Privacy Policy
PERSONAL DATA PROTECTION (GDPR)
I. Data Controller
1. The controller of personal data is Łafra Spółka z Ograniczoną Odpowiedzialnością, with its registered office in Warsaw (00-238), ul. Długa 29, NIP 5253038656, hereinafter referred to as the “Controller”.
2. The Controller may be contacted:
- electronically: z.biziuk@kkgallery.art, lafra.spzoo@gmail.com
- in writing: Łafra Sp. z o.o. ul. Długa 29, 00-238 Warsaw.
3. The Controller has appointed a Data Protection Officer.
4. Personal data are processed in accordance with:
with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
with the Act of 10 May 2018 on the Protection of Personal Data,
with other applicable laws.
II. Privacy Notice for Customers (orders and user accounts)
2.1 Scope of data processed
The Controller processes the following data:
• first and last name,
• email address,
• telephone number,
• delivery address,
• invoice details (if applicable),
• IP address.
2.2 Purposes and legal bases for processing
Data are processed for the purpose of:
1. entering into and performing a sales contract – Article 6(1)(b) GDPR;
2. maintaining a user account – Article 6(1)(b) GDPR;
3. fulfilling tax and accounting obligations – Article 6(1)(c) GDPR;
4. establishing, pursuing or defending claims – Article 6(1)(f) GDPR (the Controller’s legitimate interest);
5. marketing the range of products (works of art) and conducting statistical analysis – Article 6(1)(f) GDPR.
2.3 Data retention period
Data will be stored:
• for the duration of the contract,
• after its termination, for the period required by law (in particular tax
regulations),
• until claims become time-barred.
2.4 Recipients of data
Data may be disclosed to:
• courier companies and postal operators,
• payment operators (PayU, PayPal),
• entities providing hosting, accounting and IT services,
• public authorities – in cases provided for by law.
Data are not transferred to countries outside the EEA, unless this results from the use of
technology providers’ tools (e.g. Google, Meta) in accordance with applicable
safeguards (e.g. standard contractual clauses).
III. Privacy Notice – Newsletter
3.1 Scope of data
• email address.
3.2 Purpose and legal basis
Data are processed for the purpose of sending commercial information electronically on the
basis of:
• Article 6(1)(a) GDPR – the consent of the data subject.
3.3 Processing period
Data are processed until consent is withdrawn.
Consent may be withdrawn at any time by:
• clicking the unsubscribe link in an email,
• contacting us at: z.biziuk@kkgallery.art.
Withdrawal of consent does not affect the lawfulness of processing carried out before its
withdrawal.
IV. Privacy Notice – Competitions and Promotional Campaigns
4.1 Scope of data
The scope of data is specified in the rules of each competition and may include:
• first and last name,
• email address,
• telephone number,
• correspondence address.
4.2 Purposes and legal bases
Data are processed for the purpose of:
1. conducting the competition and selecting the winners –
Article 6(1)(b) GDPR;
2. fulfilling tax obligations –
Article 6(1)(c) GDPR;
3. marketing – where separate consent has been given –
Article 6(1)(a) GDPR.
4.3 Retention period
Data are stored for the duration of the competition and for the period required by law.
V. Profiling and online advertising
1. The Controller may use profiling involving the analysis of user behavior
on the Website in order to tailor marketing content.
2. Profiling does not produce legal effects concerning the user or significantly affect
their situation.
3. The Controller uses Google and Meta (Facebook) advertising tools.
VI. Cookies
1. The Website uses cookies for the purpose of:
ensuring the proper functioning of the website,
analyzing traffic,
marketing activities.
2. Users may change their cookie settings in their internet
browser at any time.
VI. Rights of data subjects
Data subjects have the right to:
• access their data (Article 15 GDPR),
• rectification of data (Art. 16 GDPR),
• erasure of data (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection (Art. 21 GDPR),
• withdrawal of consent at any time (Art. 7(3) GDPR),
• lodging a complaint with the President of the Personal Data Protection Office.
VII. Voluntary provision of data
1. Providing personal data is voluntary, however:
for order fulfilment – necessary to conclude and perform the contract,
for the newsletter – necessary to receive it,
for competitions – necessary to participate in the competition.
Receive the latest news straight to your inbox
About the latest and upcoming Art Auctions.
About the upcoming Exhibitions and events.
About the latest Works in our Catalogs.
FIRM
FOR ARTISTS
CUSTOMER SERVICE
Page created by Łafr Sp.z o.o