Loading...
 
  • Account Information
  • My addresses
  • My Orders
  • My Returns
  • My Wish List
  • Sign In
  • Compare Products
  • Join S'portofino Club
Menu
My Cart
My Wishlist
English / EUR
Menu
English / EUR
Account

PRIVACY POLICY

 

1. Pursuant to Art. 13(1) and Art. 13(2) of the General Data Protection Regulation of 27 April 2016 (hereinafter: GDPR), we hereby inform you that the controller of personal data processed in the Online Store and in the Stores is SAT sp. z o.o. with its registered office in Poznań (60-277), at ul. Grochowska 27.

2. If you have any questions related to the processing of personal data, please contact the Data Protection Officer, Mr Jakub Wietrzyński, at: iod@sat.poznan.pl.

3. Capitalized terms, unless separately defined in this Privacy Policy, shall have the meanings assigned to them in the S’portofino Terms and Conditions and the S’portofino Club Program Terms and Conditions.

4. The following personal data are processed in the Online Store and in the Stores:

1) Store Visitor,

2) Visitor,

3) Customer,

4) Club Member and VIP Club Member,

5) Person Contacting via the Form or Messenger,

6) Person Calling the Helpline.

5. The data of the Store Visitor are processed exclusively in connection with an issued invoice for the purpose of handling the concluded sales agreement, operational processing of the order, shipment or delivery of the ordered goods, handling returns and complaints, and fulfilling obligations arising from granted warranties and statutory warranty,

• pursuant to Art. 6(1)(b) GDPR, where processing is necessary for the performance of the sales agreement

• and pursuant to Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation to which the controller is subject, in connection with the provisions of the Act of 29 September 1994 on Accounting and other accounting and tax regulations.

6. The data of the Store Visitor are processed for the period necessary to perform the sales agreement, extended by the warranty period and the limitation period for any claims or, where required by law, for the period provided for by applicable law.

7. The data of the Visitor, Customer and Club Member, including the VIP Club Member, are processed:

1) for the purpose of handling the concluded sales agreement, operational processing of the order, shipment or delivery of the ordered goods, handling returns and complaints, and fulfilling obligations arising from granted warranties and statutory warranty,

• pursuant to Art. 6(1)(b) GDPR, where processing is necessary for the performance of the sales agreement

• and pursuant to Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation to which the controller is subject, in connection with the provisions of the Act of 29 September 1994 on Accounting and other accounting and tax regulations,

for the period necessary to perform the sales agreement, extended by the warranty period and the limitation period for any claims or, where required by law, for the period provided for by applicable law,

2) on the basis of the controller’s legitimate interest (Art. 6(1)(f) GDPR) for the purpose of conducting research and analyses aimed at improving the operation of the available services, including evaluation of the Online Store, until an objection to the processing is raised.

8. The data of the Customer and Club Member, including the VIP Club Member, are additionally processed

1) for the purpose of registering the Customer Account and ensuring the operation of the Customer’s profile, including the possibility of issuing, redeeming and delivering gift cards and discount coupons, handling promotional campaigns and competitions, and communication on technical security matters, on the basis of the accepted Terms and Conditions of the S’portofino loyalty program “S’portofino Club” (Art. 6(1)(b) GDPR), for the period during which the account is maintained and, after its deletion, until the limitation period for any claims has expired,

2) on the basis of the controller’s legitimate interest (Art. 6(1)(f) GDPR) for the purpose of reminding the user about an abandoned cart and unfinished purchases, until an objection to the processing is raised.

9. The data of the Club Member, including the VIP Club Member, are additionally processed for the purpose of receiving information concerning the S’portofino Club Program, sent to the email address provided during account registration. Information concerning the S’portofino Club Program may also be sent to the provided telephone number, provided that separate consent has been given.

10. For the purpose indicated above, the data of the Club Member, including the VIP Club Member, are processed until consent is withdrawn. Withdrawal of consent to receive information concerning the S’portofino Club Program by email is equivalent to resignation from participation in the Program (termination of the agreement), because it prevents the provision of information necessary to achieve the purpose of the S’portofino Club Program and thus prevents the purpose of participation from being achieved. Withdrawal of consent to receive information concerning the S’portofino Club Program at the provided telephone number does not result in resignation from participation in the Program.

11. The data of the Visitor, Customer and Club Member, including the VIP Club Member, are also processed for the purpose of creating personalized content and advertisements, offering social media features and analyzing website traffic, on the basis of consent given during cookie configuration (Art. 6(1)(a) GDPR), for a period consistent with the cookie settings: until the settings are changed or until the cookie expires.

12. The data of the Person Contacting via the Form or Messenger are processed on the basis of the controller’s legitimate interest (Art. 6(1)(f) GDPR), for the purpose of responding to questions submitted and ensuring efficient communication. The data are stored for 6 years from the date they are obtained.

13. The data of the Person Calling the Helpline are processed for the purpose of ensuring high-quality customer service and responding to questions submitted via the helpline. The data are processed on the basis of consent to record the conversation (Art. 6(1)(a) GDPR), expressed by continuing the conversation. The data are stored for 6 years from the date they are obtained.

14. The data of all the above-mentioned data subjects are also processed for the purpose of securing any claims, until the expiry of the applicable limitation period under the law.

15. Personal data may be transferred to entities cooperating with the controller and participating in the process of performing the sales agreement for the purpose of its proper performance, e.g. Poczta Polska, carriers, logistics companies, payment transaction service providers, IT system and service providers, entities providing marketing services, law firms, as well as authorized entities upon a documented request.

16. To the extent provided for by the GDPR and subject to the limitations specified therein, data subjects have the right to request from the controller access to their personal data and the right to rectification, erasure, restriction of processing, data portability, the right to object to processing and the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

17. Data subjects also have the right to lodge a complaint with the President of the Personal Data Protection Office (www.uodo.gov.pl).

18. Providing the data is a contractual requirement specified in the Terms and Conditions of the S’portofino Club Program.

19. Personal data will not be used in automated decision-making processes, including profiling.

20. Given that personal data are processed using the following tools: Google Analytics 4, Google Tag Manager and Microsoft Clarity, the data may be transferred outside the European Economic Area. Google LLC (Google Analytics 4 and Google Tag Manager) and Microsoft Corporation (Microsoft Clarity) transfer data outside the EEA using, in accordance with Art. 45 GDPR, the transfer mechanism based on an adequacy decision for entities listed under the EU-US Data Privacy Framework, i.e. the framework principles for data protection between the European Union and the United States, implemented by the European Commission decision of 10 July 2023 and issued by the U.S. Department of Commerce (EU-U.S. DPF).

COOKIES

1. What are cookies

1) The sportofino.com Service uses cookies and similar technologies, such as browser local storage (Local Storage), tracking pixels, device identifiers and web beacons. These are pieces of information stored on the user’s device or read from that device while using the Service.

2) These technologies may store, among other things, a session or device identifier, information about Service settings, visited subpages, viewed products, the source of the visit, browser and device type, approximate location and the manner of using the Service. To the extent that this information allows the user to be identified directly or indirectly, it constitutes personal data.

2. Categories of technologies used

The following categories of cookies and similar technologies are used in the Service:

1) Necessary

Necessary technologies ensure security, session maintenance, operation of the shopping cart, handling of forms, saving consent settings, and proper display and functioning of the Service. Without some of these technologies, it would not be possible to provide a service expressly requested by the user.

This category includes in particular technologies supporting the Service session, the shopping cart, protection against abuse and request forgery, the Cookiebot consent management mechanism and - to the extent necessary - reCAPTCHA safeguards.

Necessary technologies are used without the user’s separate consent solely to the extent that the conditions of Art. 399(3) of the Act - Electronic Communications Law are met. If the information related to them constitutes personal data, the legal basis for its further processing is, depending on the function, the necessity to perform an agreement or take action at the user’s request, or the Controller’s legitimate interest in ensuring the security and proper operation of the Service.

2) Preferences

Preference technologies make it possible to remember the user’s choices, such as language, region, interface settings or other settings affecting the operation and appearance of the Service.

They are optional and are activated only after consent has been given.

3) Statistics and analytics

Statistical and analytical technologies make it possible to measure the number of visits, analyze traffic sources, how users navigate the Service, use its functions and the effectiveness of implemented changes.

In this respect, the Service uses, among others, Google Analytics 4 and may use analytical tools from Microsoft, TikTok, Issuu, Synerise and other providers indicated in the “Cookie Settings” panel.

Analytical data should not be treated as anonymous solely because they do not contain the user’s first and last name. They may include online identifiers, device identifiers and activity information and may therefore constitute personal data.

Statistical and analytical technologies are optional and are activated only after consent has been given.

4) Marketing

Marketing technologies are used to measure advertising effectiveness, create audience groups, limit the number of ad impressions, tailor advertising content and conduct marketing activities within and outside the Service.

This category includes or may include, among others, technologies of Google Ads and DoubleClick, Meta, TikTok, Microsoft Advertising, Pinterest, RTB House, Adform, AppNexus, WP, GLAMI and other providers listed in the “Cookie Settings” panel.

Marketing technologies are optional and are activated only after consent has been given.

5) Unclassified technologies

Technologies whose purpose, provider or operating principles have not yet been determined are not activated until they have been classified and their purpose, storage period, provider, legal basis and any transfers of data outside the European Economic Area have been determined.

3. Consent management

1) On the first visit, the user may:

• reject all optional technologies,

• accept all optional technologies,

• make a separate choice for individual categories.

2) No action, continued browsing of the Service or closing the banner shall constitute consent.

3) The user may change or withdraw consent at any time using the “Cookie Settings” link available in the footer of the Service. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

4) Restricting the use of necessary technologies may cause some Service functions, in particular the shopping cart, login, forms or the purchase process, not to work properly. Refusal to consent to optional technologies may not prevent the use of the basic functions of the Service.

4. Google Analytics and other Google services

1) The Service uses Google Analytics 4 to measure and analyze how the Service is used. The tool may process, among other things, online identifiers, information about visited subpages and events, source of visit, device type, operating system, browser, language and approximate location.

2) Google Analytics measurement identifiers and Google Tag Manager are used in the Service. The Service may also use Google Ads, Floodlight/DoubleClick and reCAPTCHA services. Individual Google services have different purposes and should not be described collectively solely as a statistical tool.

3) According to information provided by Google, the IP address of a user from the EEA is used on servers located in the EU to determine approximate location and is then deleted before the data are stored in Google Analytics. This does not mean, however, that all other information processed by Google Analytics is anonymous.

4) Optional Google Analytics and Google Ads functions are activated after the user’s consent has been obtained. Depending on the configuration of Google Consent Mode, limited technical signals may be transmitted before consent is granted without storing optional identifiers on the device. The Controller may periodically verify the configuration of Google tools, in particular the default consent status, the scope of modeling, Google Signals, ad personalization and data sharing settings.

5. Transfer of data outside the European Economic Area

1) In connection with the use of Google services, data may be transferred to the United States or processed in other countries outside the European Economic Area.

2) In cases covered by Google LLC certification, transfers of data to the United States are carried out on the basis of a European Commission adequacy decision under the EU-U.S. Data Privacy Framework, in accordance with Art. 45 GDPR. In cases not covered by an adequacy decision, Google may use standard contractual clauses approved by the European Commission, in accordance with Art. 46 GDPR.

3) Transfers of data outside the EEA may also occur in connection with the services of other providers of analytical, advertising, social media or security tools. Information concerning the recipient country, transfer mechanism and safeguards applied is made available in the “Cookie Settings” panel or in the information relating to and available from the relevant provider.

6. Storage period

1) Individual technologies are used for the period indicated in the “Cookie Settings” panel. Some of them are session-based and are deleted when the browser is closed, while others remain on the device for a specified period or until they are deleted by the user.

2) Data stored by tool providers may be retained for a period different from the lifetime of the cookie. These periods result from the configuration of the individual services and should be indicated in the information concerning the relevant provider.