Privacy Policy

PRIVACY POLICY OF THE ONLINE STORE
WWW.THELUCKYRIVER.COM

§ 1
GENERAL PROVISIONS

1. The administrator of personal data collected via the online store www.theluckyriver.com is Dominika Ewa Misiura-Radziewicz conducting business activity under the company name FI_STUDIO - DOMINIKA MISIURA-RADZIEWICZ, entered into the Central Registration and Information on Business of the Republic of Poland maintained by the minister competent for economic affairs, with the place of business and correspondence address: ul. Stanisława Spychalskiego 32/1, 45-716 Opole, NIP: 9910441384, REGON: 161538341, email address: dominika.misiura@op.pl, phone number: +48 698906989, hereinafter referred to as the "Administrator" and also being the "Service Provider".

2. Personal data collected by the Administrator via the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.

3. Any words or expressions written in this Privacy Policy with a capital letter should be understood in accordance with their definition set out in the Terms and Conditions of the online store www.theluckyriver.com.

§ 2
TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Administrator processes personal data of the Service Recipients of the store www.theluckyriver.com in the following cases:
   1.1. account registration in the Store, for the purpose of creating an individual account and managing this Account, based on Art. 6(1)(b) GDPR (performance of a contract for the provision of electronic services in accordance with the Store Regulations),
   1.2. placing an order in the Store, for the purpose of performing the sales contract, based on Art. 6(1)(b) GDPR (performance of a sales contract),
   1.3. using the Review System, in order to obtain the Customer's opinion on the Sales Agreement concluded with the Administrator, based on Art. 6(1)(f) GDPR (legitimate interest of the business).

2. TYPE OF PERSONAL DATA PROCESSED. The Service Recipient provides, in the case of:
   2.1. Account: first and last name, login, home address, email address.
   2.2. Order: first and last name, address, VAT number, email address, phone number.
   2.3. Review System: first and last name, email address.

3. PERIOD OF PERSONAL DATA RETENTION. The Service Recipients' personal data is stored by the Administrator:
   3.1. if the basis for processing the data is the performance of a contract, for as long as necessary to perform the contract, and after that time for a period corresponding to the statute of limitations for claims. Unless otherwise provided by specific provisions, the statute of limitations is six years, and for claims related to periodic performance and business activities – three years.
   3.2. if the basis for processing the data is consent, until the consent is withdrawn, and after withdrawal for a period corresponding to the statute of limitations for claims that may be raised by the Administrator and against him. Unless otherwise provided by specific provisions, the statute of limitations is six years, and for claims related to periodic performance and business activities – three years.

4. During the use of the Store, additional information may be collected, in particular: the IP address assigned to the Service Recipient's computer or an external IP address of the Internet provider, domain name, browser type, access time, and type of operating system.

5. With separate consent, based on Art. 6(1)(a) GDPR, the data may also be processed for the purpose of sending commercial information electronically or making telephone calls for direct marketing – respectively in connection with Art. 398(1) and (2) of the Act of July 12, 2024 – Electronic Communications Law, including those resulting from profiling, provided the Service Recipient has given the relevant consent.

6. As part of the User's activity in the Store, profiling may occur, aimed at selecting appropriate advertising content to be directed to the User.

7. Profiling means any form of automated processing of personal data that involves using personal data to evaluate certain personal factors of a natural person, in particular to analyze or predict aspects concerning that person's work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movement. Profiling does not produce legal effects for the Service Recipient nor significantly affects his or her situation. Its sole purpose is to better tailor marketing content and offers.

8. Navigational data may also be collected from Service Recipients, including information about links and references they choose to click on or other activities undertaken in the Store. The legal basis for such actions is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting of facilitating the use of services provided electronically and improving the functionality of these services.

9. Providing personal data by the Service Recipient is voluntary.

10. The Administrator takes special care to protect the interests of individuals whose data is processed, and in particular ensures that the data collected is:
    10.1. processed lawfully,
    10.2. collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes,
    10.3. substantially correct and adequate in relation to the purposes for which it is processed, and stored in a form that allows identification of the data subjects for no longer than is necessary to achieve the purpose of processing.

§ 3
SHARING PERSONAL DATA

1. The Service Recipients' personal data is provided to service providers used by the Administrator in the operation of the Store, in particular to:
   1.1. entities delivering Products,
   1.2. payment system providers,
   1.3. accounting office,
   1.4. hosting provider,
   1.5. software providers enabling business operations,
   1.6. email system providers,
   1.7. software providers necessary for running the online store.

2. The service providers referred to in point 1 of this paragraph, to whom personal data is transferred, depending on contractual arrangements and circumstances, either follow the Administrator's instructions as to the purposes and methods of processing the data (processors) or independently determine the purposes and methods of processing (controllers).

3. The Service Recipients' personal data is stored exclusively within the European Economic Area (EEA), subject to § 5 point 5 and § 6 of the Privacy Policy.

4. Personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, due to the Administrator's use of services from providers of analytical and marketing tools (e.g., Google LLC, Meta Platforms Inc.).
   The transfer of data is based on Standard Contractual Clauses (SCC) approved by the European Commission, pursuant to Art. 46(2)(c) GDPR.

§ 4
RIGHT TO CONTROL, ACCESS, AND RECTIFICATION OF PERSONAL DATA

1. The data subject has the right to access their personal data and the right to rectify, delete, restrict processing, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

2. Legal grounds for the Service Recipient's request:
   2.1. Access to data – Art. 15 GDPR.
   2.2. Rectification of data – Art. 16 GDPR.
   2.3. Deletion of data (right to be forgotten) – Art. 17 GDPR.
   2.4. Restriction of processing – Art. 18 GDPR.
   2.5. Data portability – Art. 20 GDPR.
   2.6. Objection – Art. 21 GDPR.
   2.7. Withdrawal of consent – Art. 7(3) GDPR.

3. To exercise the rights referred to in point 2, a relevant email may be sent to: biuro@theluckyriver.com.

4. In the event of a request made by the Service Recipient under the above rights, the Administrator fulfills the request or refuses to fulfill it immediately, no later than within one month of its receipt. However, if due to the complex nature of the request or the number of requests, the Administrator cannot meet the deadline within one month, it will be extended by a further two months, with prior notice to the Service Recipient within one month of receiving the request, including the reasons for the delay.

5. If it is determined that the processing of personal data violates GDPR provisions, the data subject has the right to file a complaint with the President of the Personal Data Protection Office.

§ 5
"COOKIES" FILES

1. The Administrator's website uses "cookies".

2. The installation of "cookies" is necessary for the proper provision of services on the Store's website. "Cookies" contain information necessary for the correct functioning of the website and also allow for the creation of general visit statistics.

3. Two types of "cookies" are used on the website: "session" and "permanent".
   3.1. "Session cookies" are temporary files stored on the Service Recipient's device until logging out (leaving the website).
   3.2. "Permanent cookies" are stored on the Service Recipient's device for the time specified in the parameters of the "cookies" or until deleted by the Service Recipient.

4. The Administrator uses its own cookies to better understand how Service Recipients interact with the website's content. The files collect information about how the Service Recipient uses the website, the type of website from which they were redirected, the number of visits, and the duration of the visit. This information does not record specific personal data but is used to compile website usage statistics.

5. The Administrator also uses external cookies to collect general and anonymous statistical data via analytical tools such as Google Analytics (external cookie administrator: Google LLC, based in the USA).

6. Cookies may also be used by advertising networks, in particular Google, to display advertisements tailored to how the Service Recipient uses the Store. For this purpose, they may store information about the Service Recipient's navigation path or time spent on a given page.

7. The Service Recipient has the right to decide on the access of "cookies" to their computer by:
   7.1. choosing the types of cookies they consent to collect immediately after entering the Store's website and seeing the cookies notification,
   7.2. changing settings in their browser window. Detailed information on the possibilities and ways of handling "cookies" is also available in the settings of the browser software.

§ 6
ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

1. The Store uses so-called social media plugins ("plugins") of social networking sites. By displaying the www.theluckyriver.com website containing such a plugin, the Service Recipient's browser establishes a direct connection with the servers of Facebook, Instagram, Twitter, and Google.

2. The content of the plugin is transmitted by the respective service provider directly to the Service Recipient's browser and integrated with the website. Thanks to this integration, service providers receive information that the Service Recipient's browser has displayed the www.theluckyriver.com website, even if the Service Recipient does not have a profile with that service provider or is not logged in at the time. Such information (including the Service Recipient's IP address) is sent directly by the browser to the service provider's server (some servers are located in the USA) and stored there.

3. If the Service Recipient is logged into one of the above social networking sites, the service provider will be able to directly link the visit to the www.theluckyriver.com website to the Service Recipient's profile in the respective social network.

4. If the Service Recipient uses a plugin, e.g., by clicking the "Like" button or the "Share" button, the corresponding information will also be sent directly to the service provider's server and stored there.

5. The purpose and scope of data collection and their further processing and use by service providers, as well as the rights of the Service Recipient and options for privacy protection settings, are described in the privacy policies of the service providers:
   5.1. https://www.facebook.com/policy.php
   5.2. https://help.instagram.com/519522125107875?helpref=page_content
   5.3. https://x.com/pl/privacy
   5.4. https://policies.google.com/privacy?hl=pl&gl=ZZ

6. If the Service Recipient does not want social networking sites to associate data collected during visits to the www.theluckyriver.com website directly with their profile in the respective network, they must log out of the site before visiting www.theluckyriver.com. The Service Recipient may also completely prevent the loading of plugins on the website by using appropriate browser extensions, e.g., script blocking with "NoScript".

7. The Administrator uses remarketing tools such as Google AdWords on its website, which involves using cookies from Google LLC for Google AdWords services. Within the cookie settings management mechanism, the Service Recipient can decide whether the Service Provider may use Google AdWords (external cookie administrator: Google Inc., based in the USA) concerning them.

§ 7
FINAL PROVISIONS

1. The Administrator uses technical and organizational measures to ensure the protection of processed personal data appropriate to the threats and categories of data protected, and in particular, secures data against access by unauthorized persons, acquisition by unauthorized persons, processing in violation of applicable laws, and alteration, loss, damage, or destruction.

2. The Administrator provides appropriate technical measures to prevent the acquisition and modification by unauthorized persons of personal data transmitted electronically.

3. In matters not regulated by this Privacy Policy, the provisions of GDPR and other relevant provisions of Polish law shall apply accordingly.

4. The Administrator updates this Privacy Policy in connection with legal changes or business development. Information about the modification of the Privacy Policy will be posted at least 7 days before it comes into force on the Store's website or sent by email to the Service Recipient using Electronic Services provided on a continuous basis (Account).