Privacy Policy

CLICK2DROP PRIVACY POLICY

§ 1. Controller and Contact

1. The controller of personal data processed in connection with the use of the https://click2drop.eu/ website and the https://click2drop.eu/app application is ADAMANTA spółka z ograniczoną odpowiedzialnością z siedzibą w Lublinie, ul. Metalurgiczna 62, 20-234 Lublin, KRS (National Court Register) 0001078676, NIP (Tax Identification Number) 7123467638, REGON (National Business Registry Number) 527332151 (hereinafter: “we”/”us”/”our”).

2. For matters concerning personal data, you may contact us via e-mail at support@click2drop.eu or by mail at our registered office address.

3. This Policy applies to website visitors, Account holders, representatives of business partners, individuals who contact us and persons whose data are provided in connection with the fulfilment of orders and delivery of shipments. It also applies to retail customers in cases where we ourselves act as the seller.

4. This Policy provides information regarding the processing of personal data, as required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Information on the use of cookies and similar technologies can be found in a separate Click2Drop Cookie Policy.

§ 2. Data categories and sources of acquisition

1. Depending on how you use the website, we process identification and contact data, data regarding the business entity and its representatives, delivery addresses, Account details, order and payment history, complaints, and the content of correspondence.

2. When you use the website, the following may be processed: IP addresses, session and device identifiers, data stored in essential cookies, and logs used to ensure the security and operation of the application.

3. We receive data directly from individuals using the website, from business partners, and from persons authorised to manage an Account and to the extent necessary for the performance of a contract, we also obtain data from payment providers, carriers, and public registers.

4. In the case of shipments sent directly to the end customer, the Buyer provides us with the data necessary for delivery, typically including the recipient’s full name, address, phone number or email address, and the Order number.

§ 3. Purposes and legal grounds for processing

1. Data of individuals who enter into a contract directly with us are processed for the purpose of entering into and performance of such a contract (Article 6(1)(b) of the GDPR). Data of representatives of business entities who manage an Account are processed to the extent necessary for the purpose of the business relationship, pursuant to Article 6(1)(f) of the GDPR.

2. Data of contractors' representatives and employees are processed for the purpose of cooperation, confirmation of authorisations and contact based on the legitimate interests pursued by us and by the contractor (Article 6(1)(f) of the GDPR).

3. Data covered by sales documentation, invoices and settlements are processed for the purpose of fulfilling legal obligations, including tax, accounting and KseF(National e-Invoice System)-related obligations (Article 6(1)(c) of the GDPR).

4. Data concerning complaints and returns are used for processing claims and fulfilling contractual and legal obligations (Article 6(1)(b) or (c) of the GDPR).

5. Data provided in correspondence is used to respond and maintain contact in connection with our activities (Article 6(1)(f) of the GDPR).

6. Technical data serves to secure the website, detect abuse and protect against unauthorised access (Article 6(1)(f) of the GDPR).

7. Data necessary to establish, pursue and defend claims are processed on the basis of the legitimate interests pursued by us (Article 6(1)(f) of the GDPR).

8. Commercial information is sent via electronic channels only upon receipt of the required consent, in particular pursuant to Article 398 of the Electronic Communications Law. Personal data used for marketing purposes are processed on the appropriate legal grounds as defined in Article 6 of the GDPR. Consent may be withdrawn at any time.

9. Analytical and marketing cookies, as well as similar technologies that require consent, are only activated once such consent has been provided. If these technologies allow for the identification of an individual, the data derived from them is processed in accordance with the relevant provisions of the GDPR.

§ 4. Recipient data in fulfilment services

1. When we deliver a shipment to a business entity which then sells the Goods to its own customer, we process the recipient data as a data processor, within the scope defined by a data processing agreement. The business entity requesting the shipment remains the controller for the recipient's data.

2. The data provided is used for preparing shipping documents, order picking, handing it over to the carrier, and managing the delivery and any potential returns.

3. If we determine purposes of processing by ourselves, for example, in connection with our own sales, tax settlements, security, or the pursuit of legal claims, we act in this regard as a separate controller.

4. The recipient of a shipment may also obtain information regarding the use of their data from the business with which they placed their order. Regarding data processing carried out by us, such recipient may contact us at the following address: support@click2drop.eu.

§ 5. Payment and Trade Credit Limit data

1. Card payments are processed by an external payment service provider. We receive information regarding the payment status, as well as the data required for its settlement. If a card is saved to an Account, the system may use a payment identifier, without transmitting the CVV code to us.

2. In relation to Buyers using deferred payment, we analyse order and payment history, outstanding balances, and available registration data for the purpose of determining and monitoring a Trade Credit Limit (Article 6(1)(f) of the GDPR).

3. Decisions regarding the Trade Credit Limit may be supported by IT tools. If we implement automated individual decision-making, which produces legal effects concerning natural persons or similarly significantly affects natural persons, we will provide the required information and ensure the rights set forth in Article 22 of the GDPR.

§ 6. Recipients of personal data

1. Data is shared only to the extent necessary to fulfil a specific purpose, in particular, with IT and hosting service providers, payment processors, carriers, warehousing entities, as well as providers of accounting, legal, and debt collection services.

2. Data may also be shared with authorised public authorities, including tax authorities, while information from invoices may be accessed via KSeF, to the extent required by law.

3. Some entities that provide services to us act on our behalf as data processors. Others, in particular, certain payment service providers and carriers, may act as independent data controllers.

§ 7. Transfer of data outside the European Economic Area

1. Data may be transferred outside the European Economic Area if this arises from the use of certain IT services or cooperation with foreign entities.

2. The transfer of data outside the European Economic Area takes place solely on the basis of a mechanism permitted under Chapter V of the GDPR, in particular an adequacy decision by the European Commission or standard contractual clauses.

3. Information regarding the safeguards in place for the transfer of data outside the EEA can be obtained at support@click2drop.eu.

§ 8. Data retention period

1. Account data are stored for the duration of the account's existence, and following its closure, for the period required by law or necessary for the settlement of contracts and the protection of claims.

2. Sales and accounting documents are retained for a period as required by tax and accounting laws, and, to the extent justified, until the expiry of the limitation periods for claims.

3. Data related to complaints and correspondence are retained in the records until the matter is resolved, as well as for the period necessary to demonstrate how it was handled and for the protection against potential claims.

4. Data processed on the basis of consent are used until such consent is withdrawn or the purpose for processing ceases to exist. Information regarding the granting and withdrawal of consent may be retained for the purpose of demonstrating legal compliance.

5. Technical data are stored for the period necessary to ensure the security of the website. The retention periods for cookies are specified in the Cookie Policy and in the list available in the preferences panel.

§ 9. Rights of data subjects

1. Data subjects may request access to their data, its rectification, erasure, or restriction of processing, and, in the cases specified under the GDPR, also the portability of their data.

2. When processing is based on legitimate interests, an individual has the right to object to their processing of personal data. An objection to processing for the purposes of direct marketing may be raised at any time.

3. When processing is based on consent, it may be withdrawn at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

4. Requests regarding data protection may be sent to support@click2drop.eu. We will process them in accordance with the timeframes and principles set out in the GDPR.

5. Data subjects may lodge a complaint with the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa.

§ 10. Voluntary provision of data

1. Data required to create an Account, place an order, and issue documents are provided on a voluntary basis; however, failure to provide such data may render the provision of a selected service impossible.

2. Providing data for marketing purposes and consenting to non-essential cookies is voluntary and is not a prerequisite for making a purchase.

§ 11. Data protection measures and Policy changes

1. We employ security measures appropriate to the nature of the data and the level of risk, including, in particular, access controls, transmission safeguards, and a system for granting authorisations.

2. The Policy is updated in the event of changes to the law or to data processing principles. The current version is made available on the Click2Drop website.