Privacy policy

Privacy Policy of the website getmuslinblanket.com

For the owner of this website, protecting users' personal data is a top priority. The owner makes every effort to ensure that users feel safe when they share their personal data while using the website.

A user is a natural person, a legal person, or an organizational unit without legal personality that has legal capacity under the law, who uses the electronic services available on the website.

This Privacy Policy explains the rules and scope of processing of the user's personal data, the user's rights and the obligations of the data controller, and provides information about the use of cookies.

The controller uses technical and organizational measures that ensure a high level of protection of the personal data it processes and protect it against access by unauthorized persons.

I. Data controller

The controller of personal data is LOCALGROWTH spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office at ul. Szczęsna 26, 02-454 Warsaw, Poland, entered in the Register of Entrepreneurs kept by the District Court in Warsaw (Sąd Rejonowy w Warszawie), Commercial Division, under KRS number 0000966086, NIP: 5223223277, REGON: 521762821, EU VAT ID: PL5223223277 (the "Owner"), represented by Filip Henryk Sobczyk, President of the Management Board (Prezes Zarządu). Full company details are available in our Legal Notice.

Contact for personal data matters: contact@getmuslinblanket.com, phone: +48 531 200 820, mailing address: ul. Szczęsna 26, 02-454 Warsaw, Poland.

II. Purposes of processing personal data

The controller processes the user's personal data for the following purposes:

  • Managing the customer account: we let you create a customer account in our online store, so you can view your order history and track the status of current orders. Processing is necessary to perform the contract for maintaining the customer account under the rules described in our store's Terms of Service (legal basis: Art. 6(1)(b) GDPR).
  • Completing sales: personal data is necessary to receive payment, deliver the ordered goods, issue sales documents and settle the transaction. We process the data because this is necessary to perform the sales contract and to comply with legal obligations under tax regulations (legal basis: Art. 6(1)(b) and (c) GDPR).
  • Handling complaints and refunds: if you file a complaint or request a refund, we process the data to handle the complaint or the refund. This is necessary to perform the contract and to comply with legal obligations related to the seller's liability for the conformity of goods with the contract (legal basis: Art. 6(1)(b) and (c) GDPR).
  • Posting product reviews: we let you add reviews of products available in our store. Processing is necessary to perform the contract for providing the review service (legal basis: Art. 6(1)(b) GDPR).
  • Marketing: we want to learn the user's opinion about our products, promote our offers and send personalized offers and promotions. We process data from our marketing database on the basis of legitimate interests under Art. 6(1)(f) and Recital 47 GDPR.
  • Marketing profiling: to carry out marketing, we use profiling that does not affect the user's rights or freedoms. The basis for processing is our legitimate interest in promoting our products (Art. 6(1)(f) GDPR).
  • Marketing communications: if the user consents to receive marketing communications (including a newsletter) by electronic means or by phone, we will use their email address or phone number to send our store's commercial offers. The basis for processing is voluntary consent, which can be given, for example, by signing up for the newsletter (Art. 6(1)(a) GDPR).
  • Answering questions: if the user asks a question or raises a concern, we process the data to respond. The basis for processing is our legitimate interest in giving customers and users complete information and a positive experience (Art. 6(1)(f) GDPR).

This means that the data is needed in particular to:

  • register on the website,
  • enter into a contract,
  • settle payments,
  • deliver the goods ordered by the user.

The user may also consent to receive information about new products and promotions. In that case, the controller will process personal data to send commercial information about, among other things, new products, promotions or sales.

Personal data is also processed to fulfill the controller's legal obligations, including those related to keeping tax records.

Personal data may also be processed for direct marketing of products, and to establish, pursue or defend claims by the user or a third party.

III. Types of data

The controller processes the following personal data, which must be provided in order to:

a. Register on the website:

  • first and last name,
  • email address.

b. Make purchases through the website:

  • first and last name,
  • shipping address,
  • phone number,
  • email address.

c. Data the user provides voluntarily:

  • tax identification number (if you request an invoice for a business).

IV. Legal basis for processing personal data

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88 ("GDPR").

Consent to the processing of personal data for marketing purposes is completely voluntary. Providing the data needed to fulfill an order is a condition for entering into and performing the sales contract.

V. User rights

  • The user may at any time ask the controller for information about the scope of processing of their personal data (Art. 15 GDPR).
  • The user may at any time request the correction of their personal data. The user can also do this on their own after signing in to their account (Art. 16 GDPR).
  • The user may withdraw their consent to the processing of personal data at any time, without giving a reason. The withdrawal may apply to a specific purpose, for example receiving commercial information, or to all purposes of processing. Withdrawing consent does not affect actions already taken (Art. 7(3) GDPR).
  • The user may at any time, without giving a reason, request that the controller delete their data. Deleting the data also means deleting the user's account together with all personal data stored so far (right to erasure, Art. 17 GDPR).
  • The user may at any time object to the processing of personal data, either for all data or to a limited extent, for example regarding processing for a specific purpose (Art. 21 GDPR).
  • The user may request that the processing of personal data be restricted, for a set period or without a time limit, to a specified extent (Art. 18 GDPR).
  • The user may request that the controller transfer the personal data it processes to another entity. To do so, send a request to the controller stating the name and address of the entity and the scope of the data. After the request is confirmed, the controller will transfer the data in electronic form. Confirmation is required for the security of the user's personal data (right to data portability, Art. 20 GDPR).
  • The user has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). The user may also lodge a complaint with another supervisory authority, in particular in the EU member state of their habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

The controller will inform the user of the actions taken within one month of receiving any of the requests listed above.

VI. How long we keep personal data

Personal data is kept only as long as necessary to fulfill the contractual or legal obligations for which it was collected. The data will be deleted when keeping it is no longer necessary for evidence purposes under civil law or because of a legal obligation to retain data.

Contract information is kept for evidence purposes for three years, starting from the end of the year in which the business relationship with the user ended. The data will be deleted after the statutory limitation period for contractual claims expires.

In addition, the controller may keep archived information about completed transactions, because keeping it is related to claims the user may have, for example under the seller's liability for defects.

If no contract has been concluded between the user and the Owner, personal data is kept until the user's account on the website is deleted.

VII. Sharing data processing with other entities

The controller may entrust the processing of personal data to entities that work with the controller, to the extent necessary to complete transactions. Examples include preparing the ordered goods, delivering packages, processing payments, or sending the controller's commercial information (this applies to users who have consented to receive commercial information).

Recipients and processors (names): Shopify International Limited (Ireland), as the operator of the store platform and a data processor; the payment providers offered at checkout; the shipping provider we use for delivery; providers of additional store features (customer reviews through Loox, volume discounts through Kaching Bundles); Meta Platforms Ireland Limited (Facebook/Instagram), if you have consented to the relevant marketing cookies.

Apart from the purposes described in this Privacy Policy, users' personal data will not be made available to third parties in any way, or passed on to other entities so that those third parties can send their own marketing materials.

This Privacy Policy complies with Art. 13(1) and (2) GDPR.

VIII. Transfers to third countries

When we use the service providers listed above, personal data may be transferred to third countries outside the EU/EEA, in particular to the United States and Canada.

Such transfers are based on an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework, if the recipient is certified) or on EU Standard Contractual Clauses under Art. 46 GDPR.

IX. Cookies

Our store uses cookies and similar technologies.

We use strictly necessary cookies (for example for the cart, checkout, security and language settings) on the basis of Art. 6(1)(f) GDPR.

We use non-essential cookies and tracking technologies (for example Meta analytics and marketing pixels, and customer review services) only with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.