Privacy policy - GDPR

What data about you do we collect?

Data collected during registration

To be able to use some of the functions of our system, you will have to register. During registration, we will ask for your e-mail address and the password you will use on our website.

Data collected during the purchase transaction

Before you can make a purchase transaction in our store, we will ask for your name, surname, address, telephone number, and data concerning payment method, e.g. credit card type, credit card number, expiry date, CVV number.

Data collected automatically

During your visit to our website, all data about your visit is automatically collected, e.g. your IP address, domain name, browser type, operating system type, etc.

Data collected when you contact us

When you contact us via the website, telephone, e-mail, etc., you provide us with your personal data, e.g. name, surname, e-mail address, etc.

How do we use your data?

Under no circumstances will we sell the data collected about you to third parties.
Data collected during registration will only be used to enable you to log into our system. If you want to make a purchase, registration is mandatory.
The data collected during the purchase transaction will be used to complete the transaction, including collecting money from you and sending you the ordered goods. Providing this data is mandatory if you want to make a purchase.
If you subscribed to our Newsletter, or otherwise agreed to receive it, we will use your data to send you our Newsletter. During registration you will be asked if you want to receive our Newsletter.
Data collected automatically can be used to analyse user behaviour on our website, collect demographic data about our users, or to personalize the content of our websites. Each user’s data are collected automatically.
The data collected during the correspondence between you and our website will only be used to answer your inquiry.
In the event of an inspection by the General Inspectorate for Personal Data Protection, your data may be made available to the employees of the Inspectorate in accordance with the Personal Data Protection Act.
In the event of a breach of the Regulations of our website, violation of the law, or when it will be required by law, we may disclose your data to judicial authorities.

How will we contact you?

If you have made a purchase of goods, you can receive from us e-mails regarding your transaction. We can also contact you by phone if we have important information regarding your transaction.
If you subscribed to our Newsletter, or otherwise agreed to receive it, you will receive our Newsletter by e-mail.

How can you inform us about the change of data?

After logging into the system and selecting the Data section, you can make changes or delete your personal data collected during registration and used to log into the system and send the Newsletter. The data used for the purchase transaction cannot be changed or deleted, as they are part of the bill or invoice. Data collected automatically cannot be changed or deleted.

The use of cookies ("cookies")

Our website may use cookies to identify your browser when using our website, so that we know which page to display to you. Cookies do not contain any personal data.

How do we secure your personal data?

Communication between your computer and our server when we collect your personal data is encrypted using the SSL (Secure Socket Layer) protocol. In addition, our databases are protected against access by third parties.

Changes to our privacy policy.

We reserve the right to change the above privacy policy by publishing a new privacy policy on this website.

 

Personal data processing security policy

at Fashiontex Group Sp. z o. o Spółka komandytowa

Ul. Sienkiewicza 73 lok. 7
90-057 Łódź

 

Section   1

General provisions

 

§ 1

The purpose of the Personal Data Processing Security Policy, hereinafter referred to as the "Security Policy" at Fashiontex Group Sp. z o.o. Spółka komandytowa, hereinafter referred to as the "Organization", is to obtain the optimal and compliant with the requirements of applicable legal acts, method of processing information containing personal data.

 

§ 2

The security policy was developed based on the requirements contained in:

• Regulation of the European Parliament and of the Council /EU/ 2016/679 of April 27, 2016 on protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC/Official Journal EU.L No. 119, p.1/,
• Act of May 10, 2018 on personal data protection.

 

§ 3

The protection of personal data is carried out through physical and organizational security, system software, applications and protection of users proportional and adequate to the risk of violating the security of personal data processed as part of the business.

 

§ 4

1. Providing the security of personal data processed in the Organization is understood as ensuring their confidentiality, integrity, accountability and availability at an appropriate level. The measure of security is the acceptable level of risk related to the protection of personal data.
2. The applied security measures are to achieve the above goals and ensure:
3. data confidentiality - understood as a property that ensures that data is not disclosed to unauthorized persons;
4. data integrity - understood as a property ensuring that personal data has not been changed or destroyed in an unauthorized way;
5. data accountability - understood as a property ensuring that the actions of a person can be uniquely attributed only to that person;
6. system integrity - understood as system sanctity, impossibility of any manipulation, both intentional and accidental;
7. availability of information - understood as ensuring that authorized persons have access to information and related resources when it is needed;
8. risk management - understood as the process of identifying, controlling and minimizing or eliminating the security risk that may apply to information systems used to process personal data.

 

§ 5

1. The administrator of personal data processed at Fashiontex Group Sp. z o.o. Spółka komandytowa is Mrs Elżbieta Rykała. 

 

Section 2

Definitions 

§ 6

Terms used in the Security Policy shall have the following meaning:

1. personal data administrator - a natural or legal person, public body, unit or other entity that independently, or jointly with others, sets the purposes and means of personal data processing,
2. data protection officer - a person appointed by the administrator of personal data, supervising compliance with the principles and requirements of personal data protection specified in the GDPR and national regulations,
3. the Act of May 10, 2018 on personal data protection ,
4. GDPR – Regulation of the European Parliament and of the Council /EU/ 2016/679 of April 27, 2016 on protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC/Official Journal EU.L No. 119, p. 1/,
5. personal data - any information relating to an identified or identifiable natural person,
6. set of personal data - an ordered set of personal data available according to specific criteria,
7. processed data - an operation or a set of operations performed on personal data in an automated or non-automated manner, such as collecting, recording, storing, processing, combining, sending, changing, sharing and deleting, destroying, etc.,
8. IT system - a set of cooperating devices, programs, information processing procedures and software tools used to process personal data,/li>
9. traditional system - a set of organizational procedures related to the mechanical processing of information as well as equipment and fixed assets used to process personal data on paper,
10. securing data in the IT system - implementation and operation of appropriate technical and organizational measures ensuring data protection against unauthorized processing,
11. IT system administrator - a person or persons authorized by the personal data administrator to administer and manage IT systems,
12. recipient - a natural or legal person, public authority, unit or other entity to which personal data is disclosed based on, among others, for an entrustment agreement,
13. third party - a natural or legal person, public authority, unit or entity other than the data subject, which, under the authority of the personal data controller, may process personal data,
14. user identifier (login) - a string of letters, numbers or other characters that uniquely identifies the person authorized to process personal data in the IT system,
15. password - a string of letters, numbers or other characters assigned to the user ID, known only to the person authorized to work in the IT system.

 

Section 3

Scope of applicability 

§ 7

1. The Organization processes personal data of employees, job applicants and clients, collected in personal data files.
2. This information is processed both in the form of traditional and electronic documentation.
3. The security policy contains regulations regarding the introduced technical and organizational safeguards ensuring protection of the processed personal data.
4. Other documents regulating the protection of personal data in the Organization are:

1)Regulation No. 1/2018 of the Administrator on the protection of personal data with attachments

 

§ 8

The security policy applies in particular to:

1. personal data processed in the system: CDN XL, Microsoft Office,
2. all information regarding the data of employees, customers,
3. recipients of personal data to whom personal data has been provided for processing based on entrustment agreements: accounting office, insurance company, company dealing with health and safety training, medical clinic, banks.
4. information on the protection of personal data, in particular account names and passwords in personal data processing systems,
5. register of third parties authorized by the administrator of personal data to process personal data,
6. other documents containing personal data.

 

§ 9

1. The scopes of personal data protection specified by the Security Policy and other related documents apply to:

1) all existing IT and paper systems, implemented currently or in the future, in which personal data subject to protection are processed,

2) all locations - buildings and rooms where information to be protected is or will be processed,

3) all employees and other persons who have access to the protected information.

 All employees, interns and other persons who have access to the personal data subject to protection are required to apply the principles set out in the Security Policy and other related documents.

 

Section 4

List of the collections of personal data

§ 10

1. Personal data is collected in the following sets:

1. Registration of persons authorized to process personal data,
2. Employees' personal files,
3. Employees’ information collections,  
4. Sick leaves records,
5. Referrals for periodic and specialist examinations,
6. Record of holidays, working time, leave,
7. Register of business trips,
8. Employee payrolls,
9. Employee insurance declarations,
10. social insurance company declarations and files of employees,
11. Employees’ tax declarations,
12. Accident register,
13. Civil law contracts,
14. Agreements concluded with contractors,
15. Customer register,
16. Archival documents. 

 

§ 11

The personal data files listed in § 10 are processed in a traditional way and with the use of IT equipment.

 

Section 5

List of buildings, rooms in which personal data processing operations are performed

 

§ 12

Personal data is processed in the building located in Głowno, at Łowicka 89A street.

Section 6 

List of personal data files with an indication of the programs used to process this data

§ 13

 

Lp	Data set	Department/organizational unit	Program	Database location	Data processing location
1	Recipients database	commercial, accounting, finished goods warehouse	CDN XL	Głowno, ul. Łowicka 89A	Głowno, ul. Łowicka 89 A
2	Suppliers database	Supplies, accountant	CDN XL	Głowno, ul. Łowicka 89A	Głowno, ul. Łowicka 89A
3	Employees’ database	human resources	Microsoft Office, iPKO biznes	Głowno, ul. Łowicka 89A	Głowno, ul. Łowicka 89A

 

Section 7  

Structure of data sets indicating the content of

individual information fields

§ 14

The structure of data sets indicating the content of individual information fields for programs and systems used in the Organization is as follows:

1. CDN XL     
2. Company name, 
3. Tax ID No.
4. National Business Registry Number
5. Polish Resident Identification Number                      
6.  Place of business address
7. Delivery address 
8.  e-mail,          
9.  mobile phone,         

 

2. Microsoft Office

1. Surname and family name,

2. Place and date of birth,

3. ID,

4. NIP [Tax ID],

5. Address of residence,

6. Correspondence address,

7. Phone No.,

8. Bank account number,

9. records of medical examinations,

10. records of health and safety training

 

Chapter 8   

Method of data flow between individual systems, cooperation of IT systems with data sets 

§ 15

Data flow between individual systems

 

Program 1	Flow	Program 2	Data flow
Office	not specified	……	not specified
CDN XL	not specified	……	not specified

 

 

Chapter 9

Organizational and technical measures to protect personal data 

§ 16

1. Organizational security
2. a security policy for the processing of personal data has been developed and implemented,
3. Regulation No. 1/2018 of the Administrator was developed and implemented
4. a procedure to be followed in the event of a breach of personal data protection has been established,
5. only persons authorized by the data controller or a person authorized by him have been allowed to process data,
6. persons employed in data processing are familiar with the provisions on the protection of personal data,
7. persons employed in the processing of personal data are obliged to keep them secret,
8. the processing of personal data is carried out in conditions that protect the data against unauthorized access
9.  the presence of unauthorized persons in the premises where personal data are processed is allowed only in the presence of a person employed in the processing of personal data and in conditions ensuring data security,
10.  documents and information carriers containing personal data, which are subject to destruction, are neutralized with the use of devices intended for this purpose, or their content is modified in such a way that it is not possible to recreate their content.
11. Technical security
12. the internal computer network is password-protected by separating it from the public network,
13. computer stations are equipped with individual anti-virus protection,
14. computers are secured against the possibility of being used by unauthorized persons to process personal data with an individual user identifier and cyclical enforcement of password changes,
15. Physical control measures:
16. the area in which personal data is processed, outside working hours, is protected by an alarm,
17. the area in which personal data is processed is monitored 24/7,
18. devices used to process personal data are located in locked rooms,
19. documents and information carriers containing personal data are stored in lockable cabinets.

 

Chapter 10

Tasks of the personal data administrator 

§ 17

The most important duties of the personal data administrator or information security administrator include:

1. organization of security and protection of personal data in accordance with the requirements of the GDPR and the Act on the Protection of Personal Data,
2. ensuring data processing in accordance with the provisions of the Security Policy and other internal documents,
3. carrying out an assessment of the effects of the planned processing operation on the protection of personal data - if the organization introduces a new type of personal data processing,
4. issuing and cancelling authorizations to process personal data,
5. keeping records of people authorized to process personal data,
6. conducting investigation proceedings in the event of a breach of personal data protection,
7. personal-data protection supervision
8. control of the activities of organizational units in terms of compliance of data processing with the provisions on the protection of personal data,
9. initiating and undertaking projects to improve the protection of personal data.

Section 11

Final provisions

§ 18

1. Before being allowed to work with the IT system processing personal data or personal data files in paper form, each user should be trained in the protection of personal data in electronic and paper files.
2.  The personal data administrator is responsible for conducting the training.
3. The scope of the training should include familiarizing the user with the provisions of the Personal Data Protection Act and the implementing acts issued on its basis as well as the Security Policy and other related documents managed by the personal data administrator,
4. The training ends with the student signing a declaration of participation in the training and its understanding, and a commitment to comply with the principles of personal data protection presented during the training.