1.1. This Website Privacy Policy is for informational purposes only, which means that it does not impose any obligations on Service Users or Online Store Customers. The privacy policy primarily contains rules regarding the processing of personal data by the Administrator in the Online Shop, including the basis, purposes and period of personal data processing and the rights of data subjects, as well as information on the use of cookies and analytical tools in the Online Shop.

​

1.2. The Administrator of personal data collected via the Website is Nicole Petters, conducting business activity under the name NICOLE PETTERS, entered in the Central Register and Information on Economic Activity of the Republic of Poland kept by the minister responsible for the economy, with the following address of the place of business: Franciszkańska 16, 44-218 Rybnik, and address for service: Franciszkańska 16, 44-218 Rybnik, NIP 6423242179, REGON 524125397, e-mail address: psychoterapia@nicolepetters.pl, telephone number: +48728938252 – hereinafter referred to as the ‘Administrator’ and also being the Website Service Provider and Seller.

​

1.3. Personal data in the Online Store is processed by the Administrator in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter referred to as ‘GDPR’ or ‘GDPR Regulation’. Official text of the GDPR: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679

​

1.4. Use of the Online Shop, including making purchases, is voluntary. Similarly, the provision of personal data by the Service Recipient or Customer using the Online Shop is voluntary, with two exceptions: (1) concluding contracts with the Administrator – failure to provide, in the cases and to the extent indicated on the Online Store website and in the Online Store Regulations and this privacy policy, the personal data necessary to conclude and perform a Sales Contract or a contract for the provision of Electronic Services with the Administrator results in the inability to conclude such a contract. In such a case, the provision of personal data is a contractual requirement and if the data subject wishes to conclude a given agreement with the Administrator, they are obliged to provide the required data. Each time, the scope of data required to conclude an agreement is indicated in advance on the Online Store website and in the Online Store Regulations; (2) the Administrator's statutory obligations – the provision of personal data is a statutory requirement resulting from generally applicable laws imposing on the Administrator the obligation to process personal data (e.g. processing data for the purpose of keeping tax or accounting records) and failure to provide such data will prevent the Administrator from performing these obligations.

1.5. The administrator shall exercise particular care to protect the interests of persons whose personal data it processes, and in particular shall be responsible for and ensure that the data it collects is: (1) processed lawfully; (2) collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes; (3) factually correct and adequate in relation to the purposes for which they are processed; (4) stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and (5) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

1.6. Taking into account the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Controller shall implement appropriate technical and organisational measures to ensure that processing is performed in accordance with this Regulation and to be able to demonstrate this. These measures shall be reviewed and updated where necessary. The Controller shall use technical measures to prevent unauthorised persons from obtaining and modifying personal data transmitted electronically.

1.7. All words, expressions and acronyms appearing in this privacy policy and beginning with a capital letter (e.g. Seller, Online Shop, Electronic Service) should be understood in accordance with their definitions contained in the Online Store Regulations available on the Online Store's website. data) – hereinafter referred to as ‘GDPR’ or ‘GDPR Regulation’. Official text of the GDPR: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679 preventing unauthorised persons from obtaining and modifying personal data sent electronically

​

2. Basis for data processing

​

2.1. The controller is authorised to process personal data in cases where – and to the extent that – at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Controller is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

2.2. The processing of personal data by the Controller requires at least one of the grounds specified in section 2.1 of the privacy policy to be present in each case. The specific grounds for the processing of personal data of Service Users and Customers of the Online Store by the Controller are indicated in the next section of the privacy policy – in relation to the specific purpose of the processing of personal data by the Controller.

​

3. Purpose, basis and period of data processing on the website

​

3.1. In each case, the purpose, basis and period of processing of personal data by the Controller, as well as the recipients of such data, result from the actions taken by a given Service Recipient or Customer in the Online Shop or by the Controller.

3.2. In connection with the subject of the Seller's activity, if such data is part of psychological consultation, psychotherapy or psychological workshops purchased by the Customer in the Online Store as a Product, the Service Provider, with the Customer's consent, may process their personal data concerning health, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning the sexuality or sexual orientation of that person, i.e. special category personal data referred to in Article 9 of the GDPR – so-called sensitive data (data referred to in Article 9(1) of the GDPR).

3.3. The Controller may process personal data within the Online Store for the following purposes, on the grounds and for the periods indicated below:

• Performance of a Sales Agreement or an agreement for the provision of Electronic Services or taking action at the request of the data subject prior to the conclusion of the above-mentioned agreements - Article 6(1)(b) of the GDPR (performance of a contract) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract – Data is stored for the period necessary for the performance, termination or other expiry of the concluded Sales Agreement or agreement for the provision of Electronic Services.

• Direct marketing – Article 6(1)(f) of the GDPR (legitimate interest of the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller – consisting in caring for the interests and good image of the Controller, its Online Store and striving to sell Products - The data is stored for the duration of the legitimate interest pursued by the Controller, but no longer than the limitation period for the Controller's claims against the data subject in relation to the Controller's business activity. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and for Sales Agreements two years).
  The Administrator may not process data for direct marketing purposes if the data subject has effectively objected to this.

• Marketing - Article 6(1)(a) of the GDPR (consent) - the data subject has consented to the processing of their personal data for marketing purposes by the Administrator - The data is stored until the data subject withdraws their consent to further processing of their data for this purpose.

• Expression of opinion by the Customer on the concluded Sales Agreement - Article 6(1)(a) of the GDPR - the data subject has given consent to the processing of their personal data for the purpose of expressing an opinion - The data is stored until the data subject withdraws their consent to further processing of their data for this purpose.

• Keeping tax records - Article 6(1)(c) of the GDPR in conjunction with Article 86(1) of the Tax Ordinance of 17 January 2017 (Journal of Laws of 2017, item 201, as amended) – processing is necessary for compliance with a legal obligation to which the Controller is subject – Data is stored for the period required by law, which requires the Controller to keep tax records (until the expiry of the limitation period for tax liabilities, unless tax laws provide otherwise).

• Establishing, investigating or defending claims that may be raised by the Controller or that may be raised against the Controller - Article 6(1)(f) of the GDPR (legitimate interest of the controller) - processing is necessary for the purposes of the legitimate interests pursued by the Controller – consisting in establishing, pursuing or defending claims that may be raised by the Controller or against the Controller – The data are stored for the duration of the legitimate interest pursued by the Controller, but no longer than for the limitation period for claims that may be raised against the Controller (the basic limitation period for claims against the Controller is six years).

• Use of the Online Store website and ensuring its proper functioning - Article 6(1)(f) of the GDPR (legitimate interest of the controller) - processing is necessary for the purposes of the legitimate interests pursued by the Controller - consisting in the operation and maintenance of the Online Store website - The data is stored for the duration of the legitimate interest pursued by the Controller, but no longer than the limitation period for the Controller's claims against the data subject in relation to the Controller's business activity. The limitation period is specified by law, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and for Sales Agreements two years).

• Keeping statistics and analysing traffic in the Online Shop - Article 6(1)(f) of the GDPR (legitimate interest of the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller – consisting in keeping statistics and analysing traffic in the Online Store in order to improve the functioning of the Online Store and increase sales of Products - The data is stored for the duration of the legitimate interest pursued by the Controller, but no longer than for the period of limitation of the Controller's claims against the data subject in relation to the Controller's business activity. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and for Sales Agreements two years).