Privacy Policy

„Looty”

The Privacy Policy aims to provide you with the most important information about the purposes and basis for which we use your personal data when you visit the website of the Service, contact us, enter into business relations with us (e.g. you are the owner of an Account or place orders). In the Privacy Policy you will also find information about our use of cookies and similar technologies.

The administrator of your personal data processed for the purposes described in the Privacy Policy is Artur Wajchert, ul. Cegielniana 60, 47-400 Racibórz You can contact us:

• to the e-mail address: info@looty.pl

BASIC INFORMATION

The following terms used in the Privacy Policy have the following meanings:

• Administrator - an entity that independently or jointly with others determines the purposes and methods of processing personal data (i.e. decides why and how personal data are to be used);
• personal data – any information about an identified or identifiable natural person; an identifiable person is a person who can be identified, directly or indirectly, e.g. based on an identifier such as a name and surname, identification number, location data, online identifier or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person,
• … or we – … ,
• processing – an operation or set of operations performed on personal data or sets of personal data in an automated or non-automated manner, such as collecting, recording, organizing, arranging, storing, adapting or modifying, downloading, browsing, using, disclosing by transmission, disseminating or otherwise making available, matching or combining, limiting, deleting or destroying,
• GDPR – Regulation of the European Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC,
• Service – an internet service operated at www.looty.pl or in a version for mobile devices such as smartphones etc.,
• User – any person who uses the Service 
• Account – a service provided electronically by the Administrator.
• Order – a sales transaction handled via the Account.

YOU ARE USING AN ACCOUNT MAINTAINED ON THE SERVICE, PLACING ORDERS

We process your data for the purpose of:

• providing the Account service in connection with the performance of the agreement on its maintenance (Article 6 paragraph 1 letter b of the GDPR);
• fulfilling Orders placed and managed via the Account (Article 6 paragraph 1 letter b of the GDPR);
• determining, pursuing or defending against claims (Article 6 paragraph 1 letter f of the GDPR) based on the legitimate interest of the administrator, which consists in defending against or pursuing claims;
• keeping statistics and improving the quality of services provided, i.e. based on the legitimate interest of the Administrator, consisting in the possibility of developing the conducted business activity (Article 6 paragraph 1 letter f of the GDPR);
• making accounting and tax settlements, i.e. in connection with the fulfillment of public law obligations incumbent on the Administrator (Article 6 paragraph 1 letter c of the GDPR);

IF YOU USE THE SERVICE WITHOUT REGISTERING AN ACCOUNT, YOU HAVE SUBSCRIBED TO THE NEWSLETTER

Your personal data for the purpose of:

• making the content on the Service available to you (Article 6, paragraph 1, letter b of the GDPR);
• establishing, pursuing or defending against claims (Article 6, paragraph 1, letter f of the GDPR);
• for the purpose of keeping statistics and improving the quality of services provided, i.e. based on the legitimate interest of the Administrator, consisting in the possibility of developing the conducted business activity (Article 6, paragraph 1, letter f of the GDPR);
• conducting direct marketing and sending commercial information (newsletter), based on the consent granted to the processing of personal data for this purpose (Article 6, paragraph 1, letter a of the GDPR).

COMMON INFORMATION

Data recipients

We may disclose your personal data to external entities (data recipients). These are primarily providers of hosting services, couriers, e-mail providers and other IT services, companies providing accounting, auditing and legal services to us.

We may also disclose personal data to competent public authorities (e.g. courts, law enforcement agencies) or third parties who submit a request for such information. Data will only be disclosed if there is an appropriate legal basis for this (e.g. a legal provision requiring the disclosure of personal data) and in accordance with applicable law.

Transfer of personal data outside the European Economic Area

The level of protection of personal data outside the European Economic Area (EEA) may be lower than that in force in Poland and other EEA countries. Therefore, we have adopted the principle that we do not transfer personal data outside the EEA that allows for direct identification of anyone.

Personal data storage period

The period for which we store personal data depends on the purpose of processing. In some cases, the storage period may also result from legal regulations.

• In the case of processing personal data based on our legitimate interest, we store the data for the period necessary to pursue this interest or until you effectively object to the processing of personal data.
• If we process personal data based on consent, we store the data until it is withdrawn, unless it becomes unnecessary to achieve the purpose for which we collected it earlier.
• In the event that the basis for processing is the necessity to conclude and perform a contract, we will store the data for the duration of such contract. The period for storing personal data may be extended when processing is necessary to establish, pursue or defend against potential claims. In such a case, we store the data until the limitation period for property claims expires.
• In the case of personal data processed in order to fulfill our legal obligations, we store the data for the period required by law. Due to the significant number of legal regulations, the period for storing data varies. As an example, in the case of data stored for tax purposes, this period is usually 5 years, and is counted from various events (e.g. in the case of tax documentation, the period of 5 years is - as a rule - counted from the end of the calendar year in which the tax payment deadline expired).
• In the case of data processing for the purpose of determining, pursuing and defending against claims, we store the data until the claims are time-barred.

Rights of data subjects

The persons whose personal data we process as the administrator have the following rights in accordance with the GDPR:

• The right to request access to their personal data from the administrator: This means that each data subject may obtain information from us about how and to what extent we process their personal data and may additionally obtain a copy of their personal data.
• The right to request that the administrator rectify their personal data: This means that each data subject may request that we rectify (correct) their personal data, e.g. if they have been incorrectly recorded or if they have changed.
• The right to request that the administrator delete their personal data: This means that each data subject may request that we delete their personal data if there is no basis for us to process this data or if there are other circumstances provided for in the GDPR.
• The right to demand that the controller restrict the processing of personal data: This means that every data subject may demand that we process their personal data only to a limited extent, until the objection of the data subject to the processing of their data is considered or until their request for rectification is considered, or in the event that the data subject wants their data to be stored by us in connection with their claims or in connection with the determination of unlawful processing.
• The right to transfer personal data: If the processing of personal data by us is based on consent (Article 6 paragraph 1 letter a GDPR) or on the basis of a contract (Article 6 paragraph 1 letter b GDPR) and is carried out in an automated manner (e.g. by computer), the data subject has the right to demand that we provide their personal data that they have provided to us in a structured, commonly used, machine-readable format. Such a person may independently transfer such personal data to another controller of their choice. In addition, if technically possible, while maintaining appropriate security standards, we may, at the request of the data subject, transfer the personal data to another designated controller. The right to data portability must not adversely affect the rights and freedoms of others.
• Right to object to processing: If we process personal data based on a legitimate interest (Article 6, paragraph 1, letter f of the GDPR), the data subject may object to such processing on grounds relating to their particular situation. We will then examine the objection in terms of the existence of compelling legitimate grounds for our processing of the personal data that override the interests, rights and freedoms of the data subject, or grounds for us to assert or defend against claims. In the event of an effective objection, we may no longer process the personal data to which the objection relates.
• If we process personal data for direct marketing purposes, each data subject may object to such processing at any time. This objection does not require any justification. In the event of receipt of such an objection, we will no longer process the data of the person who filed the objection for the purposes of direct marketing.
• Right to withdraw consent to the processing of personal data: To the extent that we process personal data based on consent, the data subject may withdraw such consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. In order to withdraw consent, you can contact us, e.g. at the e-mail address or correspondence address indicated in the Privacy Policy.
• Right to lodge a complaint with a supervisory authority: If the data subject believes that our processing of their personal data is unlawful, they have the right to lodge a complaint with a supervisory authority responsible for the protection of personal data. In Poland, the supervisory authority is the President of the Personal Data Protection Office.

The rights referred to above are implemented in accordance with the provisions of the GDPR. In order to exercise your rights, you can contact us using the contact channels indicated in the Privacy Policy.

Changes to the Privacy Policy

We review the Privacy Policy on an ongoing basis and update it if necessary