Privacy Policy

This Privacy Policy describes how the IFIORA online shop processes the personal data of users and Customers in connection with use of the Shop and the placing and fulfilment of orders. We take care to process personal data in line with applicable law, including the GDPR.

1. Data controller

The controller of your personal data is IFIORA – the entity operating the IFIORA online shop.

Controller contact details:

  • IFIORA
  • Al. Polski Walczącej 30, Lokal U3/A, Mokotów, 00-712 Warszawa, Poland
  • Email: info@ifiora.com
  • Phone: +48 883 338 113
  • Opening hours: 10:00 to 17:00

For any matters relating to the processing of personal data or the exercise of your rights, please contact us by email at: info@ifiora.com.

2. Categories of data processed

In connection with use of the Shop and the fulfilment of orders, we may process the following categories of data:

  • Order data – information about ordered Goods, order value and order history.
  • Contact data – name and surname, email address and phone number.
  • Delivery data – the delivery address and the Recipient's details needed to complete delivery.
  • Account data – if a user chooses to create an account, data related to setting it up and running it.
  • Technical data – information collected automatically as you use the site, such as IP address, device and browser data, and data associated with cookies.

3. Purposes of processing

Personal data is processed for the following purposes:

  • fulfilling orders and concluding and performing the sales contract;
  • delivering the ordered Goods;
  • customer service, including responding to enquiries and handling complaints;
  • fulfilling the controller's legal obligations, including tax and accounting duties;
  • carrying out marketing activities – only where the user has given the appropriate consent.

4. Legal bases for processing

Personal data is processed on the following legal bases under the GDPR:

  • Art. 6(1)(b) GDPR – where processing is necessary to conclude and perform a contract, including fulfilling an order and delivery;
  • Art. 6(1)(c) GDPR – where processing is necessary to comply with legal obligations, in particular tax and accounting duties;
  • Art. 6(1)(f) GDPR – where processing is necessary for the controller's legitimate interests, such as handling enquiries, ensuring security and pursuing or defending claims;
  • Art. 6(1)(a) GDPR – where processing takes place on the basis of the user's consent, in particular for marketing purposes.

5. Data recipients

Personal data may be shared with parties working with the controller to the extent needed to achieve the stated purposes. Categories of recipients include:

  • the provider of the online shop platform (Shopify);
  • payment service providers;
  • delivery and logistics providers;
  • IT service providers and email delivery tools;
  • the accountancy firm and legal advisers – to the extent necessary.

Data is shared only to the extent needed for the specified purposes and with appropriate safeguards in place.

6. Transfers of data outside the European Economic Area

Because we use service providers including the Shopify platform and other tools, personal data may also be processed outside the European Economic Area (EEA). In such cases, transfers take place on the basis of appropriate safeguards provided for by law. The exact scope and basis of such transfers require verification.

7. Data retention periods

Personal data is kept for as long as is necessary to achieve the purposes for which it was collected, in particular:

  • for the time needed to fulfil the order and perform the contract;
  • for the period required by law, in particular tax and accounting rules;
  • for the time needed to establish, pursue or defend claims;
  • in the case of data processed on the basis of consent – until consent is withdrawn.

Once these periods expire, data is deleted or anonymised.

8. User rights

In connection with the processing of personal data, users have the following rights:

  • the right of access to their personal data;
  • the right to have data rectified;
  • the right to have data erased;
  • the right to restrict processing;
  • the right to object to processing;
  • the right to data portability;
  • the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (PUODO).

Where data is processed on the basis of consent, users have the right to withdraw their consent at any time; this does not affect the lawfulness of processing carried out before consent was withdrawn.

9. Data security

We take great care to protect the personal data entrusted to us. We apply appropriate technical and organisational measures to safeguard the data against loss, destruction, unauthorised access, alteration and unauthorised disclosure. Access to personal data is restricted to authorised individuals, to the extent needed to carry out their duties, and they are bound by confidentiality. Security measures are periodically reviewed and adapted to changing threats and to the nature of the data processed.

10. Automated decision-making and profiling

The Shop does not make decisions about users based solely on the automated processing of personal data, including profiling, that would produce legal effects concerning them or similarly significantly affect them. Should such processing be introduced in the future, users will be informed and advised of their related rights.

11. Data of minors

The Shop and its services are intended for adults. We do not knowingly collect personal data of children or direct our activities at them. If a legal guardian becomes aware that a minor has provided us with personal data, please contact us at info@ifiora.com so we can delete it. Once we have verified such a report, we will take the steps needed to remove the data, unless further retention is required by law.

12. Cookies

The Shop may use cookies and similar technologies to ensure the site works properly, improve its functionality and analyse how it is used. You can manage cookie settings via your web browser. Detailed information about the types of cookies used, their purposes and how to manage them is set out in a separate Cookie Policy that complements this Privacy Policy.

13. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy, in particular in connection with changes in the law, changes to how the Shop works or to clarify its provisions. The current version of the Privacy Policy is published on the Shop's website and applies from the moment of publication. We encourage you to review it from time to time.

14. Contact

For any matters relating to the processing of personal data and the exercise of your rights, please contact us:

  • IFIORA
  • Al. Polski Walczącej 30, Lokal U3/A, Mokotów, 00-712 Warszawa, Poland
  • Email: info@ifiora.com
  • Phone: +48 883 338 113