Privacy Policy

PRIVACY POLICY INCLUDING COOKIES POLICY

Definitions

  1. Whenever the following phrases written with a capital letter are used in the further part of the Privacy Policy or Cookies Policy, they should be understood in the meaning given below:
    • Administrator – the administrator of personal data and Websites is Archive by X Mateusz Marmurowicz ul. Nakielska 144B, 85-391 Bydgoszcz, NIP: 9671475769 , REGON: 528385250 contact details: tel. +488810769461, e-mail contact@archivebyx.com;
    • Brands – brands of products included in the Administrator's portfolio: ARCHIVE BY X
    • User – any person using the Newsletter, Fanpage, Commercial Information, Websites and Contact Form;
    • Websites – website (a group of related websites), consisting of the following domains: www.cocoboutique.pl/
    • Social Media - fanpage, channels, profiles of the Administrator or the Administrator's brands run by the Administrator on social networking sites, e.g. Facebook, YouTube, Twitter, which contain a link to these Regulations or the Privacy Policy;
    • Newsletter - a service provided electronically, the subject of which is the delivery - after prior consent expressed by the User - of periodic materials with marketing content promoting the Administrator's activities;
    • Contact Form - a service provided electronically, available on the Websites, the subject of which is to enable the User to send a message to the Administrator;
    • Commercial Information - commercial information sent electronically, within the meaning of the Act of July 18, 2002 on the provision of electronic services;
    • Regulations - these Regulations of the Privacy Policy together with the Cookies Policy,
    • GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Journal of Laws EU 2016 L No. 119);
    • Services – services provided electronically on the Websites and in Social Media by the Administrator pursuant to the Regulations.


Privacy policy


This privacy policy (hereinafter: "Privacy Policy") sets out the rules for the collection, processing and use of personal data obtained from Users in connection with their use of the Services.

Personal data administrator

The administrator of personal data processed for the purpose of providing the Services is the Administrator: Archive by X Mateusz Marmurowicz ul. Nakielska 144B, 85-391 Bydgoszcz, NIP: 9671475769 , REGON: 528385250

You can contact the Administrator using the following details:

  1. Traditional correspondence address: Archive by X Mateusz Marmurowicz ul. Nakielska 144B, 85-391 Bydgoszcz
  2. E-mail address: contact@archivebyx.com
  3. By phone: +48881076946
The Administrator limits the collection and use of information about Users to the minimum necessary to provide them with services at the desired level, pursuant to Art. 18 of the Act on the provision of electronic services.


The Administrator applies technical and organizational measures to ensure respect for the privacy and protection of Users' personal data.

In the case of Services provided on social networking sites: Sharing, Social Media and Social Media Links, separate administrators of personal data of users of individual portals are the service providers of these portals. The Administrator is not responsible for the services provided by social networking sites or for the processing of personal data of users of these sites. The Administrator is solely responsible for processing as part of the provision of Services under the Regulations.

If you need clarification on any matters related to the processing of personal data by the Administrator, please contact us directly at the above-mentioned address. contact details.

Purposes, legal basis and time of data processing

Not all information processed by the Administrator as part of the provision of Services may constitute personal data. This may depend on how the User uses the Services and what other data about this User is processed by the Administrator. In order to ensure full rights of Users, the Administrator informs in this Privacy Policy about the processing of all information, regardless of whether they will formally fulfill the definition of personal data under the GDPR or remain outside the scope of the GDPR.

  1. Websites, Brand Links, Brand Social Media Links, Sharing
    • In order to provide the Website service, the Administrator processes information about the User's device in order to ensure the correct operation of the services: computer IP address, information contained in Cookies or other similar technologies, session data, web browser data, device data, data regarding activity on the website. Website, including on individual subpages.
    • This information does not contain data regarding the identity of Users, but in combination with other information it may constitute personal data and therefore the administrator provides it with full protection under the GDPR.
    • These data are processed in accordance with Art. 6 section 1 letter b GDPR, in order to provide the Website service, i.e. a contract for the provision of electronic services in accordance with the Regulations and in accordance with Art. 6 section 1 letter a GDPR in connection with consent to the use of specific Cookies or other similar technologies, expressed by appropriate settings of the web browser in accordance with the Telecommunications Law. The data is processed until the User stops using the Website.
    • As part of Links to Social Media Brands and Sharing, separate entities obtaining information about Users using the above-mentioned. Links or buttons are entities providing services of individual social networking sites (e.g. Facebook, Instagram, Twitter, YouTube). Information regarding data collected by social networking sites is included in the privacy policies of individual sites.

  2. Contact form
    • The name, e-mail address, title and content of the correspondence are processed for the time necessary to resolve the User's matter, including to send marketing information about the products or services selected by the User, and no longer than 3 months after settling the matter for archiving purposes, if necessary. defense against possible claims against the Administrator.
    • Providing an e-mail address and entering the content of the message is necessary to use the contact form Service. The User may provide additional information in the Contact Form, such as: name, surname and telephone number; if he prefers the Administrator to contact him in a different way. Providing the above data is voluntary and depends on the User's will.
    • This data will be processed on the basis of voluntary consent expressed before sending the completed contact form in order to provide the contact form Service in accordance with the Regulations (Article 6(1)(a) of the GDPR).
    • If the inquiry concerns Brands, products or Services, the response will include the Commercial Information so ordered.

  3. Newsletter
    • The Administrator processes the e-mail addresses of Newsletter subscribers in order to provide the ordered Newsletter service provided electronically on the basis of the Regulations. The administrator processes data:
      • 1) provided e-mail address,
      • 2) date of joining the subscription,
      • 3) information about sending Newsletters.
    • In addition, the Administrator processes e-mail addresses provided to provide the Newsletter service to provide the service in accordance with the Regulations and this Privacy Policy, in particular to inform about changes in the above-mentioned documents.
    • This data is processed on the basis of voluntary consent expressed when ordering the Newsletter service, in accordance with Art. 6 section 1 letter a GDPR, in order to provide the Newsletter service.

  4. Administrator
    • processes Users' personal data in order to enable them to use Social Media. The administrator has information:
      • 1) about liking Social Media,
      • 2) about activity in Social Media,
      • 3) the content of comments and posts posted by the User.
    • These data are processed in accordance with Art. 6 section 1 letter b GDPR, in order to provide services, i.e. contracts for the provision of electronic services in accordance with the Regulations.
    • In addition, the Administrator may share public posts of Users or otherwise use information made public on Social Media, including other activities of Users on Social Media, for the Administrator's marketing and PR purposes, e.g.: share public posts of Users, perform analyzes and statistics regarding Users' activities, respond to Users' posts.
    • These data are processed in accordance with Art. 6 section 1 letter f GDPR, i.e. in order to implement the legally justified interest of the Administrator, consisting in achieving its marketing and image goals. At the same time, Users using Social Media are aware that certain information is public and visible to other users of these Social Media, and that Users themselves decide which information will be public and which will have limited visibility by making appropriate profile settings.
    • Moreover, in the scope of using the forms of direct contact available in the Administrator's Social Media (e.g. Messenger), Users' personal data will be processed in order to enable the Administrator to contact the User, in particular their name and surname or the User's name on the social networking site, the content of correspondence (messages , threads). Messages are not stored by the Administrator in places other than the social networking site, unless their further processing is necessary for other purposes described below.
    • These data are processed in accordance with Art. 6 section 1 letter f GDPR, in the legitimate interest of the Administrator and Users consisting in the need to ensure contact between Users and the Administrator, and the processing of this data does not violate the rights and freedoms of Users.
    • The content of correspondence and contact information is processed for the time necessary to resolve the User's case and no longer than 3 months after resolving the case for archiving purposes in the event of a need to defend against possible claims against the Administrator. After this time, they are deleted from the Administrator's Social Media level, after which the Administrator will no longer be able to access this data.

  5. Complaints
    • In order to consider complaints, the Administrator processes personal data of Users submitting complaints, in particular e-mail address, name, content of the complaint, circumstances of the event giving rise to the complaint, information obtained in the course of considering the complaint, including explaining the event giving rise to it. In the course of considering complaints, the Administrator may process a number of other information, including the User's name and surname, information about the User's use of services, cookies or other similar technologies, and information about devices.
    • These data are processed in accordance with Art. 6 section 1 letter b GDPR, in order to provide services, i.e. contracts for the provision of electronic services in accordance with the Regulations and are processed for the time necessary to consider the complaint and no longer than 1 year after the end of the complaint procedure, for archiving purposes in the event of the need to defend against possible claims towards the Administrator in accordance with the information provided below.
  6. Explanatory proceedings, pursuing claims
    • In the event of undertaking an investigation regarding a possible violation of the provisions of the Regulations or legal provisions, principles of social coexistence or good manners, proceedings to pursue claims by the Administrator or other Users or entities, defense against claims of Users or other entities, the Administrator may process personal data of specific Users until the end of the ongoing proceedings and until the expiry of the limitation period for the administrator's claims against the User, which is usually 3 years in accordance with the Civil Code, but in special cases provided for by law, it may be longer.
    • If personal data will be processed in order to pursue claims of other Users, these data may be made available for this purpose to another User or entity or public authority authorized under the law, e.g. courts, police, prosecutor's office.
    • These data will then be processed, including made available in accordance with Art. 6 section 1 letter c GDPR, i.e. in order to fulfill the obligation arising from the legal provisions regarding the obligation to consider complaints, in accordance with the Act on the provision of electronic services or in accordance with Art. 6 section 1 letter f GDPR, i.e. in the Administrator's legitimate interest in pursuing claims against the User. The legitimate interest of the administrator will then override the rights and freedoms of the Service User.

  7. Pursuing claims
    • If the Administrator needs to pursue claims or defend against claims, the Administrator may process personal data of specific Users until the end of the ongoing proceedings and until the expiry of the limitation period for the Administrator's claims against the User, which is usually 3 years in accordance with Art. 118 of the Civil Code, but in special cases provided for by law it may be longer.
    • These data will then be processed in accordance with Art. 6 section 1 letter f GDPR, i.e. in the legitimate interest of the Administrator consisting in pursuing claims against the User or defending against claims. The legitimate interest of the Administrator will then override the rights and freedoms of the Service User.

  8. Statistics on the use of the Services
    • In order to improve the quality of its services, the Administrator processes statistical information regarding the use of the Websites, including information about the session, IP number, amount of time spent on individual pages and subpages, use of individual functionalities of the Services, information about the device and web browser. The administrator uses cookies or other similar technologies and statistical tools from Google Analytics and Facebook Insight. provided by Google and Facebook.
    • These data are processed in accordance with Art. 6 section 1 letter f GDPR in the legitimate interest of the Administrator consisting in facilitating the use of the Service, improving the quality and functionality of the Services provided, and the processing of this data does not violate the rights and freedoms of Users. Information about Users is not used for any additional purposes, and due to the specificity of the Services, customizing the manner of displaying the content of the Websites and Social Media, information, facilitating the use of the Websites and Social Media and improving the quality of the Services is not only a market standard, but also as well as Users' expectations towards Website and Social Media providers.
    • Moreover, the User may withdraw his/her consent at any time by changing the web browser settings regarding the admissibility of using Cookies or other similar technologies.
    • This data is processed as part of the Administrator's ongoing activities, but no longer than for a period of sixty days from receiving the information. After this time, the Administrator may further process general statistical data, which will be devoid of any information regarding individual Users.
    • However, the period of availability of statistical data in Google Analytics and Facebook Insight tools provided by Google and Facebook may be longer than sixty days, but this is beyond the administrator's decision-making scope. The administrator will no longer use them, but will have potential access to them until they are removed by the provider of the above. tools.

  9. Marketing and PR activities of the Administrator
    • The Administrator may post marketing information about its products or brands on the Websites and in Social Media. This content is displayed by the Administrator in accordance with Art. 6 section 1 letter f GDPR, in accordance with the Administrator's legitimate interest in publishing content related to the Services provided. At the same time, this action does not violate the rights and freedoms of Users, and Users expect to receive similar content, and sometimes they even expect it or it is their direct purpose of visiting the Website.

  10. Profiling
    • The Administrator performs the functions of obtaining information about Users and their behavior in the following way:
      • through voluntarily entered information (e.g. in the Contact Form);
      • by collecting cookies;
      • by using Google Analytics and Facebook Insight services.
    • The data provided by the User is processed solely for the purpose of providing the Services in accordance with Art. 6 section 1 letter f GDPR, in accordance with the Administrator's legitimate interest in providing Services.
    • A user who is a natural person has the right to object to the profiling mechanism at any time. The Administrator declares that it has technical tools enabling a User who is a natural person to express an objection. To express an objection, please send a message to the following address: ... or by post to the address of the Administrator's registered office with the note "Objection - personal data".

  11. Third party marketing
    • Information obtained from Cookies is also processed for marketing purposes of other entities, including being made available to other entities in order to present Users with marketing information from other entities in a personalized manner, tailored to the estimated interests of Users. In this way, entities using this information present information that is more tailored to Users, thanks to which they achieve greater efficiency, and Users do not receive information that is completely unsuited to their potential interests.
    • This data is processed on the basis of the legitimate interest of the Administrator and third parties using this information for their own marketing purposes, i.e. in accordance with Art. 6 section 1 letter f GDPR.

  12. Recipients of Users' data
    • Users' personal data are disclosed only to entities processing data for the Administrator on the basis of a written agreement entrusting the processing of personal data to entities providing hosting, website operation, IT, marketing, CRM and PR services.

  13. Transferring personal data to third countries
    • Personal data will not be processed in third countries.

  14. Rights of persons to whom personal data concern
    • Every data subject has the right:
      • 1) access - obtaining confirmation from the administrator whether her personal data is being processed. If data about a person is processed, he or she is entitled to access them and obtain the following information: about the purposes of processing, categories of personal data, information about the recipients or categories of recipients to whom the data have been or will be disclosed, about the period of data storage or about the criteria for their processing. determining the right to request rectification, deletion or limitation of the processing of personal data of the data subject, and to object to such processing (Article 15 of the GDPR);
      • 2) to receive a copy of the data - to obtain a copy of the data subject to processing, where the first copy is free of charge, and for subsequent copies the administrator may impose a reasonable fee resulting from administrative costs (Article 15(3) of the GDPR);
      • 3) to rectify - request the rectification of incorrect personal data or the completion of incomplete data (Article 16 of the GDPR);
      • 4) to delete data - request the deletion of personal data if the administrator no longer has a legal basis for their processing or the data is no longer necessary for the purposes of processing (Article 17 of the GDPR);
      • 5) to limit processing - request to limit the processing of personal data (Article 18 of the GDPR), when:
        1. a) the data subject disputes the accuracy of the personal data - for a period enabling the controller to check the accuracy of the data,
        2. b) the processing is unlawful and the data subject objects to their deletion and requests restriction of their use,
        3. c) the controller no longer needs the data, but they are needed by the data subject to establish, pursue or defend claims,
        4. d) the data subject has objected to the processing - until it is determined whether the legitimate grounds of the controller override the grounds for the data subject's objection;
      • 6) to transfer data - to receive personal data concerning him or her in a structured, commonly used and machine-readable format, which he or she provided to the administrator, and to request that these data be sent to another administrator if the data is processed on the basis of the data subject's consent or an agreement with contained therein and if the data are processed in an automated manner (Article 20 of the GDPR);
      • 7) to object - to object to the processing of her personal data for the legally justified purposes of the administrator, for reasons related to her particular situation, including profiling. The controller then assesses the existence of valid legitimate grounds for processing, overriding the interests, rights and freedoms of data subjects, or grounds for establishing, pursuing or defending claims. If, according to the assessment, the interests of the data subject are more important than the interests of the controller, the controller will be obliged to stop processing data for these purposes (Article 21 of the GDPR);
      • 8) to withdraw consent at any time and without giving reasons, but the processing of personal data carried out before the withdrawal of consent will still remain lawful. Withdrawal of consent will result in the administrator ceasing to process personal data for the purpose for which the consent was expressed.
    • To exercise the above-mentioned rights, the data subject should contact the controller using the provided contact details and inform him which right and to what extent he wishes to exercise.

  15. President of the Personal Data Protection Office
    • The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office with its registered office in Warsaw, ul. Stawki 2, which can be contacted as follows:
      • 1) by letter: ul. Stawki 2, 00-193 Warszawa,
      • 2) via the electronic inbox available at: https://www.uodo.gov.pl/pl/p/kontakt,
      • 3) by phone: (22) 531 03 00.

Cookies policy

In order to improve the functionality of the Websites, the Administrator declares that it uses cookies.

  1. What are cookies?
    • Cookies are files saved on the device (computer, smartphone, tablet) on which a web browser is installed, through which the User browses the Websites.
    • Cookies used by the Administrator do not store any personal data of the User. The User's identity is not disclosed using cookies. However, in combination with other data held by the Administrator, cookies may constitute information constituting personal data.
  2. What types of cookies does the Administrator use?
    • The administrator uses the following types of cookies:
      • 1) Permanent
      • 2) Own
      • 3) Advertising
      • 4) Functional
    • Cookies from third-party websites may also be saved on the User's device, in particular: Facebook, Google, Twitter. Information about cookies from these websites can be found on the websites of these entities.
  3. For what purposes does the Administrator use cookies?
    1. Provision of Services
      • The Administrator uses cookies necessary to provide the Services. These files ensure the ability to correctly display the Websites and navigate between individual subpages, remember the language preferences of the Website and enable efficient and ergonomic use of other functionalities of the Services.
      • Some cookies are necessary to provide the Services, and some are not necessary, but facilitate the use of the Services or enable the use of various functionalities.
    2. Statistics on the use of the Websites
      • Based on the collected information, the Administrator may create statistics. use of the Services, in particular views of individual pages or subpages, use of individual functionalities, in order to count visits to the Websites, their length and frequency of use of individual Services or their functionalities. Statistics and analyzes of the use of the Websites enable the Administrator to analyze the performance of the Websites and determine the development needs of the Services.
      • The statistics are created in a way that does not allow the identification of individual Website Users.
    3. Own and other entities' marketing activities
      • Interest profiles are created based on Users' behavior and are then used to provide information tailored to the estimated interests of Users. This information does not contain data regarding the identity of Users, but in combination with other information, the Administrator or entities using this information may be able to determine the identity of these Users.
    4. Does the Administrator disclose data obtained using cookies to other entities?
      • The information collected by the Administrator will not be made available to entities or persons other than those authorized under the provisions of generally applicable law and authorized to administer the Websites.
    5. How to withdraw consent to cookies / opt out of the use of cookies?
      • In any case, the User may block the installation of cookies or delete permanent cookies using the appropriate options of the web browser. In case of problems, it is recommended to use the browser's help file or contact the browser manufacturer.
      • Any User who does not consent to the use of cookies is obliged to modify the web browser settings. Configuring the User's system enabling the use of cookies constitutes consent to the Administrator storing the information referred to in Art. 173 section 2 of the Act of 16 July 2004 - Telecommunications Law.

Final Provisions

  1. The Privacy Policy and Cookies Policy may be supplemented or updated in accordance with the Administrator's current needs in order to provide Users with current and reliable information regarding their personal data and information about them. Users will be informed about any changes on the Website.
  2. The Administrator reserves the right to change the Cookie Policy, which may be influenced by the development of Internet technology, possible changes in the law on the protection of personal data and the development of the Services provided. Users will be informed about any changes in a visible and understandable way.
  3. In case of doubts as to any provisions of this Cookie Policy, the User may contact the Administrator directly.

These Policies are valid from April 18, 2024.