Privacy Policy

The controller responsible for processing your personal data is:
Mateusz Maruniak
Pogodna 16
60-275 Poznań, Poland
m.maruniak@julianessa.pl

Thank you for your interest in our online shop. Protecting your privacy is very important to us. Below you will find detailed information on how we handle your data.

1. Access data and hosting

You can visit our website without providing any personal data. Each time a page is accessed, the server automatically stores only so-called server log files, e.g. the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting internet service provider (access data), and documents the access.

This data is analysed solely to ensure the smooth operation of our website and to improve our offer. Under Article 6(1)(f) GDPR, this serves our legitimate interest in presenting our website and offer correctly and in the best possible way. All access data is deleted within seven days after the end of your visit.

2. Data collection and processing for performing the contract, contact and opening a customer account

We collect personal data only if you provide it to us voluntarily when placing an order or contacting us (e.g. via the contact form or by email). Mandatory fields are marked as such, because the data in them is necessary to perform the contract or to handle your enquiry. Without this data, you cannot complete your order or contact us. The data collected is shown in the respective input forms. We use the data you provide in accordance with Article 6(1)(b) GDPR to perform the contract and answer your enquiries. In addition, if you give your consent to opening a customer account in accordance with Article 6(1)(a) GDPR, we will process the personal data necessary for this purpose. Further information on how we process your data, in particular on passing data to our service providers for order processing, payment and shipping, can be found in the following sections of this privacy policy.

Once the contract has been fully performed or your customer account has been deleted, the processing of your data will be restricted, and after the retention periods required by tax and accounting law have expired, the data will be deleted (Article 6(1)(c) GDPR), unless you have expressly consented to further use of your data (Article 6(1)(a) GDPR) or we reserve the right to use the data for other purposes permitted by law, in which case we inform you about this in this privacy policy. You can delete your customer account at any time by sending a message to the contact address given in the section “Our contact details and your rights” or by using the relevant function in your customer account settings.

3. Passing data on for delivery

To perform the contract (Article 6(1)(b) GDPR), we pass your data on to the shipping company chosen by you during the ordering process and entrusted with delivering the products you ordered.

4. Data processing for payment

To process payments in our online shop, we work with external providers of online payment services and pass your data on to the payment service provider you choose during the ordering process. In the English version of our shop, this is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. This serves the performance of the contract (Article 6(1)(b) GDPR).

Data processing for fraud prevention and payment optimisation
In some cases, we may give our service providers additional information, which they may use together with the information required to process the payment. These service providers then act on our behalf as processors and provide us with services for fraud prevention and optimising payment processes (e.g. invoicing, handling disputed payments, accounting support). Under Article 6(1)(f) GDPR, this serves our legitimate interests in protection against misuse and fraud and in efficient payment management.

5. Marketing by email

Newsletter
If you subscribe to our newsletter, we use the data you provide to send you our newsletter regularly by email, based on your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time by sending a message to the contact address given in the section “Our contact details and your rights” or by using the link in the newsletter. After you unsubscribe, we will delete your email address, unless you have expressly consented to further use of your data for other purposes or we reserve the right to further use the data in cases permitted by law, in which case we inform you about this in this privacy policy.

Invitations to review your purchase
If you have given your consent during or after placing your order (Article 6(1)(a) GDPR), we will use your email address to send you an invitation to review your purchase from our shop. Reviews are submitted through the review system we use. You can withdraw your consent at any time by sending a message to the contact address given in the section “Our contact details and your rights” or by using the link in the review invitation email.

Review invitations may be sent on our behalf by our service provider, Trusted Shops, which works with subcontractors based in the USA for this purpose. An adequate level of data protection is ensured. Further information on Trusted Shops’ data protection can be found here. If you have any questions about the basis of our cooperation with this service provider, please contact us using the details in the section “Our contact details and your rights”.

6. Cookies and similar technologies

General information
To make your visit to our website more pleasant and to enable you to use its key features, we use technologies including so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted at the end of your browser session, i.e. when you close your browser (session cookies). Other cookies remain on your device and allow us to recognise your browser on your next visit (persistent cookies). We use technologies that are strictly necessary for the correct and optimal use of essential functions of our website (e.g. the shopping basket). These technologies process data such as your IP address, the time of your visit, device and browser information and information about how you use our website (e.g. the contents of your basket). Under Article 6(1)(f) GDPR, this serves our legitimate interest in presenting our offer in the best possible way.

We also use technologies to meet our legal obligations (e.g. to prove that you have consented to the processing of your personal data), as well as for web analytics and online marketing. Further information, including the relevant legal bases, can be found in the following sections of this privacy policy.

You can find out how to change your cookie settings in the help section of your browser: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

Where you have given us consent to use certain technologies (Article 6(1)(a) GDPR), you can withdraw it at any time. To do so, please contact us at the address given in the section “Our contact details and your rights”.

7. Use of cookies and similar technologies for web analytics and marketing

If you have given your consent (Article 6(1)(a) GDPR), we use the cookies and similar technologies of third-party providers listed below on our website. Once the purpose of the processing has been achieved and we stop using the technology concerned, the data collected will be deleted. You can withdraw your consent at any time. Details on withdrawing your consent and your right to object can be found in the section “Cookies and similar technologies”. Further information is available on the providers’ websites. If you have any questions about our service providers and the basis of our cooperation with them, please contact us using the details in the section “Our contact details and your rights”.

Use of Google services
We use the technologies listed below provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Information collected automatically by Google technologies about your use of our website is usually transferred to a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework), and Google LLC is certified under it; in addition, our cooperation is based on the standard contractual clauses adopted by the European Commission. Where your IP address is processed when using Google technologies, it is shortened before being stored on Google’s servers thanks to IP anonymisation. Only in exceptional cases is the full IP address transferred to a Google server and shortened there. Unless stated otherwise for individual Google technologies in this privacy policy, data processing takes place on the basis of a joint controller agreement with Google under Article 26 GDPR. Further information on data processing by Google can be found in Google’s privacy policy.

Google Analytics
To analyse how our website is used, we use Google Analytics, a web analytics service by Google, which automatically processes your data for this purpose (IP address, time of visit, device and browser information and information about your use of our website) and creates pseudonymised user profiles from it. Cookies may be used for this purpose. As a rule, your IP address is not combined with other Google data. Data processing in Google Analytics takes place on the basis of a data processing agreement with Google.

Google Ads
We use Google Ads to promote our website in search results and on third-party websites. For this purpose, when you visit our website, a Google remarketing cookie is automatically stored on your device, which enables interest-based advertising based on the pages you visit, by processing your data (IP address, time of visit, device and browser information and information about your use of our website) using a pseudonymous ID. Further data processing only takes place if you have enabled ad personalisation in your Google account settings. In that case, if you are logged in to Google while visiting our website, Google uses your data together with Google Analytics data to create and define target audience lists for cross-device remarketing.

For web analytics, we use Google Ads Conversion Tracking to measure and analyse your behaviour when you visit our website via a Google Ads advertisement. Cookies may be used for this purpose, and data such as your IP address, time of visit, device and browser information and information about your use of our website (e.g. a visit to our website or newsletter sign-up) may be processed. Pseudonymised user profiles are then created from this data.

YouTube video plugin
We embed third-party content using the YouTube video plugin. When a video is played, Google processes the following data: IP address, time of visit, device and browser information.

Use of Meta (Facebook) services – Meta Pixel
We use the Meta Pixel provided by Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). The Meta Pixel automatically collects and stores data (your IP address, time of visit, device and browser information and information about your use of our website, e.g. a visit to our website or newsletter sign-up), from which pseudonymised user profiles are created.

When you visit our website, the Meta Pixel stores a cookie on your device which, using a pseudonymised cookie ID, enables your browser to be recognised automatically when you visit other websites. Meta combines this information with other data from your Facebook account and uses it to compile reports on website activity and to provide other services related to your use of websites, in particular for ad personalisation. Information collected automatically by Meta technologies about your use of our website is usually transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, and stored there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework), and Meta Platforms, Inc. is certified under it; insofar as we are responsible for data transfers to the USA, our cooperation is also based on the European Commission’s standard contractual clauses. Further information on data processing by Meta can be found in Meta’s privacy policy.

8. Trusted Shops Trustbadge

The Trusted Shops Trustbadge is embedded on our website to display our Trusted Shops trustmark, collected customer reviews and the Trusted Shops products available to buyers after placing an order.

This serves our legitimate interests in the optimal marketing of our offer by enabling secure shopping (Article 6(1)(f) GDPR). The Trustbadge and the services advertised with it are offered by Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany. The Trustbadge is provided to us through a content delivery network (CDN). Trusted Shops GmbH uses service providers from the USA, among others. An adequate level of data protection is ensured. Further information on data protection at Trusted Shops GmbH can be found here.

When the Trustbadge is accessed, the server automatically stores so-called server log files, containing e.g. your IP address, the date and time of access, the amount of data transferred and the requesting internet service provider (access data), and documents the access. These log files are stored to analyse security issues and are automatically deleted no later than 90 days after they are created. Other personal data is only transferred to Trusted Shops GmbH if you voluntarily decide to use Trusted Shops products after placing an order in our shop, or if you have already registered to use them. In such cases, the contractual agreement between you and Trusted Shops applies. For this purpose, personal data is automatically collected from the order data. Whether you are already registered as a buyer for Trusted Shops products is checked automatically using a neutral parameter – your email address hashed with one-way cryptographic encryption. The email address is hashed before transfer so that it cannot be decrypted by Trusted Shops. After the check, the parameter is automatically deleted. This is necessary for our and Trusted Shops’ legitimate interests (Article 6(1)(f) GDPR) in providing services linked to a specific order, i.e. buyer protection (Trusted Shops guarantee) and review services. Further information, including on your rights, can be found in the Trusted Shops privacy policy linked above and in the Trustbadge.

9. Social media

Social media plugins: Facebook, Instagram, Pinterest
Our website uses social media plugins (buttons). These plugins are embedded as an HTML link, so no automatic, direct connection to the social network’s servers is established when you visit a page of our website containing such buttons. When you click one of the buttons, a new browser window opens with the social network’s page, where you can confirm the use of the button, e.g. “Like” or “Share”.

Our presence on social media: Facebook, Instagram, YouTube
If you have given the relevant social network your consent (Article 6(1)(a) GDPR), your data will be collected and stored automatically for web analytics and marketing purposes when you visit our pages on the social networks listed above. Pseudonymised user profiles are created from this data. These can be used, for example, to show personalised advertisements within and outside the social networks that are likely to match your interests. Cookies are usually used for this purpose.

Detailed information on how each social network processes and uses your data, your rights and privacy settings, and contact details for enquiries can be found in the privacy policies of the social networks linked below. If you need help with this, you can also contact us.

Facebook is a social network offered by Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland. Information processed automatically about your activity on our Facebook page is usually transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, and stored there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework); our cooperation is also based on the European Commission’s standard contractual clauses. Data processing when you visit our Facebook page takes place under Article 26 GDPR on the basis of a joint controller agreement, available here. Further information on how your personal data is processed when you visit our Facebook page (Page Insights) is available here.

Instagram is a social network offered by Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland. Information processed automatically about your activity on our Instagram account is usually transferred to a server of Meta Platforms, Inc. in the USA and stored there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework); our cooperation is also based on the European Commission’s standard contractual clauses. Data processing when you visit our Instagram account takes place under Article 26 GDPR on the basis of a joint controller agreement. Further information on how your personal data is processed (Page Insights) is available here.

YouTube is a social network offered by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Information processed automatically about your activity on our YouTube channel is usually transferred to a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework); our cooperation is also based on the European Commission’s standard contractual clauses.

10. AI chat

Our shop offers a chat based on artificial intelligence (AI), which allows quick contact with customer service and helps you choose products.

During the conversation, you may voluntarily provide personal data such as your name, email address or phone number.

This data is processed solely to handle your enquiry, in accordance with Article 6(1)(b) and (f) GDPR.

Recommendations and answers given by the AI chat are for guidance only and do not constitute a binding commercial offer.

11. Trafficwatchdog

To monitor website traffic and prevent misuse, we use Trafficwatchdog, provided by Spark DigitUP Sp. z o.o., Plac Wolnica 13 lok. 10, 31-060 Kraków, Poland, tax ID (NIP) 6762496391.

11.1. Data processed
Trafficwatchdog may collect the following data:

URLs of the pages visited, date and time of the visit,
technical data (screen resolution, device type, browser, operating system),
IP address, geolocation data (country, city),
session identifiers and cookies,
contact details provided voluntarily by the user (e.g. in forms or the chat).

11.2. Purposes of processing
The data is processed for the following purposes:

ensuring website security and detecting misuse (Article 6(1)(f) GDPR),
traffic analysis and improving the quality of our services (Article 6(1)(f) GDPR),
marketing and content personalisation – only with the user’s consent (Article 6(1)(a) GDPR).

11.3. Trafficwatchdog cookies
Trafficwatchdog uses cookies, which may include both cookies necessary for the website to work (e.g. forms, chat) and marketing cookies (e.g. product recommendations). Details of the cookies used can be found in the Trafficwatchdog Cookie Policy.

12. Our contact details and your rights

As a data subject, you have the following rights:

under Article 15 GDPR: the right to obtain information about the processing of your data to the extent set out in that article;
under Article 16 GDPR: the right to have inaccurate or incomplete personal data rectified;
under Article 17 GDPR: the “right to be forgotten”, i.e. the right to have your personal data stored by us erased, unless further processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation;
- for reasons of public interest;
- for the establishment, exercise or defence of legal claims;
under Article 18 GDPR: the right to restriction of processing of your personal data, where:
- you contest the accuracy of the data;
- the processing is unlawful and you oppose its erasure;
- we no longer need the data, but you need it for the establishment, exercise or defence of legal claims;
- you have objected to the processing under Article 21 GDPR;
under Article 20 GDPR: the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller;
under Article 77 GDPR: the right to lodge a complaint with a supervisory authority – the President of the Polish Personal Data Protection Office (UODO) or the data protection authority in the country where you live or work.

If you have any questions about the collection, processing or use of your personal data, or if you wish to request information, rectification, restriction or erasure of your data, withdraw your consent or object to the use of certain data, please contact the controller named at the beginning of this privacy policy directly.

Right to object
Where we process personal data to protect our legitimate interests as described in this privacy policy, you can object to such processing with effect for the future. If the processing is for direct marketing purposes, you can exercise this right at any time. If the processing is for other purposes, you only have the right to object on grounds relating to your particular situation.

After you exercise your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

This does not apply if the processing is for direct marketing purposes. In that case, we will always stop processing your personal data once you have objected.