Preliminary provisions
The purpose of this Privacy Policy is to inform our customers and cooperators about all aspects of the process of collecting, processing, and safeguarding their personal data, including explaining to them the methods of collecting personal data and the purposes for which personal data is collected. Personal data is processed based on the applicable provisions of the law, in particular – the Regulation of the European Parliament and the Council of the European Union (EU) 2016/679 of April 27, 2016 on the protection of natural persons with respect to the processing of personal data and the free flow of such data, as well Acting on the grounds of the legal regulations in force, the Employer, repealing of Directive 95/46/WE (the General Data Protection Regulation), hereinafter referred to as GDRP, as well as the Act of May 10, 2008, on the protection of personal data (Journal of Laws, item 1000).
Who processes personal data
The controller of personal data:
Personal data, including data provided by customers in connection with the use of napcontract.com website services are processed by Nap Sp. z o.o. with its registered office in Warsaw (03-008) at Dynamiczna St. 10, entered in the register of entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000233111, NIP (Taxpayer ID no.) 5242540889, REGON (Business statistical no.) 140113649, share capital 150,000 PLN, which is the Controller of this data within the meaning of GDPR.
Contact details:
You can contact us about matters related to data protection at the following e-mail address: bok.nap@nap.com.pl – customers of NAP bricks and mortar stores and cooperating entities, and at the telephone number: (+48) 22 894 69 02
What personal data is processed
In connection with using the website napcontract.com and its services, the following personal data may be processed: first name, surname, residential address, contact address, delivery address, e-mail address, phone number, bank account number, and Taxpayer ID no. (NIP).
In connection with using the services offered on napcontract.com, additional data may be processed such as:
- IP address or other means of identification as well as information collected through cookies or using other similar technologies – in connection with viewing content on napcontract.com;
- submitting a question via the contact form, subscribing to the newsletter.
Purposes and basis for processing personal data
Viewing content on the napcontract.com website
If a customer views content on the Nap.com.pl online store website, their personal data, including personal data collected through cookies and using other similar technologies, may be processed for one or more of the purposes indicated below, depending on how they use our website:
- for the purpose of making available the content placed therein, related to the presentation of the products offered and the newsletter sign-up form – on the basis of Article 6 sec. 1 f) of the GDPR, as processing is necessary for the Controller's legitimate interests consisting in the possibility to present the products and services offered to the customer;
- for the purpose of a possible establishment or assertion of claims by the Controller or the defence against such claims – on the basis of Article 6 sec. 1 f) of the GDPR, if processing is necessary for the Controller's legitimate interests consisting in the protection of its rights;
- to analyse the customer's activity, preferences, and behaviour in order to adjust the content displayed on the website to them as well as facilitate the customer's use of the service – on the basis of Article 6 sec. 1 f) of the GDPR, as processing is necessary for the Controller's legitimate interest consisting in the possibility of presenting the customer with information on the products offered, tailored to their needs and interests, and thus increasing the sales of the products offered (marketing purposes).
In addition, the customer's activity on the napcontract.com website, including their personal data, is recorded in system logs (a dedicated computer system created to store a chronological record containing information on events and activities concerning the IT system used to provide services by the Controller). The information collected in the logs is processed in connection with the provision of services by the Controller as well as for technical purposes. This data may be temporarily stored and processed to ensure the security and correct operation of IT systems, e.g. in connection with making security copies, testing changes to IT systems, detecting irregularities, or protecting against fraud and attacks. This data is processed on the basis of Article 6 sec. 1 f) of the GDPR, as its processing is necessary for the Controller's legitimate interest consisting in ensuring the security of the website and its correct operation.
Use of the contact form on the napcontract.com website
If the customer uses the contact form to ask us a question, they are asked to provide personal data necessary for the handling of the enquiry. The provision of data is voluntary, but if the customer does not provide it, we will not be able to accept and handle the enquiry.
The customer’s personal data will be processed for one or more of the purposes indicated below:
- in order to determine the sender and handle their enquiry – on the basis of Article 6 sec. 1 b) of the GDPR, as processing is necessary for the performance of the agreement (handling of the enquiry); in order to analyse the customer's activities, preferences, and behaviours – on the basis of Article 6 sec. 1 f) of the GDPR, as processing is necessary for the Controller's legitimate interests consisting in the possibility of presenting the customer with information on the offered products that are tailored to their needs and interests, as well as for increasing the customer's satisfaction with the offered products and thus increasing their sales (marketing purposes);
- in order to determine, assert, or defend against possible claims by the Controller – on the basis of Article 6 sec. 1 f) of the GDPR, if processing is necessary for the Controller's legitimate interests consisting in the protection of its rights.
Newsletter (direct marketing)
If the customer wishes to subscribe to the newsletter, they are asked to provide the data necessary for the newsletter and grant consent to receive commercial information. If the customer agrees to receive commercial information, it is tantamount to agreeing to have their personal data processed.
The customer’s personal data will be processed for one or more of the purposes indicated below:
- for the purpose of presenting the customer with marketing content – commercial information on the products offered by NAP, including information on new products, interesting promotions, and special offers – on the basis of Article 6 sec. 1 a) of the GDPR, as processing is related to the consent granted by the customer to forwarding such content to a specified e-mail address (direct marketing);
– for the purpose of analysing the customer’s activity, preferences, and behaviours – on the basis of Article 6 sec. 1 f) of the GDPR, as processing is necessary for the Controller's legitimate interest consisting in the possibility of presenting the customer with information on the products offered, tailored to their needs and interests, as well as increasing the customer's satisfaction with the products offered, and thus increasing their sales (marketing purposes);
- in order to pursue the Controller's legitimate interest consisting in protecting its rights, including the possible establishment or assertion of claims or defence against such claims – on the basis of Article 6 sec. 1 f) of the GDPR.
Cooperation with business partners
If the data provided in an agreement concluded by NAP with a cooperating entity includes personal data, providing such data is necessary to conclude this agreement and failing to provide such data will prevent its conclusion.
The personal data provided in the agreement will be processed for one or more of the purposes indicated below:
- for the purpose of concluding and performing this agreement, on the basis of Article 6 sec. 1 b) of the GDPR, for accounting and tax purposes, in connection with the performance of the Controller's legal obligation arising from accounting and tax law provisions – on the basis of Article 6 sec. 1 c) of the GDPR;
- for the purpose of possible establishment or assertion of claims by the Controller or defence against such claims – on the basis of Article 6 sec. 1 f) of the GDPR, if processing is necessary for the Controller's legitimate interests consisting in protecting its rights.
Processing of personal data using profiling
In order to carry out marketing activities corresponding to your preferences and interests, the Controller processes your personal data collected through cookies and using other similar technologies. In this case, the processing also includes profiling, which is the automated processing of your personal data whereby the Controller evaluates selected factors concerning individuals in order to analyse their behaviour or make predictions for the future.
However, in carrying out such profiling, the Controller does not use profiling that produces legal effects on you or significantly affects you in a similar manner.
The processing of personal data using profiling is carried out for marketing purposes in order to present you with information about the products offered, tailored to your needs and interests, and to improve customer satisfaction with the products offered and services made available on the website. Processing using profiling is based on the Controller's legitimate interest consisting in being able to present marketing content that matches your preferences and interests, thereby increasing sales of the products offered.
The collection and processing of personal data is only carried out subject to your acceptance of the fact that the website napcontract.com uses cookies. Your acceptance is effected on your part through the appropriate configuration of the browser, pressing the "I accept" button or remaining on the website after reading the information on the processing of cookies. Your acceptance can be revoked at any time, in particular by clearing the cookie history and disabling cookies in the browser settings.
Who we share personal data with
The customer’s personal data may be shared with business entities that support us in operating the napcontract.com website (by sending e-mails to establish contact with our customers), provide support for and ensure the operation of our ICT tools and systems (e.g. data retension), including entities providing hosting services for the Controller, entities conducting advertising activities (marketing campaigns), payment operators, entities providing ongoing legal service to the Controller or carrying out audits, as well as entities authorised to obtain data on the basis of legal regulations, and in the case of order processing and fulfilment – our suppliers.
Brick and mortar NAP stores and cooperating entities
Personal data of the customer may be shared with the business entity delivering the goods to the customer, entities providing ongoing IT and legal services to the Controller, or entities carrying out audits, as well as entities authorised to obtain data on the basis of legal regulations.
The data of a cooperating business entity provided in an agreement may be shared with the Controller's customers – if it is necessary to ensure contact with the customer – entities providing ongoing IT and legal support or carrying out audits, as well as entities authorised to obtain data on the basis of legal regulations.
Storage time of your personal data
In accordance with applicable law, we process personal data for the time necessary to achieve the purpose of the processing as indicated in the section "Purposes and basis for processing personal data". After this time, the customer's personal data will be irreversibly deleted or destroyed in accordance with the provisions of the GDPR.
The customer's personal data will be processed:
- for the time of the customer's using their account on the napcontract.com website until it is deleted at the customer's request or until the customer exercises other rights resulting in the cessation or restriction of data processing, in particular up to the point of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data;
- for the time necessary for processing and fulfilling the order or until the customer exercises other rights resulting in the cessation or restriction of the processing of data, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the point of objecting to the processing of data;
- for the time necessary to reply to a question asked via the contact form or until the moment of exercising other rights resulting in the cessation or restriction of the processing of data, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the Controller's interest – up to the moment of objecting to the processing of data;
- until the moment of withdrawal of the customer's consent to being sent the newsletter or until the moment of exercising other rights resulting in the cessation or restriction of the processing of data, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data for the purposes of direct marketing
- for the time necessary for the purposes of exercising the right to withdraw from the agreement or until the moment of exercising other rights resulting in the cessation or restriction of the processing of data, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data.
NAP bricks and mortar stores and cooperating business entities
The customer's personal data will be processed:
- for the time necessary for the purposes of processing and fulfilling the order or until exercising other rights resulting in the cessation or restriction of the processing of data, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data;
- for the time necessary for replying to the correspondence sent to us or until exercising other rights resulting in the cessation or restriction of the processing of data, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data;
- until the customer withdraws their consent to the processing of personal data in connection with the shopping cart or until they exercise other rights resulting in the cessation or restriction of data processing, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data;
- until the moment of withdrawal of the customer's consent to being sent the newsletter or until the moment of exercising other rights resulting in the cessation or restriction of data processing, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data for the purposes of direct marketing;
- for the time necessary for the purposes of exercising the right to withdraw from the agreement or until the moment of exercising other rights resulting in the cessation or restriction of the data processing, in particular up to the moment of demanding the erasure of data or – if the processing is connected with the pursuit of the Controller's interest – up to the moment of objecting to the processing of data.
The time of personal data retention may be extended each time by the time of limitation of claims, if the processing of personal data is necessary for NAP to assert or defend against claims. The personal data of a cooperating business entity provided in an agreement will be processed for the time necessary to perform the agreement, allowing for the retention time of such data required by accounting and tax law.
The time of personal data retention may be extended each time by the period of limitation of claims, if the processing of personal data is necessary for the Controller to assert or defend against claims.
The rights connected with the processing of your personal data
Customers and cooperating business entities have certain rights related to the processing of their personal data.
The right to information about the processing of personal data.
In order to exercise this right, at the request of the data subject, the Controller is obliged to provide them with information on the processing of personal data, including in particular the purposes and legal basis of the processing, the scope of the data held, the entities to which the personal data is disclosed, as well as the planned time for which the data is to be retained and the date of its erasure. In exercising the above right, the Controller will provide you with a copy of the personal data relating to you that is processed.
The right to have personal data rectified.
In order to exercise this right, at the request of the data subject, the Controller is obliged to rectify any inconsistencies or errors concerning the personal data being processed and complete or update it if it is incomplete or has changed.
The right to have personal data erased.
The data subject may request the erasure of personal data whose processing is no longer necessary for any of the purposes for which it was collected by the Controller.
The right to have the processing of personal data restricted.
In order to exercise this right, at the request of the data subject, the Controller shall cease performing operations on the personal data, with the exception of operations with respect to which the data subject has granted their consent (in which case it is necessary to withdraw the consent) as well as cease their retention in accordance with the adopted rules on retention, or until the reasons for the restriction of data processing cease to exist (e.g. if a decision authorising further processing is issued by a supervisory authority).
The right to have personal data transferred.
In order to exercise this right, at the request of the data subject, insofar as the data is processed in connection with an agreement concluded or consent given, the Controller is obliged to conveys the personal data provided by that person in a readable format. Personal data may also be sent to another entity if it is technically feasible, both on the part of the Controller and the other entity.
The right of objection to the processing of personal data.
- for marketing purposes. The customer may object at any time to the processing of personal data for marketing purposes, without having to justify such objection;
- for the purposes of the Controller's legitimate interests. The data subject may at any time object to processing of personal data on the basis of a legitimate interest of the Controller (e.g. for analytical or statistical purposes). An objection in this respect must contain a statement of reasons and is be subject to review by the Controller.
For customers of the website napcontract.com, a request to exercise the rights specified above may be submitted by post to the following address: ul. Dynamiczna 10 (03-008 Warsaw); by e-mail to sent: bok.nap@nap.com.pl.
For customers of NAP bricks and mortar stores and cooperating business entities, a request for the exercise of the rights specified above may be submitted:
- at a NAP store in writing,
- by post, in a letter sent to the following address: ul. Dynamiczna 10 (03-008 Warsaw);
- by e-mail sent to: bok.nap@nap.com.pl.
The request should indicate as precisely as possible what it concerns, i.e. in particular, who submits the request, which of the rights described above you wish to exercise, and what purposes of processing the request concerns (e.g. marketing purposes). If the Controller is unable to determine the content of your request or identify the person making the request based on the request made, we will ask you to provide additional information. A reply to the request will be provided to the e-mail address from which the request was sent, by registered mail to the address indicated by the person making the request, or to the customer's account if the request was made in this way, immediately, but no later than within one month of its receipt by the Controller. If it is necessary to extend this period, the Controller is obliged to inform the person who made the request of the reasons for such an extension.
The right to withdraw consent for personal data to be processed.
Where the Controller processes your personal data on the basis of your consent, you may withdraw that consent at any time, at your sole discretion.
The person who wishes to withdraw their consent to the processing of their personal data may do so in the following manner:
- send an e-mail directly to the Controller, i.e. to bok.nap@nap.com.pl;
- click on the link in the e-mail attached at the end of the message.
For customers of NAP bricks and mortar stores and cooperating business entities: at a NAP store in writing,
- by post, in a letter sent to the following address: ul. Dynamiczna 10 (03-008 Warsaw),
- by e-mail sent to: bok.nap@nap.com.pl
Where the Controller processes personal data on the basis of the consent given by the data subject, withdrawal of this consent does not affect the lawfulness of the existing processing.
The right to lodge a complaint with the President of the Office for Personal Data Protection.
If the data subject believes that their personal data is being processed contrary to applicable law, they may lodge a complaint with the President of the Office for Personal Data Protection.
Safety rules
Nap Sp. z o.o. ensures the security of personal data by means of proper technical and organisational measures aimed at preventing unlawful processing of data, as well as accidental data loss, destruction, and damage. Furthermore, we take special care to ensure that personal information is:
- correct and lawfully processed,
- obtained only for specified purposes and not processed further in a manner incompatible with those purposes,
- adequate, relevant and not excessive,
- accurate and up-to-date,
- not retained longer than necessary,
- processed in accordance with the data subject's rights, including the right of objection
- securely stored,
- not transferred without proper protection.
For your safety, remember to:
- use anti-virus software, including regularly scanning your hard drive for viruses;
- use of the napcontract.com website only with computers that you trust and on which only well-tested software is installed. If you use someone else's computer, there is a risk that your login name, password, or any other data you enter may be intercepted;
- however, if you access the napcontract.com website using another person’s computer, e.g. in an internet café, please ensure that you do not store data on the computer and that you delete your browsing history. Your data stored on such a computer can be used by the person who uses the computer after you.
Technical information
For your safety, please remember:
When you use the napcontract.com website, small files (in particular text files) containing information necessary for the correct use of the napcontract.com website, so-called "cookies", are saved on your terminal device (computer, smartphone, tablet, etc.). By storing these files on your device, it is possible to tailor the content of the website to your interests. Cookies allow us to collect statistical data about the napcontract.com website, which enables us to develop the website according to the preferences of our customers.
These files are in no way harmful to your device and do not change its settings or the settings of the software installed on it. The content of these files can only be read by the server that created them.
When you use the napcontract.com website, two types of cookies are applied: session cookies and persistent cookies. Session files are temporary files stored on your device until you close your browser. Permanent cookies are stored on your device for a time determined in cookies' parameters or until they are deleted by the user.
What cookies do we use?
- Files necessary for the operation of the Store – these files enable proper operation of the napcontract.com website as well as the user’s navigation through the site. Without saving them on your device, using the website is impossible;
- Statistical files – they allow us to collect statistical information on the way the website is used;
- Functional files - files that allow remembering your settings and preferences. Thanks to the fact that these files are stored on your device, you will not have to enter your login and password each time, you will be shown products tailored to your interests, etc.;
- Social files – enabling the integration of social networking sites (e.g. Facebook, Google) that you use.
What to do if you do not agree to files being stored on your device?
Most browser settings allow the storing of cookies on the user’s device by default. If you do not agree to these files being stored on your device, you must change your browser settings accordingly. The change may consist in not storing cookies on your device, or in informing you each time a cookie is stored on your device. You can also delete the files from your device each time after visiting the site. Detailed information about the possibilities and methods of cookie support is available in the settings and the “Help” section of your browser. Please note, however, that restrictions on the use of cookies may make it difficult or impossible to use the website.
By setting your device's browser to allow such files to be stored on your device, you consent to them being stored.
Other technical information
We also use geolocation, i.e. we check from which location (continent, country, province, and town) you are placing your order.
Your personal data is stored in a database in which technical and organisational measures have been applied to ensure the protection of the processed data in accordance with the requirements set out by generally applicable legislation on the protection of personal data, including the GDPR. Access to the database is only be granted to persons authorised by the data Controller.
Final provisions
Due to the continuous development and progress of technology, the rules set out in this document are subject to change. Changes to this policy will be conveyed to you in advance, no later than 7 days prior to the implementation of the change, by posting the new content of this document on the napcontract.com website under "Privacy Policy".
To the extent not covered by this Privacy Policy, the provisions of the GDPR and the Act of May 10 on the Protection of Personal Data and their implementing provisions shall apply.
This Privacy Policy is effective as of November 8, 2021.