Privacy Policy
I General Provisions
1. This document sets out the principles governing the processing and protection of Customers’ personal data.
2. The controller of the personal data of Customers – natural persons – and users (data subjects) is DrTusz Sp. z o.o., with its registered office in Białystok at Wyszyńskiego 2, unit 75, Tax Identification Number (NIP): 5423141609, National Court Register number (KRS): 0000336375.
3. Personal Data referred to in this Privacy Policy means information relating to an identified or identifiable natural person who is the data subject.
4. The Service Provider processes the Personal Data of data subjects in accordance with applicable laws.
5. Processing, within the meaning of this Privacy Policy, means an operation or set of operations performed on Personal Data or sets of Personal Data, whether by automated or non-automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval and consultation. II Scope and Purpose of Data Collection 6. Personal Data is processed by the Controller for the following purposes:
a. registration in the drtusz.pl online store;
b. efficient operation and functioning of the online store and ensuring the security of its use, including the detection of abuse and the performance of analyses;
c. processing data necessary to accept and fulfil orders and to arrange shipment of ordered products by other entities providing transport services to DrTusz Sp. z o.o., as well as enabling the use of various payment methods;
d. fulfilment of the obligations of DrTusz Sp. z o.o., in particular obligations related to complaints concerning agreements concluded in the store or via the store and the operation of the website;
e. preparation and presentation of advertisements and offers tailored to the interests and needs of data subjects, and the receipt of commercial information, in particular the sending by DrTusz Sp. z o.o. of the requested newsletter to the email address provided by the Customer;
f. publication of content. III Legal Basis for the Processing of Personal Data 7. The legal bases for the processing of Personal Data are:
g. the consent of the data subject to the processing of their Personal Data; (Article 6(1)(a) of the GDPR).
h. the necessity of processing for the performance of agreements concluded in the store or via the store, or in order to take steps at the request of the data subject prior to entering into an agreement; (Article 6(1)(b) of the GDPR)
i. the necessity of processing for compliance with a legal obligation to which DrTusz Sp. z o.o. is subject; (Article 6(1)(c) of the GDPR)
j. the legitimate interests pursued by DrTusz Sp. z o.o. or by a third party, including electronic payment operators or other entities involved in connection with the functionality of the store. (Article 6(1)(f) of the GDPR) IV Personal Data Processing Period 8. Personal Data collected in the store will be retained for accounting purposes for a maximum period of 5 years, calculated from the end of the calendar year in which the deadline for payment of tax related to an agreement concluded in the store or via the store expired. In all other respects justified by the purposes of processing, Personal Data will be retained for as long as there is a legal basis for its processing, unless applicable laws require a longer retention period, for example for use in proceedings concerning the operation of the store or for handling potential complaints. At the end of the retention period, the Personal Data will be deleted or anonymised. V Voluntary Provision of Personal Data 9. The provision of Personal Data in the store is voluntary, but necessary for the fulfilment of one or more of the purposes of Personal Data processing defined in point 7 above. DrTusz will not be able to fulfil the relevant purpose or purposes defined in point 7 above if Personal Data is not provided in the store. VI Profiling of Personal Data 12. Personal Data will be processed by automated means, including profiling, using information about purchases, activities in the Service Provider’s sales channels (computer IP address, cookies, preferred purchasing methods) and sociodemographic data (e.g. gender, age, income, place of residence), in order to tailor marketing information to individual preferences. VII Cookies 13. The Service Provider informs that, when using the drtusz.pl website, Personal Data is also collected automatically in the store’s system logs.
14. DrTusz informs that, from the moment the Customer connects to the website, information concerning the number, including the IP address, and type of the Customer’s end device used to connect to the store appears in the store’s system logs. DrTusz informs that, in accordance with applicable law, it also processes data concerning the number, including the IP address, and type of the Customer’s end device, the time of the Customer’s connection to the website and other usage data concerning the Customer’s activity. The described data is processed for technical purposes, in order to adapt the website to Customers’ needs and to collect general statistical information concerning the operation of the store.
15. DrTusz uses Cookies to collect information related to the Customer’s use of the store. Cookies are IT data, in particular small text files, saved and stored on the devices through which the Customer uses the website, which enable:
a. maintenance of the Customer’s session after logging in, so that the Customer does not need to re-enter their Login and Password on every subpage of the store,
b. adaptation and optimisation of the store to Customers’ needs,
c. personalisation of marketing communications,
d. ensuring security and reliability of operation.
16. The store uses session Cookies, which are deleted after the web browser window is closed, as well as persistent Cookies, which are stored for a specified period on the devices through which the Customer uses the website.
17. The Customer may independently change Cookie settings at any time, specifying the conditions for their storage and for Cookies to access the Customer’s Device.
18. The Customer may delete Cookies at any time using the functions available in the web browser they use.
19. Restricting the use of Cookies may affect certain functionalities available in the store.
20. The store also uses Cookies placed by partners of DrTusz Sp. z o.o., which enable the personalisation of advertising activities and the measurement of their effectiveness. This Privacy Policy does not govern the manner in which third parties use Cookies.
21. Certain subpages of the website and other means of communication with Customers may contain so-called “web beacons” (electronic images, also known as clear GIFs). Web Beacons make it possible to obtain information such as the Internet Protocol address of the computer to which the page containing the Web Beacon was loaded, the URL of the page, the time the page was loaded, the browser type and information contained in Cookies, in order to assess the effectiveness of advertisements. VIII Rights and Obligations of the Service Provider 22. DrTusz Sp. z o.o. reserves the right to disclose necessary Personal Data to the competent public authorities or third parties that submit a request for such information on an appropriate legal basis and in accordance with applicable law.
23. DrTusz Sp. z o.o. declares that it entrusts the processing of Personal Data, under written agreements concluded in accordance with applicable laws, to entities providing DrTusz with hosting, administration, maintenance and website management services, as well as services relating to communication optimisation and promotional campaign management.
24. DrTusz Sp. z o.o. declares that it entrusts the processing of Customers’ Personal Data to entities providing services to DrTusz Sp. z o.o. or directly to the Customer, to the extent necessary for the use of the store, including the performance of agreements, in particular Orders/Reservations, and the handling of complaints available in the online store, under written agreements concluded in accordance with applicable laws. Customers’ Personal Data may be entrusted in particular to suppliers and courier companies. IX Processing of Personal Data by Processors 25. Processors, within the meaning of this Privacy Policy, are the entities referred to in points 23 and 24 that process Personal Data on behalf of DrTusz Sp. z o.o.
26. A Processor is authorised and entitled to process Personal Data solely for the purposes and within the scope specified in this Privacy Policy.
27. Personal Data may be processed exclusively within the territory of Poland, a Member State of the European Union (EU), or within the territory of a signatory to the European Economic Area Agreement (EEA).
28. The Processor processes the entrusted Personal Data in accordance with applicable laws. In particular, the Processor:
a. applies the technical and organisational measures required by law, in particular with regard to the security of Personal Data processing.
b. applies measures ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services; ii) the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; iii) regular testing, assessment and evaluation of the effectiveness of technical and organisational measures for ensuring the security of processing.
c. applies Personal Data security measures at a level no lower than those applied by DrTusz Sp. z o.o.
29. The Processor may modify, delete or block the processed Personal Data solely upon the instruction of the Data Controller. If a data subject contacts the Processor directly with a request to modify or delete their Personal Data, the Processor shall immediately, and no later than within 5 business days, forward such request to DrTusz Sp. z o.o.
30. The Processor must not process Personal Data for any purpose other than the fulfilment of the obligations specified in this Privacy Policy. The Processor must not disclose Personal Data to third parties.
31. The Processor is liable towards the data subject for any damage suffered by that person as a result of the Processor’s acts or omissions.
X Rights and Obligations of the Data Subject
32. Every Customer has the right to:
a. access their Personal Data, rectify or erase it, and request restriction of processing.
b. object to the processing of Personal Data, withdraw consent to the processing of Personal Data for one or more purposes for which it was granted, at any time and without affecting the lawfulness of processing based on consent before its withdrawal, as well as the right to data portability.
33. In order to exercise the rights referred to in point 32(a) above, an email should be sent to: sklep@drtusz.pl or the functionalities available in the Customer Account should be used.
34. In order to exercise the rights referred to in point 32(b) above, an email should be sent to: sklep@drtusz.pl with the words “withdrawal of consent” in the subject line, the consent withdrawal link included in the commercial communication should be clicked, or written notice of withdrawal of consent to receive commercial information should be sent to the store address: DrTusz Sp. z o.o., ul. Wyszyńskiego 2, unit 75, 15-888 Białystok, marked PERSONAL DATA.
35. If the Customer posts any personal data of other persons on the website, including their full name, address, telephone number or email address, they may do so only provided that this does not infringe applicable laws or the personal rights of those persons.
36. The Customer is entitled to use Personal Data and content made available by other persons on the website solely in connection with the use of the store and with their consent, in a manner consistent with applicable laws, unless the Customer obtains the consent of those persons to process their Personal Data and content within the scope or for the purpose provided for in this Privacy Policy and extending beyond the use of the store.
37. Every Customer has the right to lodge a complaint with the supervisory authority responsible for Personal Data processing. XI Personal Data Security 38. The Service Provider declares that it makes every effort to ensure Customers a high level of security when using the website and, for this purpose:
a. applies the technical and organisational measures required by law, in particular with regard to the security of Personal Data processing;
b. applies measures ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; and regular testing, assessment and evaluation of the effectiveness of technical and organisational measures for ensuring the security of processing.
39. Any events affecting the security of information or data transmission, including suspected distribution of files containing viruses, other files of a similar nature or destructive mechanisms other than files, should be reported to DrTusz at the following email address: sklep@drtusz.pl XII Final Provisions 40. In matters not regulated by this Privacy Policy, the laws governing the processing of Personal Data, including the GDPR, shall apply. | 
