PRIVACY AND COOKIES POLICY

ONLINE STORE MAISON DE REVE

www.maison-dereve.com

 I. General Information

1. This document outlines the privacy principles for the online store www.maison-dereve.com (from now on referred to as the "Online Store"). The data controller for the Online Store is JOHNSONSTYLE Spółka z ograniczoną odpowiedzialnością, ul. Świeradowska 47, 02-662 Warsaw, NIP 8971857121, REGON: 380796088, KRS: 0000740008, e-mail: contact@johnsonstyle.com.
2. The Administrator collects information voluntarily provided by the Online Store's customers. However, providing specific personal data is a prerequisite for placing an order, and failure to provide such data will result in the inability to order products in the store.
3. The Administrator may record information about connection parameters, such as IP addresses, for technical purposes related to server administration, and to gather general statistical demographic information (e.g., about the region from which the connection is made), as well as for security purposes.
4. The Administrator takes special care to protect the privacy and information provided by the Online Store's customers. The Administrator carefully selects and applies appropriate technical measures, including programming and organizational methods, to ensure the protection of processed data, in particular, securing data against unauthorized access, disclosure, loss, and destruction, unauthorized modification, as well as processing that violates applicable laws.
5. Personal data will be processed in accordance with the principles set out in Article 5 of the GDPR. Personal data will be:

1. Processed lawfully, fairly, and in a transparent manner in relation to the data subject ("lawfulness, fairness, and transparency");
2. Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the initial purposes as per Article 89(1) GDPR ("purpose limitation");
3. Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization");
4. Accurate and, where necessary, kept up to date ("accuracy");
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) GDPR, subject to the implementation of appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ("storage limitation");
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures ("integrity and confidentiality").

6.  As part of the Administrator's use of tools supporting his ongoing activities provided, for example, by Google, the Client's Personal Data may be transferred to a country outside the European Economic Area, in particular to the United States of America (USA) or another country where a cooperating entity maintains tools for processing Personal Data in cooperation with the Administrator.

II. Legal Bases

1. The primary legal basis for processing the Client's personal data is the necessity to perform the contract to which the Client is a party or the necessity to take steps at the Client's request prior to entering into the contract (Article 6(1)(b) GDPR).
2. Upon separate consent, pursuant to Article 6(1)(a) GDPR, data may also be processed for the purpose of sending commercial information electronically or making telephone calls for direct marketing purposes.
3. If you subscribe to the newsletter, personal data will be processed for the purpose of sending marketing content. The legal basis for processing personal data for this purpose is the necessity to perform the newsletter agreement concluded with the Administrator – Article 6(1)(b) GDPR. The Client can withdraw consent to the processing of data for the purpose of sending the newsletter at any time with future effect.
4. For other purposes, the Client's personal data may be processed on the basis of:
   1. Applicable laws – when processing is necessary to fulfill a legal obligation incumbent on the Administrator, e.g., when the Administrator settles concluded sales contracts based on tax or accounting regulations (Article 6(1)(c) GDPR);
   2. Necessity for purposes other than those mentioned above resulting from the legitimate interests pursued by the Administrator or by a third party, in particular for the establishment, exercise, or defense of legal claims, correspondence with Clients, including via contact forms (including responding to Clients' messages), market and statistical analyses (Article 6(1)(f) GDPR).
5. Personal data processed for purposes related to the execution of purchases will be processed for the period necessary to execute purchases and orders, after which data subject to archiving will be stored for a period appropriate for the statute of limitations. Personal data processed for marketing purposes covered by a declaration of consent will be processed until the consent is withdrawn.

III. Personal Data We collect and Use

1. We ensure that the collection and use of your personal data is lawful. Therefore, we use your personal data for the purposes listed below only when one of the following conditions is met:

1. You have given your consent;
2. We need your personal data to perform a contract you enter into with us, such as when purchasing a product via the website;
3. We must comply with legal obligations;
4. We need to protect your vital interests;
5. Your data is necessary for public interest purposes; or
6. We have a legitimate interest in processing personal data.

2. The Administrator may process the following personal data of Clients necessary to establish, shape the content, amend, or terminate the legal relationship concerning services provided electronically, including:

1. Client's surname and first name;
2. Client's residential address;
3. Correspondence address, if different from the address mentioned in point c;
4. Client's email addresses;
5. IP addresses;
6. Information about the web browser and device used to access the online store

IV. Recipients of Personal Data

1. The recipients of the Client's data may include entities executing orders on behalf of the Seller and handling the order, such as shipping companies, accounting firms, product suppliers, IT solution providers, payment processing companies, banks, marketing service providers, warehousing service providers, telecommunications service providers, law firms, and authorized state bodies.

2. We share personal data with our trusted partners with whom we cooperate in areas necessary to execute the sale of products purchased by clients.

V. Your Rights in Personal Data Protection

1. Due to the voluntary nature of providing your personal data, you have the right to:

a) Access your personal data (Article 15 GDPR)

b) Rectify your personal data (Article 16 GDPR)

c) Erase your personal data (“right to be forgotten” – Article 17 GDPR)

d) Restrict the processing of your personal data (Article 18 GDPR)

e) Data portability (Article 20 GDPR)

f) Object to processing (Article 21 GDPR)

2. If you believe that the processing of your personal data violates GDPR provisions, you have the right to file a complaint with the President of the Office for Personal Data Protection.

3. You can withdraw your consent to process personal data at any time. Withdrawal of consent does not affect the legality of data processing carried out by the Administrator based on consent before its withdrawal.

VI. Personal Data Breach

1. In the event of a personal data breach, the Administrator shall, without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the supervisory authority (President of the Office for Personal Data Protection), unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. If the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Administrator shall communicate the personal data breach to the data subject without undue delay.

VII. Cookies Policy

1. The Seller uses cookies.
2. Cookies are IT data, especially text files, stored on the Users' devices and intended for the use of websites.
3. The cookies used by the Administrator are safe for the User's device. In particular, it is not possible for viruses or other unwanted software or malware to enter Users' devices this way. These files allow the identification of the software used by the User and customize services individually for each User. Cookies typically contain the domain name they come from, the time they are stored on the device, and a value.
4. Based on the purpose of collecting cookies, we distinguish the following types:
   1. Necessary: essential for the proper functioning of the service – files processed based on the justified interest of the Administrator (Article 6(1)(f) GDPR);
   2. Statistical: allow us to study website traffic, understand our users' preferences, analyze their behavior on the site, and enable interaction with external networks and platforms – files processed based on the User's voluntary consent (Article 6(1)(a) GDPR);
   3. Marketing: allow us to tailor the displayed advertisements and content to our users' preferences and conduct personalized marketing campaigns – files processed based on the User's voluntary consent (Article 6(1)(a) GDPR).
5. Advertising networks, particularly Google, may use cookies to display ads tailored to how the User uses the Online Store. For this purpose, information about the User's navigation path or time spent on a particular page may be stored.
6. Regarding the information about the User's preferences collected by the Google advertising network, the User can view and edit the information resulting from cookies using the tool: https://www.google.com/ads/preferences/.
7. The User can independently and at any time change the settings for cookies, specifying the conditions for storing and accessing cookies on the User's device. The User can change the settings via the web browser settings or service configuration. These settings can be changed, in particular, to block the automatic handling of cookies in the web browser settings or to inform about their placement on the User's device each time. Detailed information about the possibility and ways of handling cookies is available in the software settings (web browser).
8. To learn how to manage cookies, including disabling their support in your browser, you can use your browser's help file. You can find information on this by pressing the F1 key in your browser. Additionally, appropriate instructions are available on the following subpages, depending on the browser you use:

   Firefox

   Chrome

   Safari

   Internet Explorer / Microsoft Edge
9. Limiting the use of cookies may affect some functionalities available on the service website.
10. The service also collects external cookies, so-called third-party cookies, which come from external servers.
11. We use services from:
    1. Google Analytics, provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
    2. Google Ads, provided by Google Ireland Ltd. | Gordon House, Barrow Street, Dublin 4, Ireland, to optimize ad display, remarketing, and popularization of the Online Store.

The Administrator reserves the right to change this Privacy and Cookies Policy.