Privacy Policy

1. Controller

YES ORIGINAL POLAND Sp. z o.o., ul. Franciszkańska 3, lok. 35, 00-233 Warsaw, Poland
E-mail: info@allikestore.com · Phone: +48 459 569 103
We are not legally obliged to appoint a data protection officer. For data protection questions please contact the e-mail address above.

2. Hosting

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers are located in Germany. Legal basis: our legitimate interest in secure provision (Art. 6(1)(f) GDPR). A data processing agreement is in place.

3. Server log files

When the website is accessed, the provider automatically collects access data (IP address, date/time, requested file, browser, operating system) for technical provision and security (Art. 6(1)(f) GDPR).

4. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption.

5. Cookies and consent

We use technically necessary cookies and – only with your consent – cookies and services for analytics and marketing. Consent is given via our consent banner and can be withdrawn at any time with effect for the future; you can change your selection at any time via the "Cookie settings" link in the page footer. We log your consents and withdrawals as evidence. Legal basis for consent-based cookies: Sec. 25(1) TDDDG together with Art. 6(1)(a) GDPR; for technically necessary cookies: Sec. 25(2) TDDDG together with Art. 6(1)(f) GDPR.
[CMP PROVIDER: INSERT COMPANY NAME AND ADDRESS]

6. Web analytics and marketing (only after consent)

The following services are loaded only after your consent. Legal basis in each case: Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG. For transfers to third countries see section 7.

  • Google Tag Manager (Google Ireland Ltd.) – tag management; loads other services only after consent.
  • Google Analytics 4 (Google Ireland Ltd.) – reach and usage analysis.
  • Google Ads incl. conversion tracking and remarketing (Google Ireland Ltd.) – advertising measurement.
  • Meta Pixel (Meta Platforms Ireland Ltd.) – reach measurement and advertising on Facebook/Instagram.
  • TikTok Pixel (TikTok Technology Ltd.) – reach measurement and advertising on TikTok.
  • Microsoft Clarity (Microsoft Ireland Operations Ltd. / Microsoft Corp.) – analysis of user behaviour (incl. session recording, heatmaps).

Joint controllership with Meta: For the collection and transmission of data by means of the Meta Pixel, we are joint controllers with Meta Platforms Ireland Ltd. within the meaning of Art. 26 GDPR, on the basis of the joint controllership arrangement provided by Meta ("Controller Addendum"). Meta is solely responsible for the subsequent further processing of the data; data subject rights may be asserted both against us and against Meta.

7. Transfers to third countries

With some of the services mentioned, personal data may be transferred to the USA or other third countries.
For the USA, the European Commission has adopted an adequacy decision in the form of the EU-US Data Privacy Framework (DPF); transfers to DPF-certified companies take place on this basis. Where a recipient is not DPF-certified, we base the transfer on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and on your consent (Art. 49(1)(a) GDPR). When the TikTok Pixel is used, access from third countries including the People's Republic of China cannot be ruled out. Please note that a level of data protection equivalent to EU standards cannot be guaranteed in all cases in third countries, in particular with regard to possible access by state authorities and limited legal remedies.

8. Payment processing

To process payments we transfer the required data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Credit card, Apple Pay and Google Pay payments are also processed via PayPal. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure payment processing and fraud prevention (Art. 6(1)(f) GDPR). The provider's privacy notices apply in addition.

9. Shipping

To deliver your order we transfer your name and delivery address and – if provided by you – your e-mail address or telephone number for shipment notification to DHL (DHL Group) (Art. 6(1)(b) GDPR).

10. Customer account

You may create a customer account. We process the data provided to manage your account and perform the contract (Art. 6(1)(b) GDPR). You may have your account deleted at any time; statutory retention obligations remain unaffected.

11. Order processing, recipients and processors

To perform the contract we use carefully selected service providers who process data exclusively on our instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR. This concerns in particular hosting, merchandise management and order administration, warehousing and shipping, e-mail dispatch and customer service. In addition, we pass on data to payment and shipping service providers (sections 8 and 9), to our tax advisors and – where legally required – to public authorities.

12. Newsletter and e-mail advertising

(a) Newsletter: If you subscribe to our newsletter, we process your e-mail address and the data collected during registration in order to send you information about products, offers and promotions. Registration uses the double opt-in procedure: after registering you receive an e-mail in which you must confirm your subscription. We log registration, confirmation and unsubscription as evidence of consent. Legal basis:
Art. 6(1)(a) GDPR. You can unsubscribe at any time via the unsubscribe link in every e-mail or by message to info@allikestore.com.
(b) Advertising to existing customers: If you have purchased goods from us and provided us with your e-mail address, we may send you e-mails with recommendations for similar goods of our own. Legal basis: Sec. 7(3) UWG together with Art. 6(1)(f) GDPR. You may object to this use at any time without incurring any costs other than the transmission costs at basic rates.
(c) Performance measurement: Where our newsletters include measurement of open and click rates, this is done only on the basis of your consent (Art. 6(1)(a) GDPR); consent may be withdrawn at any time.
[NEWSLETTER TOOL: INSERT COMPANY NAME AND ADDRESS]

13. Contact

If you contact us by e-mail or phone, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR).

14. Embedded third-party content

  • YouTube (Google Ireland Ltd.): for embedding videos; loaded only after consent. We recommend the enhanced privacy mode.
  • Social media links/content (incl. Instagram, Facebook, TikTok, X): the respective providers' privacy terms apply when you access linked profiles.
  • Fonts: fonts are served locally from our server; there is no connection to Google servers.

15. Necessity of providing data

Providing your master, delivery and payment data is necessary for the conclusion and performance of the purchase contract. Without this data we cannot conclude or perform the contract. All other information is provided voluntarily.

16. No automated decision-making

Automated decision-making, including profiling, producing legal effects concerning you within the meaning of Art. 22 GDPR does not take place.

17. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may withdraw any consent given at any time with effect for the future; the lawfulness of processing carried out until withdrawal remains unaffected.

18. Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR. Where your personal data are processed for direct marketing purposes, you have the right to object at any time without giving reasons; we will then no longer process your data for those purposes. Please send your objection informally to info@allikestore.com.

19. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The competent supervisory authority for the controller is:
Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.
You may also contact the supervisory authority of your habitual residence or place of work.

20. Storage period

We store personal data only for as long as necessary for the stated purposes. In detail:
– Order and invoice data: 10 years (tax retention obligation), commercial letters 6 years;
– Customer account: until you have the account deleted, then erasure or restriction of processing within the scope of statutory retention periods;
– Server log files: generally 7 days;
– Consents and withdrawals (consent logs): 3 years after the end of the consent;
– Newsletter data: until unsubscription, evidence data for a further 3 years;
– Enquiries by e-mail/phone: until the request has been finally dealt with, unless a retention obligation applies.

21. Changes to this privacy policy

We adapt this privacy policy when the legal situation, our services or our data processing change. The version published on this page applies in each case.