This Policy sets out the rules for processing personal data by the Controller in connection with the use of the Galilu online store available at www.galilu.pl (“Store”), Galilu’s stationary stores and the Galilu Customer Profile, as well as the rules for using cookies and similar technologies in the Store.
I. DEFINITIONS AND THE CONTROLLER
1. The data controller is GALILU SPÓŁKA JAWNA – WARYNIA GRELA, AGNIESZKA ŁUKASIK with its registered office in Warsaw, ul. Mokotowska 26, 00-561 Warsaw, entered in the register of entrepreneurs of the National Court Register under number KRS 0000245783, NIP 5252350392 (“Controller”).
2. GDPR means Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
3. User means a natural person visiting the Store or a Galilu stationary store, using the Store’s functionalities, concluding a contract with the Controller or using the Galilu Customer Profile.
4. Personal data means information about an identified or identifiable natural person.
5. The Galilu Customer Profile means a voluntary profile maintained by the Controller in its systems in connection with servicing Galilu customers, used in particular to identify the User, assign purchase history and provide benefits and personalization of service. The Galilu Customer Profile is separate from the “My Account” in the Store and does not provide the User with access to an online account.
II. PURPOSES, LEGAL BASES AND SCOPE OF PROCESSING
The Controller processes personal data only to the extent necessary to achieve the purposes indicated below.
1. Conclusion and performance of the sales contract, documentation of sales, payment handling, delivery, returns, complaints and handling of gift vouchers and discount codes.
The scope of data includes in particular: name and surname, contact and address details, order data, payment data to the extent received by the Controller, invoice data and data necessary to handle complaints or returns. The legal basis for processing is Article 6(1)(b) GDPR, and with regard to accounting and tax obligations also Article 6(1)(c) GDPR.
In connection with electronic documentation of sales, the Controller processes data necessary to issue, transmit, make available and store e-receipts and invoices, in particular e-mail address, order number, purchase information and data required on the given sales document. The legal basis for processing is Article 6(1)(c) GDPR with regard to tax and accounting obligations and Article 6(1)(b) GDPR for handling the order and the agreed method of making documents available. Messages used to transmit sales documents do not contain marketing content and do not require consent for marketing communication.
2. Managing the “My Account” and Store functionalities.
Data provided during registration and while using the account are processed, including first and last name, e-mail address, contact details, login data and data stored in the account, e.g. order history and favorites list. The legal basis for processing is Article 6(1)(b) GDPR. If the User chooses to log in via an external provider, the Controller will receive the data shared in that process to the extent necessary to create or service the account.
3. Galilu Customer Profile, purchase history and personalization of service.
The User may voluntarily create a Galilu Customer Profile under the terms set out in the Galilu Customer Profile Rules. In connection with creating and maintaining the Profile, the Controller processes the data provided at registration, in particular first and last name, phone number, e-mail address and — if the User decides to provide it — date of birth, as well as information about purchases assigned to the Profile and use of benefits associated with the Profile. Data are processed in order to create and maintain the Profile, identify the User in Galilu stores, assign purchases to the Profile and provide benefits related to the Profile. The legal basis for processing is Article 6(1)(b) GDPR, i.e. performance of the contract regarding the Galilu Customer Profile.
The Controller may analyze information assigned to the Profile, in particular purchase history, preferences, use of offers and benefits and — if the User provides date of birth — the User’s age, in order to better tailor service, product recommendations, offers, discounts, invitations and other benefits to the User’s interests, as well as for analytical purposes and to develop Galilu’s offering. This processing may include profiling. For analysis, segmentation and development of personalization, the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR), consisting in customer relationship management, better matching of the offering and development of services. Profiling does not lead to decisions concerning the User which produce legal effects or similarly significantly affect them. Sending marketing communications to the User by e-mail, SMS/MMS or phone calls is carried out only after the appropriate consent for the given communication channel has been given.
4. Newsletter and marketing communication.
If the User gives appropriate consent, the Controller processes the e-mail address or phone number for the purpose of sending the Newsletter, commercial information and direct marketing via the channels selected by the User, in particular e-mail, SMS/MMS or phone calls. The legal basis for processing is the User’s consent (Article 6(1)(a) GDPR). Giving consent also constitutes the prior consent required by the provisions of the Electronic Communications Law. Consents for individual channels are voluntary and may be withdrawn independently at any time; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Consent to marketing communication is not a condition for creating a Galilu Customer Profile, creating a “My Account” or making a purchase. If the User has a Galilu Customer Profile, the content of communications may be tailored to their preferences as described in point 3 above. Detailed rules of the Newsletter service are set out in the Newsletter Terms.
5. Notification of product availability.
If the User uses the “Notify me” function, the Controller processes the e-mail address and information enabling identification of the product or its variant to which the request relates. Data are processed solely to send a one-time notification of product restocking. The legal basis for processing is Article 6(1)(b) GDPR, i.e. taking action at the User’s request to provide this service. The notification does not constitute subscription to the Newsletter or consent to separate marketing communication.
6. Contacting the Store.
In the case of contact by e-mail, telephone or chat, the Controller processes the data provided in the content of the inquiry, including contact details. The legal basis for processing is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in conducting communication and providing responses, and where the contact concerns the conclusion or performance of a contract — also Article 6(1)(b) GDPR.
7. Product reviews and protection against claims.
The Controller may process account data and the content of reviews, as well as data necessary to establish, pursue or defend claims. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is to ensure the security of the Store, handle disputes and protect the Controller’s rights.
8. Statistics, personalization and online advertising.
Technical data and information about using the Store, including IP address, online identifiers, device and browser data, information about activity in the Store and consent settings, may be processed via cookies and similar technologies. For technologies requiring consent, the legal basis is Article 6(1)(a) GDPR in connection with provisions regarding storing information on the end device. Details are provided in sections VI–VIII of the Policy and in the cookies settings panel.
9. Recruitment.
Data submitted in connection with recruitment, including data from the application form and CV, are processed for the purpose of conducting recruitment. Information on the rules for processing candidates’ data is provided directly in the recruitment form. If the form directs to an external service, you should also review that service’s information.
III. STORAGE PERIODS
The Controller stores data only for the period necessary to achieve the processing purpose.
1. Orders, payments, returns, complaints and settlements. Data are stored for the period required by law, including tax and accounting regulations, and thereafter until the expiration of limitation periods for claims. Sales documents or their legible visualizations made available via the electronic sales document service remain available to the User for at least 3 years from the date of sale, in accordance with the Store Regulations. The availability period under the link is not identical with the period of storage of tax and accounting documentation by the Controller. Documents stored in KSeF are subject to separate rules arising from legal provisions.
2. My Account. Data are stored for the period the account is maintained. After its deletion they are deleted or restricted, except for data whose further storage results from legal provisions or the need to establish, pursue or defend claims.
3. Galilu Customer Profile. Data processed for the purpose of maintaining the Profile are stored for the duration of the contract regarding the Profile, and after its termination may be stored for the period necessary to establish, pursue or defend claims. Data processed on the basis of the legitimate interest for analysis and personalization are processed until that interest ceases or an effective objection is lodged, but not longer than for the period the Profile is maintained, subject to data stored on other legal bases.
4. Newsletter. Data are stored until consent is withdrawn or subscription is cancelled.
5. Notification of product availability. Data are stored until the notification is sent, no longer than 12 months from the request.
6. Contact and inquiries. Data are stored for the period necessary to provide an answer and conduct correspondence, generally no longer than 30 days after the case is closed, unless further storage is justified by claims.
7. Cookies and similar technologies. Data processed on the basis of consent are stored until consent is withdrawn or until the technology’s lifetime expires, in accordance with the information available in the cookies settings panel.
IV. RECIPIENTS OF DATA AND TRANSFERS OUTSIDE THE EEA
1. Data may be disclosed to entities supporting the Controller in running its business, in particular providers of IT and hosting services, ERP and CRM systems, analytical and marketing tools, including tools used for personalization and communication automation, payment systems, courier companies, providers of accounting, legal and Newsletter services and entities handling complaints. Data may also be transferred to the product manufacturer or distributor if necessary to handle a complaint.
1a. For order handling and electronic sales documents, the Controller currently uses the BASE system (formerly BaseLinker), provided by BaseLinker sp. z o.o. with its registered office in Wrocław, and the eparagony.pl system, operated by Platforma Detalistów sp. z o.o. with its registered office in Warsaw. These providers process data on the Controller’s behalf necessary for the tasks entrusted to them, in particular order handling, system integration and transmitting, storing and making sales documents available. The scope of data depends on the tasks entrusted and may include identification and contact data, e-mail address, order number, purchase information and data contained on sales documents. In this respect the providers operate on the basis of data processing agreements, and the Controller remains responsible for the compliance of processing with the GDPR.
1b. The names of providers indicated in point 1a are informative. The Controller may change the provider for the described services while observing GDPR requirements. The change of provider alone, while preserving the described purposes, scope and legal bases of processing, does not require acceptance of the Policy or separate User consent. The Controller updates information about providers in the Policy. It informs Users separately, before implementation, about changes significant for data processing or Users’ rights. Changing the provider does not authorize extending the scope of given consents. Updating information about providers is not subject to the procedure for amending the Store Regulations.
2. Some service providers used by the Controller, including providers of IT systems, marketing and analytics tools, Newsletter services, cookies and similar technologies, may process data outside the European Economic Area. If this occurs, transfers are made using mechanisms provided by law, in particular a decision finding an adequate level of protection or the European Commission’s standard contractual clauses and — when required — additional safeguards. Information on the mechanisms used for data transfers may be obtained by contacting the Controller; current information about providers used via cookies is also available in the cookies settings panel.
V. USER RIGHTS AND CONTACT
1. The User has the right to access data and receive a copy, rectify data, erase data, restrict processing, data portability and object to processing based on the Controller’s legitimate interest. If processing is based on consent, the User may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. If data are processed for direct marketing purposes, the User may object to such processing at any time, including profiling to the extent it is related to direct marketing; after objecting, data will no longer be processed for those purposes.
2. Requests regarding personal data may be sent by post to the Controller’s registered office, by phone at 22 121 99 32 or by e-mail to [email protected].
3. The User has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of their data violates the GDPR.
4. Providing data is voluntary but may be necessary to conclude and perform a contract, create and maintain a Galilu Customer Profile, create a “My Account”, receive the Newsletter, provide an answer or consider a complaint. In the case of the Galilu Customer Profile, providing data marked as mandatory in the form is necessary to create it; other data, including date of birth, are voluntary. Failure to provide required data may make it impossible to achieve the given purpose.
5. The Controller does not make decisions concerning Users based solely on automated processing which produce legal effects concerning them or similarly significantly affect them. As part of the Galilu Customer Profile, the Controller may apply profiling described in section II point 3, used to personalize service, recommendations, offers and benefits. Independently, personalization of content or online advertising via cookies and similar technologies is carried out in accordance with the User’s settings described in sections VI–VII of the Policy.
VI. COOKIES AND SIMILAR TECHNOLOGIES
1. The Store uses cookies and similar technologies that may write to or read information on the User’s end device. They allow, among other things, m.in. ensuring the proper functioning of the Store, remembering settings, measuring traffic, personalizing content and carrying out advertising activities.
2. Cookies may be session (deleted after the browser session ends) or persistent (remaining on the device for the period specified in the settings of that file or until removed by the User).
3. The current list of files, similar technologies, their providers, purposes and lifetimes is made available in the cookies settings panel. The panel is part of this information and is updated with changes to the Store’s configuration.
VII. COOKIE CATEGORIES AND CONSENT SETTINGS
1. The Store uses the following categories of cookies and similar technologies:
a. essential – necessary to provide basic functions and Store security, including handling consent settings; do not require consent if they meet the conditions of necessity;
b. analytical – used to analyze traffic and how the Store is used and to improve its operation;
c. personalization – enabling adjustment of content or functions to the User’s preferences;
d. advertising – enabling measurement of campaign effectiveness and showing ads tailored to the User’s interests, also outside the Store.
2. Analytical, personalization and advertising cookies and similar technologies are activated after obtaining the User’s consent. Consent is voluntary and may be withdrawn as easily as it was given.
To change selected consents, choose: “Change cookie settings”.
3. The User may also remove or limit cookies in their browser settings. Changing browser settings does not replace the choice made in the cookies panel; limiting some technologies may affect the operation of selected Store functions.
VIII. SECURITY AND POLICY CHANGES
1. The Controller applies appropriate technical and organizational measures to protect personal data against access by unauthorized persons, loss, destruction, alteration or unlawful disclosure. Access to data is granted only to authorized persons and entities, to the extent necessary to perform their tasks.
2. The Policy may be updated in particular in the event of changes in law, processing processes or technologies used by the Controller. The current version is published on www.galilu.pl.
3. The Policy is effective from the date of its publication on www.galilu.pl.
Curated
Selection
Authenticity Guarantee
Free samples with every order*
Free delivery from PLN 500
Gift Wrapping
Oferta
Proceed to Checkout