Privacy Policy

1. Identity of the personal data administrator

The administrator of your personal data is Shroom sp. z o.o. with its registered office in Olsztyn (KRS: 0000932953, VATEU 7162830959), which manages the www.shroom4you.com website.

2. Contact details

Contact with the Administrator in matters related to personal data protection is possible through:

1. correspondence address: ul. Towarowa 20b, 10-417 Olsztyn, Poland
2. e-mail address: hii@shroom4you.com.

3. Purposes of processing and legal basis of personal data processing

Your personal data will be processed in order to:

1. the performance of the contract for the provision of services by electronic means, which enable you to purchase goods and services on www.shroom4you.com website and maintain an account on the website, which enables you to use the services offered by the Administrator (Article 6(1)(b) of the GDPR). Thanks to your personal data, we can provide services to you, which would not be possible without the processing of personal data.
2. to contact you on matters related to the Administrator’s business and to answer your questions when you contact us, which is the fulfilment of the Administrator’s legitimate interest in being able to communicate on matters related to the Administrator’s business (Article 6(1)(f) GDPR). 
3. to perform legal obligations related to the performance and settlement of the contract (e.g. issuing and recording invoices) – (Article 6(1)(c) GDPR in connection with the Value Added Tax Act (in particular Article 112) and in connection with the Tax Ordinance, in particular Article 86). Generally applicable regulations imply the obligation to keep records related to the performance of the contract also after the end of the contract, so you must be aware that your personal data will not be deleted immediately after the performance of the contract.
4. to comply with legal obligations relating to the provision of personal data at the request of authorised state authorities (Article 6(1)(c) GDPR in conjunction with Article 18(6) of the Act on Provision of Electronic Services in conjunction with the relevant provision of national law, which allows state authorities to obtain personal data for the purposes of their investigations). Generally applicable regulations oblige us to make data on our service recipients available if requested by an authorised authority. As a matter of principle, however, we do not make such personal data available to entities other than state authorities (e.g. for the purposes of private prosecution).
5. to carry out analyses of users’ activities, as well as of their preferences in order to improve the functionalities used, if the user agrees to this by means of a cookie management tool (Article 6(1)(a) GDPR), as well as to carry out marketing activities based on information from cookies, if the user agrees to this (Article 6(1)(a) GDPR). The fulfilment of these purposes is made possible by cookies, which we may collect on our website, but only with your consent expressed by adjusting your selection via the cookie management tool. For the sake of readability, we have prepared a separate document describing how cookies work (Cookie Policy).
6. Satisfaction surveys and improving the quality of the services provided, which is the Administrator’s legitimate interest in being able to improve the quality of the services provided (Article 6(1)(f) GDPR). We want our services to meet the expectations of our customers, so from time to time we may ask for your opinion on our services – however, if you choose not to share your opinion on our services, it is possible to object to the processing of your personal data for this purpose.
7. to provide network security, including preventing unauthorised access to electronic communications and preventing damage to computer systems, which is our legitimate interest in being able to provide our services in a secure manner (Article 6(1)(f) of the GDPR).
8. the establishment, investigation or defence of claims, which is our legitimate interest in protecting our case in the event of a potential dispute at a judicial or pre-court stage (Article 6(1)(f) GDPR). For this purpose, we may retain, among other things, information from correspondence carried out, information about services provided and other information that we consider useful in the event of a potential dispute.
9. to send you marketing information about the Administrator’s services and activities via email, but only if you have consented to the marketing contact (Article 6(1)(a) GDPR).
10. In order to protect against abuse of our online forms, as well as to protect against spam, we use the Google reCAPTCHA service for some of the forms on this website. By verifying manual input, this service prevents automated software (so-called bots) from taking abusive actions on the website.  This serves under Article 6(1)(f) of the GDPR to protect our legitimate interest within the framework of the balance of interests relating to the protection of our website against abuse and the uninterrupted display of our online service.

4. Categories of recipients of your personal data
   
   Your personal data will be processed by the following entities with whom we cooperate in:

1. Google Ireland Limited;
2. Cloudflare, Inc.;
3. provider of e-mail communication tool;
4. entities providing legal services, accounting services, tax services and other advisory, analytical and marketing services, 
5. hosting services;
6. banks and financial services intermediaries.

5. Period of storage of your personal data
   
   Your personal data processed for:
   

1. the performance of the contract for the provision of services by electronic means, will be processed until all services under the contract have been provided and, if you have an account with www.shroom4you.com, until it is deleted. We would also like to remind you that we may delete your account on our own under the terms and conditions set out in the terms and conditions.
2. to contact you on matters related to the Administrator’s business and to answer questions from customers and potential customers, your personal data will be processed for a period that allows for the continuity of the correspondence. Thereafter, this personal data may be archived and stored in accordance with the retention period for the purpose of establishing, investigating or protecting against claims.
3. to perform legal obligations related to the performance and settlement of the contract (e.g. issuing and recording invoices), will be processed for the period of the statute of limitations of the tax liability, effective at the end of the calendar year.
4. maintaining compliance with legal obligations related to the provision of personal data at the request of authorised state authorities, will be processed on an ad hoc basis and then in accordance with the purpose in the form of contact in matters related to the activities of the Administrator.
5. analyses of users’ activities, as well as their preferences in order to improve the functionality used, as well as conducting marketing activities based on information from the so-called cookies, will be processed for the period indicated in the cookie management tool, as a rule not longer than one year. It is also possible to withdraw consent for this purpose of processing in advance, which will result in the discontinuation of the processing of personal data.
6. satisfaction surveys and improving the quality of the services provided will be processed on an ad hoc basis and then in accordance with the purpose of contacting you on matters related to the Administrator’s activities, unless you object in advance to the processing of your personal data for this purpose.
7. to ensure network security, including the prevention of unauthorised access to electronic communications and the prevention of damage to computer systems, will be processed on an ad hoc basis, allowing us to ensure an adequate level of security.
8. establishing, investigating or defending against claims, will be processed until the claims are time-barred or until the possibility of an administrative fine is barred.
9. sending you information about the Administrator’s services and activities via email, will be processed until you withdraw your consent. We may also decide to stop sending this type of information earlier when we consider that this type of communication is not effective. It is also possible to withdraw consent for this purpose of processing earlier, which will result in the cessation of the processing of personal data.
10. to introduce security measures connected within the Google Captcha tool will be processed for the duration of your use of the website.
11. Rights in relation to the processing of your personal data
    
    In connection with the processing of your personal data, you have the right to:

1. access to the content of your data (Article 15 GDPR)
2. rectification of your data (art. 16 GDPR)
3. erasure of your data (art. 17 GDPR)
4. restriction of data processing (Art. 18 GDPR)
5. data portability (Art. 20 GDPR)
6. to object to the processing (art. 21 GDPR)
7. not to be subject to decisions taken under automated data processing conditions, including profiling (Article 22 GDPR)

Whenever the legal basis for the processing of your personal data is consent, you may withdraw it at any time, but this does not affect the lawfulness of the processing carried out before the withdrawal of consent.

Exercising these rights is possible under the terms of the GDPR, after contacting the Administrator in advance.

7. Transfer of personal data outside the European Economic Area
   
   Your data may be transferred to service providers that are based outside the European Economic Area, i.e. in the United States. The legal basis for the transfer will be the Standard Contractual Clauses. The content of these clauses is publicly available online in the EUR-lex electronic database of European Union legislation. Due to potential access to your data by services from the United States, we have safeguards in place to ensure the security of such transfers, e.g. encryption. If you would like to know more about such a transfer, please contact us. 

8. Right to lodge a complaint
   
   If you consider that the processing of your data is unlawful, you have the right to lodge a complaint with the supervisory authority – the President of the Office for Personal Data Protection. Nevertheless, we would like to inform you that we respect the privacy of our users and it is one of the most important values of our company, so we recommend that you contact us before taking such action – we will certainly find a solution.
   
   

4. COOKIES POLICY

1. Basic informations about cookies

We use cookies on our website. Cookies are small pieces of text which a website sends to your browser and which your browser sends back the next time you visit the website. Cookies do not normally allow direct identification of the user. We use the following types of cookies: 

• Cookie storing whether a user has logged in
• A cookie storing form autocomplete data
• A cookie storing products added to a wish list
• Cookies from external service providers used on the website – e.g. Paypal, Dotpay – according to the policy of external service providers

If you want to learn more about how cookies work in detail, we encourage you to read the information about cookies on Wikipedia. You can also find information about cookies at https://allaboutcookies.org/what-is-a-cookie. You can also contact us through the contact form. 

2. Purposes for storing and accessing cookies. Information on third party tools.
The scope and purpose of the cookies we use depends on your consent, which is given via the cookie management tool (Article 6(1)(a) GDPR). You can withdraw this consent at any time, but this does not affect the lawfulness of the processing carried out before the withdrawal of consent. Since, within the framework of cookies, part of the information may constitute personal data, we also suggest you read our Privacy Policy, in which we describe the principles on which we process personal data.

As part of the use of cookies, part of the information may be transferred to service providers that are based outside the European Economic Area, i.e. in the United States. The legal basis for the transfer will be the Standard Contractual Clauses. The content of these clauses is publicly available online in the EUR-lex electronic database of European Union legislation. Privacy laws in the United States may not provide the protections of the GDPR, so we do not transfer relevant information about you (so-called content) to these entities. Due to potential access to your data by services from the United States, we have safeguards in place to ensure the security of such transfers. If you would like to know more about such a transfer, please contact us. You may also choose not to consent to the use of such tools.

3. We analyze the statistics of the recipients of our website using the Google Analytics software, which provides anonymous information about the users of our website, which we use to improve it in terms of technology and website content.

According to Google Ads Data Protection Terms: Service Information, Google Analytics collects the following types of personal data:

• Online identifiers including cookies.
• IP addresses and device IDs.
• Customer IDs.

The data generated by the google analytics software is made available to Google. Each individual cookie consists of four basic parts:

Each individual cookie consists of four basic parts:

• website name: name of the domain or subdomain that set the cookie;
• cookie name: the cookie has a name that is unique on the website that set it;
• expiration date: the validity of some cookies expires after closing the browser (so-called session cookies), other cookies will be automatically deleted only after reaching the expiration date that has been set (so-called permanent cookies);
• value: this is information in the cookie file that the website uses to “remember” the previous visit.

In cookies, we store basic information about Users (e.g. ID) and information needed to optimize and correctly display the content on the website. This information is used to:

• recognizing users logging in to the website,
• registering Users’ visits, which allows to collect data helpful in making improvements to the content and navigation of the website.

4. Ability to specify the conditions for storing and accessing cookies through your software settings

It is also possible to determine the conditions for storing and accessing cookies by means of the software settings installed on the device you are using. Please refer to the instructions for the most popular web browsers.