Privacy Policy

PERSONAL DATA PROTECTION (GDPR)
I. Data Administrator
1. The administrator of personal data is Łafra Limited Liability Company based in Warsaw (00-238), at Długa 29, NIP 5253038656, hereinafter referred to as the "Administrator."
2. Contact with the Administrator is possible:
- electronically: z.biziuk@kkgallery.art, lafra.spzoo@gmail.com
- in writing: Łafra Sp. z o.o. ul. Długa 29, 00-238 Warsaw.
3. The Administrator has appointed a Data Protection Officer.
4. Personal data is processed in accordance with:
- The Regulation of the European Parliament and of the Council (EU) 2016/679 (GDPR),
- the Act of May 10, 2018 on the protection of personal data,
- other applicable legal provisions.

II. Information clause for Clients (orders and user account)
2.1 Scope of processed data
The Administrator processes the following data:
• first and last name,
• email address,
• phone number,
• delivery address,
• invoice details (if applicable),
• IP address.
2.2 Purposes and legal basis for processing
Data is processed for the purpose of:
1. concluding and performing a sales contract – art. 6 para. 1 lit. b GDPR;
2. managing a user account – art. 6 para. 1 lit. b GDPR;
3. fulfilling tax and accounting obligations – art. 6 para. 1 lit. c GDPR;
4. establishing, pursuing, or defending claims – art. 6 para. 1 lit. f GDPR (legitimate interest of the Administrator);
5. marketing of product assortment (artworks) and statistical analysis – art. 6 para. 1 lit. f GDPR.
2.3 Data retention period
Data will be retained:
• for the duration of the contract,
• after its termination for the period required by law (in particular tax regulations),
• until the statute of limitations for claims.
2.4 Data recipients
Data may be transferred to:
• courier companies and postal operators,
• payment operators (PayU, PayPal),
• entities providing hosting, accounting, and IT services,
• public authorities – in cases provided for by law.
Data is not transferred to third countries outside the EEA unless it results from the use of
technological provider tools (e.g., Google, Meta) in accordance with applicable
security mechanisms (e.g., standard contractual clauses).
III. Information clause – Newsletter
3.1 Scope of data
• email address.
3.2 Purpose and legal basis
Data is processed for the purpose of sending commercial information electronically on
basis of:
• art. 6 para. 1 lit. a GDPR – consent of the data subject.
3.3 Processing period
Data is processed until the consent is withdrawn.
Withdrawal of consent is possible at any time by:
• clicking the unsubscribe link in the email,
• contacting at: z.biziuk@kkgallery.art.
Withdrawal of consent does not affect the lawfulness of processing carried out before its
withdrawal.
IV. Information clause – Contests and promotional actions
4.1 Scope of data
The scope of data is specified in the contest regulations and may include:
• first and last name,
• email address,
• phone number,
• correspondence address.
4.2 Purposes and legal basis
Data is processed for the purpose of:
1. conducting the contest and selecting winners –
art. 6 para. 1 lit. b GDPR;
2. fulfilling tax obligations –
art. 6 para. 1 lit. c GDPR;
3. marketing – in case of separate consent –
art. 6 para. 1 lit. a GDPR.
4.3 Retention period
Data is retained for the duration of the contest and the period required by law.
V. Profiling and online advertising
1. The Administrator may use profiling based on the analysis of user behavior
on the Service to tailor marketing content.
2. Profiling does not have legal effects on the user nor does it significantly
affect their situation.
3. The Administrator uses advertising tools from Google and Meta (Facebook).
VI. Cookies
1. The Service uses cookies for the purpose of:
- ensuring the proper functioning of the site,
- analyzing traffic,
- marketing activities.
2. The user can change cookie settings in the web browser at any time.
VI. Rights of data subjects
The data subject has the right to:
• access to data (art. 15 GDPR),
Osobie, której dane dotyczą, przysługuje prawo do:
• dostępu do danych (art. 15 RODO),
• rectification of data (art. 16 GDPR),
• deletion of data (art. 17 GDPR),
• restriction of processing (art. 18 GDPR),
• data portability (art. 20 GDPR),
• objection (art. 21 GDPR),
• withdrawal of consent at any time (art. 7 par. 3 GDPR),
• lodging a complaint with the President of the Personal Data Protection Office.
VII. Voluntariness of providing data
1. Providing personal data is voluntary, however:
o for the purpose of order fulfillment – necessary for concluding and performing the contract,
o for the newsletter – necessary for receiving it,
o for competitions – necessary for participation in the competition.

Receive the latest news straight to your inbox

About the latest and upcoming Art Auctions.

About the upcoming Exhibitions and events.

About the latest Works in our Catalogs.

FIRM

FOR ARTISTS

CUSTOMER SERVICE

Page created by Łafr Sp.z o.o