The controller of personal data of users of the website available at www.nunalu.care is Nunalu Spółka z o.o., with its registered office in Droszków, 66-003, ul. Ptasia 31, entered into the National Court Register maintained by the District Court for the city of Zielona Góra, 8th Commercial Division of the National Court Register under KRS number 0000990065, with Tax Identification Number (NIP): 9292072642 and Statistical Number (REGON): 522974560, with a fully paid-up share capital of PLN 5,000.00 (hereinafter referred to as the “Controller”).
The Controller may be contacted:
(1) via email: hello@nunalu.care
(2) in writing at the Controller’s address: Droszków, 66-003, ul. Ptasia 31.
The purpose of this Privacy Policy is to define the actions taken regarding personal data collected via the Controller’s website and the related services and tools used by its users, as well as in connection with concluding and executing agreements outside of the website.
If necessary, the provisions of this Policy may be amended. Changes will be communicated to users by publishing the updated Policy, and in the case of individuals who have given consent for data processing via email or provided their email address when concluding agreements, such individuals will also be notified via email.
Users’ personal data is processed in accordance with the General Data Protection Regulation (GDPR), the Personal Data Protection Act, the Act of May 10, 2018 on personal data protection, and the Act of July 18, 2002 on electronic service provision.
If personal data is processed as a result of an email or complaint submitted by the user, such processing is based on Article 6(1)(b) of the GDPR, which allows processing necessary to take steps at the request of the data subject.
If the user has given separate consent, their personal data may also be processed by the Controller for marketing purposes, including sending commercial information via email to the address provided by the user (Article 6(1)(a) of the GDPR).
When the Controller concludes and performs a sales agreement or service agreement, the other party is required to provide data necessary for the conclusion of the agreement (which is a contractual requirement, and in the case of tax numbers, also a legal requirement). For this purpose, the Controller processes personal data (Article 6(1)(b) of the GDPR).
In cases involving research and analysis to improve available services (e.g. tracking tools), the data processing is based on Article 6(1)(f) of the GDPR.
Users’ personal data is stored no longer than necessary to achieve the purpose of processing, i.e. until the consent is withdrawn (if the processing is based on consent), until the expiry of claims between the Controller and the other party regarding the concluded agreements (in the case of sales/service agreements — 2 years, counted until the end of the calendar year), or until the request sent via email is fulfilled or the complaint is resolved.
The Controller may use profiling for direct marketing purposes, but decisions based on such profiling do not relate to the conclusion or denial of contracts or the possibility of using electronic services. The result of profiling may be, for example, a discount granted to a person, sending a discount code, reminding about unfinished purchases, suggesting a product that may suit the person’s interests or preferences, or offering better terms compared to the standard offer. Despite profiling, the individual freely decides whether to use the discount or better terms offered in this way. Profiling involves automated analysis or forecasting of a person’s behavior on the Controller’s website, e.g. adding a specific product to the cart, browsing a specific product page, or analyzing previous activity on the website. The condition for such profiling is that the Controller holds the person’s personal data in order to send them, for example, a discount code.
To ensure proper functioning of the website and its features, the website may, while being used by the User, collect additional information, including but not limited to:
Taking into account the nature, scope, context, and purposes of processing, as well as the risk of violation of the rights or freedoms of natural persons with varying likelihood and severity, the Controller implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with the GDPR and to demonstrate such compliance. These measures are reviewed and updated when necessary. The Controller applies technical measures to prevent unauthorized persons from acquiring or modifying personal data transmitted electronically.
Additionally, the Controller may collect the following data for the following purposes:
Execution of a Contract with the Client or Taking Action at the Request of the Data Subject Before Concluding a Contract
Marketing
Customer Feedback
Maintaining Accounting Records
Establishment, Pursuit, or Defense of Claims Raised by or Against the Controller
The Administrator ensures that all collected personal data is used to fulfill obligations to users. This information will not be shared with third parties except in situations where:
Additionally, personal data of service recipients and customers may be transferred to the following recipients or categories of recipients:
The Administrator may share anonymized data (i.e., data that does not identify specific users) with external service providers for the purpose of better understanding the attractiveness of advertisements and services for users. In this regard, due to the location of the software providers, data may be transferred – while ensuring protection principles – to third countries, provided they offer a standard contractual arrangement approved by the European Commission for personal data processing or have the appropriate authorization to do so under bilateral data processing agreements between the European Union and the third country, which is not a member of the European Economic Area. For the Administrator, these entities are:
The Administrator’s website may use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google Analytics uses cookies to help website operators analyze how visitors use the site. The information generated by the cookie about the use of the website by visitors is usually transferred to Google and stored on its servers in the United States. According to current IT standards, the IP addresses of users visiting the Administrator’s website are anonymized. In exceptional cases, the full IP address is sent to a Google server in the United States and anonymized there. On behalf of the Administrator, Google will use this information to evaluate the website for its users, prepare reports on website traffic, and provide other services related to website traffic and internet usage for website operators. Google will not associate the IP address provided in Google Analytics with any other data it holds. For more information on how Google Analytics collects and uses data, visit Google’s official website at www.google.com/policies/privacy/partners. Additionally, any user can prevent Google from collecting and processing data related to their use of the website by downloading and installing a browser plugin at the following link: http://tools.google.com/dlpage/gaoptout.
When sharing data with third parties, the Administrator ensures that it is only done with entities holding certificates under the (former) EU–US and Switzerland–US Privacy Shield programs, which can be found at www.privacyshield.gov. Such entities, when using information from the European Economic Area (EEA), will do so in compliance with the “Accountability for Onward Transfer” principle of the Privacy Shield program. In relevant cases, the Administrator will rely on the EU standard contractual clauses and other safeguards to enable transfers outside the EEA. According to the decision of the Court of Justice of the European Union from July 16, 2020, regarding the EU–US Privacy Shield and guidelines from the European Data Protection Board, the Administrator continues to assess the legal system of the countries to which data is transferred and, if necessary, updates measures to ensure appropriate levels of protection.
A user whose personal data is being processed has the right to:
The exercise of the above rights is carried out upon the user’s request sent to the email address hello@nunalu.care Such a request should include the user’s full name.
The user ensures that the data they provide or publish on the website is accurate.
“Cookies” refers to data, particularly text files, stored on the end devices of users (usually on the computer’s hard drive or mobile device) used to save certain settings and data by the user’s browser to enable browsing of websites. These files allow the device to be recognized and the website to be displayed accordingly, providing comfort during its use. Storing cookies thus allows for proper customization of the website and offerings according to the user’s preferences – the server recognizes and remembers, among other things, preferences such as: visits, clicks, and previous actions.
Cookies contain, in particular, the domain name of the website from which they originate, the time they are stored on the end device, and a unique number used to identify the browser from which the connection to the website is made.
Cookies are used for:
Cookies do not serve to identify the user and do not establish their identity.
The main division of cookies is based on:
The use of cookies to adjust website content to user preferences does not generally involve collecting any information that would allow the identification of the user, although sometimes such data may be considered personal data, as they enable the attribution of certain behaviors to a specific user. Personal data collected through cookies can only be collected to perform specific functions for the user. Such data is encrypted to prevent unauthorized access.
Cookies used by this website are not harmful to either the user or the end device they are using. Therefore, it is recommended not to disable cookie handling in browsers for the proper functioning of the service. In many cases, software used to browse websites (the web browser) by default allows storing information in the form of cookies and other similar technologies on the user’s end device. The user can change how cookies are used by their browser at any time. To do so, the browser settings should be changed. The method for changing settings differs depending on the software (web browser) being used. Appropriate instructions can be found on the help pages, depending on the browser used.
In the context of cookies technology, the Administrator may use tracking pixels or clear GIF files to gather information about how the user interacts with the services and responds to marketing messages sent by email. A pixel is a software code that enables embedding an object, typically an image of pixel size, on the website, allowing the tracking of user behavior on websites where it has been placed. After giving the appropriate consent, the browser automatically establishes a direct connection with the server hosting the pixel, so the processing of data collected through the pixel is done under the data protection policy of the partner who manages the aforementioned server.
The Administrator may also use web log files (which contain technical data, such as the user’s IP address) to monitor traffic on its services, resolve technical issues, detect fraud, and prevent it, as well as enforce the provisions of the user agreement.
The Administrator informs that the website does not respond to Do Not Track (DNT) signals, but the user can disable certain forms of tracking online, including some analytical data and personalized ads, by changing cookie settings in their browser or using our cookie consent tools (if applicable).
Detailed information on changing cookie settings and deleting them in the most popular web browsers can be found in the browser’s help section and on the following pages (just click on the respective link):
Detailed information on managing cookies on mobile phones or other mobile devices should be available in the mobile device’s user manual.
