Privacy Policy

1. This document defines the Privacy Policy for the Orderye online service operating at https://orderye.com/, operated by Paweł Pierzchała, operating at ul. Ogrodniczek 9/15, 30-105 Kraków, Poland, VAT ID: PL9222979199, which in particular covers rules regarding the protection of personal data and the security of other data entered into the Service by the User.
2. The Privacy Policy forms an integral part of the Terms of Service of the Orderye online service.

Terms used in this document mean:

1. Personal Data Controller (also referred to as the Controller) - Paweł Pierzchała, operating at ul. Ogrodniczek 9/15, 30-105 Kraków, Poland, VAT ID: PL9222979199, email: hello@orderye.com.
2. Service - the website at https://orderye.com/ and all of its subpages,
3. User - a natural person who uses the Service and provides their personal data within it.
4. Personal Data - information about an identified or identifiable natural person by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity, including image, voice recording, contact details, location data, information contained in correspondence, and information collected via recording equipment or other similar technology,
5. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC,
6. Terms of Service - the Terms of Service of the Orderye online service operating at https://orderye.com/.

1. The Controller is the controller of personal data within the meaning of the GDPR.
2. The Controller collects and processes personal data in accordance with applicable laws, in particular the GDPR, and in accordance with the principles set out therein.
3. The Controller informs about data processing at the time of collection. The Controller processes data within the scope, for the period, and for the purposes specified each time in the notices provided under the forms used to collect personal data from the User.
4. The Controller transfers Personal Data exclusively to trusted subcontractors of the Controller, i.e., providers responsible for operating IT systems, entities such as banks and payment operators, entities providing accounting and legal services, marketing agencies (within the scope of marketing services), and entities providing other IT and software development services.
5. The Controller has the right to transfer selected Personal Data of the User to competent authorities and third parties if required by applicable law and when such entities request disclosure on an appropriate legal basis.
6. The Controller ensures the security and confidentiality of processed personal data and provides the User with access to information about data processing. If, despite the applied security measures, a Personal Data breach occurs (e.g., data leak or loss) and such a breach is likely to result in a high risk to the rights or freedoms of the User, the Controller will inform the User of such an event in accordance with applicable regulations.
7. The User may contact the data controller. The contact details are as follows:
   Mailing address:
   Paweł Pierzchała
   ul. Ogrodniczek 9/15
   30-105 Kraków, Poland
   
   Email address: hello@orderye.com
   Phone number: +48 790 564 521

1. The Controller uses all available technical and organizational measures to ensure the security of the User's personal data and protect it against accidental or intentional destruction, accidental loss, modification, unauthorized disclosure, or unauthorized access. Users' Personal Data is stored and processed on high-security servers with appropriate security measures meeting the requirements of Polish and EU law.
2. Entrusted data is stored on high-grade hardware and servers in appropriately secured data centers accessible only to authorized persons.
3. The Controller carries out personal data processing activities in compliance with all legal and technical requirements imposed by personal data protection regulations. The Controller continuously analyzes the risks associated with processing personal data and ensures that only authorized persons have access to data and only to the extent necessary to perform their duties.
4. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities guarantee the application of appropriate security measures whenever they process Personal Data on behalf of the Controller.
5. The Controller undertakes to maintain backup copies containing the User's personal data.

1. In the event of a change in personal data, the User should update it by sending an appropriate message to the Controller.
2. The User is entitled to the following rights:
   1. the right to information about the processing of Personal Data,
   2. the right to obtain a copy of the Personal Data processed by the Controller,
   3. the right to rectification of Personal Data,
   4. the right to erasure of Personal Data (on this basis, one may request the deletion of data the processing of which is no longer necessary for any of the purposes for which it was collected),
   5. the right to restriction of processing of Personal Data,
   6. the right to data portability,
   7. the right to object to the processing of Personal Data for marketing purposes (the User may object at any time to the processing of Personal Data for marketing purposes without having to justify such an objection),
   8. the right to object to other purposes of data processing (the User may object at any time - on grounds relating to their particular situation - to the processing of Personal Data carried out on the basis of the Controller's legitimate interest; such an objection requires justification),
   9. the right to withdraw consent if Personal Data is processed on the basis of consent (withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal),
   10. the right to lodge a complaint with a supervisory authority supervising the processing of Personal Data, competent for the User's habitual residence, place of work, or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
3. The Controller may refuse to delete the User's personal data if retaining the personal data is necessary due to a legal obligation imposed on the Controller by law.
4. The User has the right to submit a request regarding the exercise of the rights listed above by mail or electronically (email). The Controller's contact details are specified in § 3 section 7.
5. If, based on the request referred to in section 4, the Controller is unable to identify the natural person to whom the request relates, the Controller will ask the applicant for additional information. Failure to provide additional information will result in refusal to fulfill the applicant's request.
6. The Controller responds to the request within one month of its receipt. If it is necessary to extend this period, the Controller will inform the applicant of the reasons for the extension and the expected date of response.

1. Personal Data is processed for the following purposes and on the following legal bases:
   1. Using the Service:
      Personal Data of all persons using the Service (including IP address or other identifiers and information collected via cookies or other similar technologies) is processed by the Controller for the purpose of:
      1. providing services electronically (legal basis: necessity of processing for the performance of a contract - Article 6(1)(b) GDPR),
      2. analytical and statistical purposes (legal basis: consent - Article 6(1)(a) GDPR),
      3. establishing, pursuing, or defending against claims (legal basis: legitimate interest of the Controller - Article 6(1)(f) GDPR, consisting in the protection of the Controller's rights).
   2. Registration in the Service, order form:
      In order to set up, operate, and maintain a User Account, the User is asked to provide the Personal Data indicated in the registration form. Providing data is voluntary, but refusal to provide it makes it impossible to set up a User Account. In order to place an order in the Service, the User is asked to provide the Personal Data indicated in the order form. Providing data is voluntary, but refusal to provide it makes it impossible to place an order. The Personal Data provided by the User is processed by the Controller for the purpose of:
      1. providing services electronically (legal basis: necessity of processing for the performance of a contract - Article 6(1)(b) GDPR),
      2. analytical and statistical purposes (legal basis: consent - Article 6(1)(a) GDPR),
      3. establishing, pursuing, or defending against claims (legal basis: legitimate interest of the Controller - Article 6(1)(f) GDPR, consisting in the protection of the Controller's rights).
   3. Marketing
      The Controller processes Users' Personal Data in order to carry out marketing activities, which may consist in particular in displaying marketing content tailored to the User's interests or sending commercial information electronically for purposes related to direct marketing of goods and services. In such cases, the User's Personal Data is processed by the Controller on the basis of the User's consent (Article 6(1)(a) GDPR), which may be withdrawn. The Controller's marketing purposes may be carried out through profiling, consisting in the automated processing and evaluation of Personal Data in order to analyze user behavior and create a forecast for the future, allowing the display of content aligned with the User's individual preferences and interests.
   4. Contact form, traditional mail, and electronic correspondence (email)
      The User may send messages to the Controller via email using the Controller's contact details available in the Service, the Terms of Service, or this Privacy Policy, as well as via the contact form available in the Service. The Controller uses the Personal Data contained in such correspondence solely for the purpose of communication and resolving the matter to which the correspondence relates. The legal basis for processing the Data is the legitimate interest of the Controller - Article 6(1)(f) GDPR - consisting in maintaining correspondence addressed to the Controller in connection with its business activity, and in the case of contact related to provided services or an agreement - necessity of processing for the performance of a contract - Article 6(1)(b) GDPR.
   5. Telephone contact
      The User may contact the Controller by telephone for matters related to provided services or a concluded agreement, as well as other matters. In the event of telephone contact regarding matters unrelated to a concluded agreement or provided service, the Controller may request Personal Data only where necessary to handle the reported matter. The legal basis for processing Personal Data is the legitimate interest of the Controller - Article 6(1)(f) GDPR - consisting in the need to resolve a reported matter related to its business activity, and in the case of contact related to provided services or an agreement - necessity of processing for the performance of a contract - Article 6(1)(b) GDPR.
   6. Social media profiles
      The Controller maintains profiles on social media (including Facebook). The Controller processes Personal Data left by visitors to those profiles, such as comments or online identifiers. The Controller uses this data to effectively operate the profiles, enable activity on those profiles, and for analytical or statistical purposes. The legal basis for processing Personal Data is the legitimate interest of the Controller - Article 6(1)(f) GDPR - consisting in promoting its business and provided services, and where applicable pursuing or defending against third-party claims. The above does not apply to the processing of personal data by social media platforms themselves; to learn about the data processing rules of social media platforms, please refer to their respective privacy policies.
2. The data retention period depends on the service provided, the purpose, and the legal basis of processing. As a rule, data is processed for the duration of providing the service or fulfilling an order. Where the legal basis for processing Personal Data is consent, data is processed until the consent is effectively withdrawn. Where the legal basis for processing Personal Data is the legitimate interest of the Controller, data is processed until an effective objection is lodged.
3. The Personal Data retention period referred to in section 2 may be extended where processing is necessary to establish, pursue, or defend against potential claims. After that period, Personal Data may be processed only if and to the extent required by applicable law.
4. After the expiration of the Personal Data retention period, Personal Data is deleted or irreversibly anonymized.

1. The Controller uses cookies. Cookies are small text files sent (stored) by the Service on the User's end device (e.g., computer, smartphone).
2. The Controller uses cookies to provide services electronically, improve them and enhance their quality, as well as for analytical and statistical purposes and to tailor the Service to the needs of its Users. By using cookies, the Controller personalizes content and advertisements. Information about how the User uses the Service is shared by the Controller with trusted social media, advertising, and analytics partners in order to provide the highest quality services in terms of online store operation, analytics, customization, and personalization.
3. Two types of cookies are used within the Service: "session" cookies and "persistent" cookies. Session cookies are temporary files stored on the User's end device until logging out, leaving the website, or closing the software (web browser). Persistent cookies are stored on the User's end device for the time specified in the cookie parameters or until deleted by the User.
4. Within the Service, the Controller uses the following types of cookies:
   1. essential - enabling the use of services and functionalities available within the Service, e.g., used for handling user authentication or populating the shopping cart during online purchases;
   2. functional - enabling the Service to remember the User's choices and customize the Service, e.g., with respect to language preferences, font size, appearance of the Service, etc.;
   3. analytical - enabling the collection of information such as the number of visits and traffic sources in the Service. Collecting this data helps determine which pages are visited most frequently and generates traffic statistics for the Service, allowing the Controller to improve the performance of the Service. Collected data is processed in anonymized form. This category includes Google Analytics cookies;
   4. advertising - enabling the tailoring of content displayed within and outside the Service, including advertisements, to Users' interests. Data regarding browsing history, activity on websites (e.g., purchase history, how services are used, types of content and ads displayed), or geolocation data may be used to present personalized content. Based on information from the Service and the User's activity on other websites, a profile of the User's interests is built.
5. Functional, analytical, and advertising cookies may be installed by the Controller and its trusted partners through the Service.
6. The legal basis for processing data in connection with the use of essential cookies is the necessity of processing Personal Data for the performance of a contract (Article 6(1)(b) GDPR). For other cookies, the legal basis for processing Personal Data is the legitimate interest of the Controller or the User's consent (Article 6(1)(a) and (f) GDPR). To use functional, analytical, and advertising cookies, the Controller must obtain the User's consent.
7. The consent referred to in section 6 is granted via the appropriate form displayed during the first visit to the Service. Granted consent may be withdrawn or adjusted at any time. To change or withdraw granted consents, please contact the Controller.
8. The User may change cookie settings in their web browser.
9. Changing settings for cookies and similar technologies may affect the functioning of the Service and the services provided through it.

1. In accordance with the practice of most websites, the Controller stores HTTP requests directed to its server (server logs). Accordingly, the Controller stores the following information:
   1. IP addresses from which users browse content on our Service;
   2. time of receipt of the request,
   3. time of sending the response,
   4. client station name - identification carried out via the HTTP protocol,
   5. information about errors that occurred during the execution of the HTTP transaction,
   6. URL address of the page previously visited by the user (referrer link),
   7. information about the user's browser.
2. Collected logs are stored for an indefinite period as auxiliary material used to administer the Service. The information contained therein is not disclosed to anyone other than persons authorized to administer the Service. Based on log files, statistics may be generated to assist in administering the Service. Aggregate summaries in the form of such statistics do not contain any features identifying visitors to the Service.
3. The Controller processes information contained in the logs for technical and administrative purposes, to ensure the security of the IT system and manage that system, as well as for analytical and statistical purposes - in this respect, the legal basis for processing Personal Data is the legitimate interest of the Controller (Article 6(1)(f) GDPR).

1. As part of the Controller's use of tools supporting ongoing operations provided e.g. by Google, Users' Personal Data may be transferred to a country outside the European Economic Area (EEA), in particular to the United States of America (USA) or another country in which a cooperating entity maintains tools for processing Personal Data in cooperation with the Controller. The Controller transfers Personal Data outside the EEA only when necessary and while ensuring an adequate level of protection, primarily through the use of standard contractual clauses issued by the European Commission.

1. This Privacy Policy is subject to updates in connection with ongoing analysis of technical and legal conditions related to the processing of personal data.
2. This Privacy Policy is effective as of January 1, 2025.