Privacy policy

We respect the right to privacy of those who use the Website (hereinafter “Users”) and make every effort to ensure that the personal data of our Users is processed in accordance with applicable laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter “Regulation”).

The use of the functionalities or services available on the Website may require us to process the Users’ personal data. The use of services provided by our partners, which Users may access on the Website, may involve the processing of Users’ personal data by our partners.

Our Privacy Policy has been developed to inform Users who the controller of their personal data is, what personal data we process, for what purpose, on what basis and for how long we process them, and with whom we share it, as well as what rights Users have as personal data subjects.

This Policy is kept under review and will be updated, as necessary. If changes are made, we will post the new version of the Privacy Policy on the Website.

I. Personal Data Controller

The Controller of Users’ personal data is Rorohiko Spółka z ograniczoną odpowiedzialnością with its registered office in Gdańsk (80-251) at ul. Stefana Batorego 16/1A, entered to the Register of Entrepreneurs of the National Court Register by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register under KRS number 0000769483, NIP 382458674, REGON 7010904899, holding share capital of PLN 5,000.00 (hereinafter referred to as the “Service Provider”).

Furthermore, partners of the Service Provider providing services to the Users, which involve processing of the Users’ personal data by the Service Provider’s partners, are additional controllers of the Users’ personal data.

The Service Provider’s partners process the Users’ personal data in accordance with the principles and legal basis of processing defined by them.

II. Obtaining Information on personal data processing

For all matters relating to the processing of personal data (except as set out below), Users should contact the Service Provider using the following contact details: Rorohiko Sp. z o.o., ul. Stefana Batorego 16/1A, 80-251 Gdańsk, e-mail address: info@athomeliving.pl

For matters relating to the processing of personal data by the Service Provider’s partners, Users should contact the Service Provider’s partner at the contact details provided to the Users by the Service Provider’s partner

III. Scope of personal data processing

The Service Provider processes the Users’ personal data which the Users provide or leave during the use of the functionalities available on the Website, including in electronic forms or stored in cookies.

The Service Provider processes personal data necessary to use the functionalities or make the services provided on the Website available (in the event that the use of the functionalities or making the services available requires the Users to provide personal data, for example their e-mail addresses, telephone numbers, first and last names), as well as data and information related to the Users’ use of the Website, which may include in particular: IP address or other identifier, information about the Users’ terminal equipment, browser or operating system, logging on to or off the Website, Users’ activity on the Website (including the extent of use of the functionalities available on the Website, clicks, history of searched, displayed and viewed content, offers or advertisements). The Service Provider may also process information about which services provided by the Service Provider’s partners (and to what extent) the Users use. For this purpose, the Service Provider may use technologies that enable the collection and storage of information on the Users’ terminal equipment. The Service Provider may also have access to the content of complaints submitted to the Service Provider’s partner by the Users and process the data and information contained therein.

In each case, the extent of the Users’ personal data processed by the Service Provider depends on the extent of the Users’ use of the functionalities and services available on the Website.

In order to ensure security of the process of using functionalities and services available on the Website, as well as confidentiality and integrity of data transmission, the Service Provider may use encryption technologies on the Website, in particular in the form of the SSL protocol.

IV. Purpose and legal basis for personal data processing

The Service Provider may process the Users’ personal data for the following purposes:

to conclude and perform contracts for the provision of specific services available on the Website, usually concluded in accordance with the regulations applicable to the service, made available by the Service Provider and accepted by the Users – in the case of conclusion of such a contract with the Users, pursuant to Article 6(1)(b) of the Regulation,
to comply with the Service Provider’s legal obligations, in particular with regard to the maintenance and archiving of records or the fulfilment of a request from a competent authority concerning the Users’ personal data pursuant to Article 6(1)(c) of the Regulation and the provisions relevant to those obligations,
to determine, safeguard and investigate claims by the Service Provider or defend against claims lodged against the Service Provider, based on the Service Provider’s legitimate interest in determining, safeguarding, investigating and defending against claims, pursuant to Article 6(1)(f) of the Regulation,
for analytical and statistical purposes on the basis of the Service Provider’s legitimate interest in being able to conduct analyses, make reports and statistical, analytical and performance measurements, measurements of the Users’ activities, in particular for the purpose of improving and enhancing the electronic services available on the Website, pursuant to Article 6(1)(f) of the Regulation,
to conduct correspondence on the basis of Article 6(1)(b) of the Regulation (taking steps to conclude contracts for the provision of specific services available on the Website or to conduct correspondence relating to the performance of contracts), Article 6(1)(c) of the Regulation and the applicable legislation (where the correspondence constitutes the fulfilment of legal obligations on the part of the Service Provider) or Service Provider’s legitimate interest in responding to correspondence under Article 6(1)(f) of the Regulation, or the Users’ consent, under Article 6(1)(a) of the Regulation (where correspondence is sent on the basis of a relevant consent),
to conduct marketing of the Service Provider’s own products or services, on the basis of the Service Provider’s legitimate interest in being able to offer the Service Provider’s own products or services to Users who use the Service Provider’s products or services, pursuant to Article 6(1)(f) of the Regulation,
in the case of personal data processed on the basis of the User’s consent to such processing, the wording of the consent shall determine the purpose for which the Service Provider processes the User’s personal data, whereby the legal basis for the processing of such personal data shall be Article 6(1)(a) of the Regulation.

The Service Provider may also process the Users’ personal data for marketing purposes, including those related to the marketing of its own and third parties’ products or services, on the basis of consents granted by the Users. In that case, the legal basis for the processing of personal data by the Service Provider shall be the Users’ consents pursuant to Article 6(1)(a) of the Regulation. Pursuing marketing purposes may include, in particular, sending by the Service Provider, on its own behalf or on behalf of others, commercial information by electronic means or to the Users’ telephone number, as well as providing or displaying offers or advertisements of the Service Provider or third parties to the Users on the Website.

V. Disclosure of personal data (recipients of personal data)

The Users’ personal data may be made available by the Service Provider to entities processing personal data on behalf of the Service Provider, including but not limited to entities used by the Service Provider or entrusted by the Service Provider to perform activities within the scope of its business, entities providing tax, accounting, legal, technical or IT services to the Service Provider.

The Users’ personal data may be made available by the Service Provider to entities processing personal data on their own behalf (other personal data controllers), among others to the Service Provider’s partners (in the case when making the Users’ personal data available is necessary to make available to the Users or use by the Users of the services provided by the Service Provider’s partners), to entities providing delivery, courier, postal or banking services, to authorised entities or public bodies to which the Service Provider is obliged to make personal data available on the basis of legal regulations in force in the territory of the Republic of Poland.

VI. Transfers of data outside the EEA

The Service Provider accepts the possibility of cooperation with partners who are based in countries outside the European Economic Area (EEA). The Service Provider may transfer personal data outside the EEA only if it is necessary and ensuring a high level of protection of such data, in particular by applying the standard contractual clauses adopted by the European Commission for the transfer of personal data to entities domiciled outside the EEA.

VII. Duration of personal data processing

The duration of personal data processing by the Service Provider depends on the legal basis and the purpose of the processing, subject to the principle of accountability. In view of the above, the Users’ personal data may be processed for the following periods:

in the case of processing of personal data for the purpose of concluding and performing contracts for the provision of specific services available on the Website – for the duration of the contracts for the provision of the services and, after their termination, for the period specified in items b) and c) below,
in the case of processing of personal data for the purpose specified in item IV.b) of this Policy – for the time necessary for the fulfilment of the obligations and the time during which the Service Provider may bear legal consequences of non-fulfilment of the obligations,
in the case of processing of personal data for the purpose specified in item IV.c) of this Policy – for the time necessary to establish, safeguard and pursue claims by the Service Provider or to defend against claims lodged against the Service Provider, taking into account the limitation periods laid down by the applicable law,
where processing of personal data is based on the legitimate interests of the Service Provider – at the latest by the time of lodging an effective objection to the processing of personal data, subject to the other provisions of item VII of the Policy,
where processing of personal data is based on consents granted for such processing – at the latest until such consents are withdrawn.

In the case of personal data processed for different purposes or under different legal bases of processing for which there are different processing periods, the total processing time shall not be longer than the last processing period.

VIII. Rights available in connection with the processing of personal data

In connection with the processing of the Users’ personal data by the Service Provider, the Users are entitled to the following rights:

the right of access to the personal data,
the right to rectification of their personal data,
the right to erasure of their personal data (the right to be forgotten),
the right to restriction of processing of their personal data,
the right to the data portability to another controller,
the right to object to data processing, including profiling,
the right to withdraw consent where the Service Provider processes User’s personal data on the basis of a consent, at any time, without affecting the lawfulness of the processing carried out on the basis of such consent before its withdrawal,
the right to file complaints to the President of the Personal Data Protection Office when the User finds that the processing of their personal data breaches the provisions of the Regulations.

IX. Automated decision-making, including profiling

The display of offers or advertisements on the Website may be carried out with the use of profiling, which consists in using the Users’ personal data to assess certain of their personal factors, in particular to analyse or forecast the Users’ interests, behaviour or consumer preferences and to display offers or advertisements to the Users in accordance with such assessment. The personal data used in the profiling process include data and information related to the Users’ use of the Website, which may include in particular: the IP address or other identifier, information about the Users’ terminal equipment, browser or operating system, the Users’ activity on the Website, such as the extent to which they use the functionalities available on the Website, clicks, history of searched, displayed and viewed content, offers or advertisements.

Otherwise, the processing of the Users’ personal data does not involve exclusively automated decision-making or profiling within the meaning of Article 22 of the Regulation, which could have legal effects for the Users or materially affect them in a similar manner.

X. Source of data or information obtained otherwise than from the Users

Information regarding the Users’ use of services provided by the Service Provider’s partners may come from the Service Provider’s partners.

XI. Requirement to provide personal data

Providing or leaving personal data is voluntary, although it is necessary in order to use those functionalities of the Website which require providing personal data or concluding and performing contracts for providing specific services available on the Website.