Yope Sp. z o.o.

Pursuant to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) in this policy we present to you basic information on how we collect and process personal data. 

I. I. Data controller and Data Protection Officer

Data controller (the “Data Controller”) of the personal data is YOPE Sp. z o.o. with its registered seat in Warsaw, Chmielna 132/134 st, 00-805 , registered in the register of entrepreneurs by District Court for the Capital City Warsaw, XIII Commercial Department of the National Court Register, under the KRS number: 0000480787, NIP: 7010399349, REGON: 7010399349. You can contact Data Controller via e-mail address: shop@yopeme.com

Data Controller has appointed a Data Protection Officer (“DPO”), who can be contacted in matters related to personal data via e-mail: iod@yope.me, or correspondence address: Chmielna 132/134 st, 00-805 Warsaw/POLAND, with annotation “DPO”. 

II. II. Purposes, means, legal basis and retention period of processed data 

NEWSLETTER

Your personal data obtained in connection with the subscription to the newsletter are processed for the purpose of:

1) sending an e-mail newsletter containing marketing content regarding our products and services - based on your consent (Article 6 (1) (a) of the GDPR);

2) collecting and analyzing information about our customers (profiling), including by transferring data to websites and social media (including: Facebook, Instagram, Google, YouTube) in order to better adapt the targeted marketing information to the interests of customers and in the purpose of controlling the quality of our services and developing our products - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

3) sending by electronic means (SMS, MMS, push-notifications from mobile apps or websites to any electronic device, e-mail) marketing information about our products and services - based on your consent (Article 6 (1) (a) of the GDPR);

4) defense against claims and asserting our rights - based on our legitimate interest (Article 6 (1) (f) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates and external entities performing specific services for us (e.g. IT support) - on the basis of appropriate authorizations or data processing agreements;

2) websites and social media platforms (including: Facebook, Google, YouTube, Instagram) - on the basis of appropriate data processing agreements in accordance with the regulations and privacy policies of the websites concerned;

3) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Time during which we will process your data (data retention):

1) In the case of data processed on the basis of your consent - until you withdraw your consent to processing, without affecting the lawfulness of processing based on consent before its withdrawal;

2) In the case of data processed on the basis of our legitimate interest - until the purpose of processing is achieved or until you object to processing of your personal data.

ON LINE STORE

Your personal data obtained in connection with submitting an order via our on-line store are processed for the purpose of:

1) fulfillment of the order - on the basis of an already concluded contract or for the purpose of its conclusion (Article 6 (1) (b) of the GDPR);

2) fulfillment of accounting and tax obligations in the event of processing payment - based on the legal obligation imposed on us (Article 6 (1) (c) of the GDPR);

3) consideration of complaints / defense against claims and asserting our rights - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

4) sending marketing content regarding our products and services by traditional (paper) method - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

5) collecting and analyzing information about our clients (profiling), such as identification data and behavior on our website or in the online store, including by transferring data to websites and social media (Facebook, Instagram, Google, YouTube) in order to better adapt the targeted marketing information to the interests of customers and to control the quality of our services and the development of our products - based on our legitimate interest (Article 6 (1) (f) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates and external entities performing specific services for us (e.g. IT support) - on the basis of appropriate authorizations or data processing agreements;

2) external warehouses, postal and courier companies - on the basis of relevant agreements;

3) websites and social media platforms (including: Facebook, Google, YouTube, Instagram) - on the basis of appropriate data processing agreements in accordance with the regulations and privacy policies of the websites concerned;

4) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Time during which we will process your data (data retention):

1) In the case of data processed on the basis of your consent - until you withdraw your consent to processing, without affecting the lawfulness of processing based on consent before its withdrawal;

2) Data related to the realization of payments will be processed for a period of 5 years counted from the end of the year in which the payment was made;

3) The data necessary to prepare or conclude and perform the contract will be processed until the contract is performed;

4) In the case of data processed on the basis of our legitimate interest - until the purpose of processing is achieved or until you object to processing of your personal data (subject to the exclusions described in Chapter III of this Privacy Policy - "Your rights").

CONTACT (CUSTOMER)

Your personal data obtained in connection with the letter, inquiry, request addressed to us orally, in writing and via e-mail or via contact form, are processed for the purpose of:

1) maintaining contact and responding to the letter / request / inquiry / request provided to us - based on your consent expressed by providing the data in the letter / request / inquiry / request (Article 6 (1) (a) of the GDPR);

2) defense against claims and asserting our rights - based on our legitimate interest (Article 6 (1) (f) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates and external entities performing specific services for us (e.g. IT support) - on the basis of appropriate authorizations or data processing agreements;

2) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Time during which we will process your data (data retention):

1) In the case of data processed on the basis of your consent - until you withdraw your consent to processing, without affecting the lawfulness of processing based on consent before its withdrawal;

2) In the case of data processed on the basis of our legitimate interest - until the purpose of processing is achieved or until you object to processing of your personal data (subject to the exclusions described in Chapter III of this Privacy Policy - "Your rights").

CONTACT AND COMMERCE (BUSINESS) 

Your personal data obtained in connection with providing a commercial offer, submitting an order, realization of the order, performing the contract or ongoing negotiations are processed for the purpose of:

1) establishing and maintaining business contact through electronic (email, telephone) and traditional (paper) communication - based on your consent expressed directly or by establishing contact by you (Article 6 (1) (a) of the GDPR);

2) commencement and conducting business contacts, negotiations, accepting and performing the order - on the basis of a concluded contract or in order to conclude such a contract (Article 6 (1) (b) of the GDPR);

3) fulfillment of accounting and tax obligations in the case of making a payment or issuing a receipt / invoice / other document related to accounting obligations - on the basis of our legal obligation (Article 6 (1) (c) of the GDPR);

4) consideration of complaints / defense against claims and asserting our rights - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

5) sending marketing content regarding our products and services by electronic means (email, telephone) - based on your consent (Article 6 (1) (a) of the GDPR);

6) sending marketing content regarding our products and services by traditional (paper) method - based on our legitimate interest (Article 6 (1) (f) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates and external entities performing specific services for us (e.g. IT support) - on the basis of appropriate authorizations or data processing agreements;

2) external warehouses, postal and courier companies - on the basis of relevant agreements;

3) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Time during which we will process your data (data retention):

1) In the case of data processed on the basis of your consent - until you withdraw your consent to processing, without affecting the lawfulness of processing based on consent before its withdrawal;

2) Data related to the realization of payments will be processed for a period of 5 years counted from the end of the year in which the payment was made;

3) The data necessary to prepare or conclude and perform the contract will be processed until the contract is performed;

4) In the case of data processed on the basis of our legitimate interest - until the purpose of processing is achieved or until you object to processing of your personal data (subject to the exclusions described in Chapter III of this Privacy Policy - "Your rights").

SOCIAL MEDIA

When you follow, leave comments or otherwise interact with our accounts on various social media sites, we become the data controller of the personal data visible to us in accordance with the terms of the social platform.

We process your personal data that you use in accordance with the privacy rules established by the website on which you have an account. They can be, among others: name and surname, date of birth, photo, information about where you live and work, and other information assigned to your account, as well as any personal data that you voluntarily make public on a specific social media platform or provide us in a private message.

Your data is processed for the purpose of:

1) maintaining by us an account on a social media platform in accordance with the terms and privacy policy of a given website, including interacting with other users - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

2) defense against claims and asserting our rights - based on our legitimate interest (Article 6 (1) (f) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates, companies functioning in our group of companies and external entities performing specific services for us (e.g. IT support, courier services) - on the basis of appropriate authorizations or data processing agreements;

2) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Your personal data may also be used for other purposes and made available to other entities, based on the terms and conditions of a given social media platform, over which we have no influence.

Time during which we will process your data (data retention):

1. In the case of data processed on the basis of our legitimate interest - until the purpose of processing is achieved or until you object to processing of your personal data (subject to the exclusions described in Chapter III of this Privacy Policy - "Your rights"). However, the exercise of this right to object to processing on the social media platform may be limited by the website regulations in accordance with its privacy policy (e.g. rules regarding the deletion of comments or deleting the history of private messages).

For the moment being we maintain the following profiles on social media:

1) Facebook PL YOPE https://www.facebook.com/YOPEnatura

2) Facebook INT YOPE World https://www.facebook.com/yopeme

3) Instagram PL @yope_soap https://www.instagram.com/yope_soap/

4) Instagram INT @yope_world https://www.instagram.com/yope_world/

5) Tik tok @yope_soap https://www.tiktok.com/@yope_soap

6) LinkedIn Yope Sp. z o.o. https://www.linkedin.com/company/yopesp.zo.o./

The privacy policy and the terms and conditions of the above-mentioned social media platforms are available on their home pages.

CONTEST

Your personal data obtained during the application for participation in the competition are processed for the purpose of:

1) take part in the competition and its realization (including awarding the prize) - on the basis of a public promise or on the basis of an already concluded contract or for its conclusion in accordance with the competition regulations (Article 6 (1) (b) of the GDPR);

2) fulfillment of accounting and tax obligations in the case of awarding a prize in cash or in kind, the implementation or delivery of which is related to accounting obligations - on the basis of our legal obligation (Article 6 (1) (c) of the GDPR);

3) collecting and analyzing information about our customers (profiling), including by transferring data to websites and social media (including: Facebook, Instagram, Google, YouTube) in order to better adapt the targeted marketing information to the interests of customers and in the purpose of controlling the quality of our services and developing our products - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

4) defense against claims and asserting our rights - based on our legitimate interest (Article 6 (1) (f) of the GDPR);

5) sending marketing content regarding our products and services by electronic means (email, telephone, social media) - based on your consent (Article 6 (1) (a) of the GDPR);

6) sending marketing content regarding our products and services by traditional (paper) method - based on our legitimate interest (Article 6 (1) (f) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates and external entities performing specific services for us (e.g. IT support) - on the basis of appropriate authorizations or data processing agreements;

2) external warehouses, postal and courier companies - on the basis of relevant agreements;

3) websites and social media platforms (including: Facebook, Google, YouTube, Instagram) - on the basis of appropriate data processing agreements in accordance with the regulations and privacy policies of the websites concerned;

4) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Time during which we will process your data (data retention):

1) In the case of data processed on the basis of your consent - until you withdraw your consent to processing, without affecting the lawfulness of processing based on consent before its withdrawal;

2) Data related to the realization of payments will be processed for a period of 5 years counted from the end of the year in which the payment was made;

3) The data necessary to prepare or conclude and perform the contract will be processed until the contract is performed;

4) In the case of data processed on the basis of our legitimate interest - until the purpose of processing is achieved or until you object to processing of your personal data (subject to the exclusions described in Chapter III of this Privacy Policy - "Your rights").

RECRUITMENT

Your personal data obtained during our recruitment, provided via the form, contained in the CV sent to us or otherwise obtained, will be processed for the purpose of:

1) implementation of the recruitment process aimed at establishing cooperation and collecting the necessary data for this purpose - on the basis and within the scope of the legal obligation imposed on data controller (Article 6 (1) (c) of the GDPR in conjunction with Article 22(1) of the Labor Code);

2) fulfillment of the recruitment process aimed at establishing cooperation within the scope of data not required by labor law, but voluntarily provided by you during recruitment (e.g. in your CV) - based on your consent (Article 6 (1) (a) of the GDPR or Article 9 (2) (a) of the GDPR);

3) taking part in future recruitment processes - based on your consent (Article 6 (1) (a) of the GDPR).

Your personal data may be entrusted for processing or made available (disclosed) to:

1) our employees, associates and external entities performing specific services for us (e.g. IT support) - on the basis of appropriate authorizations or data processing agreements;

2) authorities authorized to request access to data, if we are obliged to disclose the data on the basis of a ruling or decision of an authorized body or provisions of generally applicable law.

Time during which we will process your data (data retention):

1) In the case of data processed in order to participate in the recruitment process on the basis of a legal obligation, they will be processed until the end of the recruitment process which should be understood as employing a person for a specific position (up to 3 months from the end of accepting the job application);

2) In the case of data processed in order to participate in future recruitments, based on your consent, they will be processed until the consent is withdrawn, but not longer than for 1 year from its granting.

III. III. Your rights

You have the right to:

1) request access to personal data relating to you, including information on their processing (Article 15 of the GDPR);
2) rectify your data or have it completed data if they are incorrect or incomplete (Article 16 of the GDPR);
3) right to erasure of your data (right to be forgotten) in the event there are no legal grounds for their processing or the consent to their processing is withdrawn (art. (Article 17 of the GDPR);
4) requests to restriction of processing the data if they are incorrect, unnecessary, processed without a legal basis or an objection to processing has been submitted on the basis of the legitimate interest of the data controller (Article 18 of the GDPR);
5) receiving and transmitting the personal data in a structured, commonly used format, in the case of data provided to the data controller and processed on the basis of consent (Article 20 of the GDPR).

Consent withdrawal

You have the right to withdraw your consent to processing at any time. Withdrawal of the consent does not affect the lawfulness of the processing of your data based on consent before its withdrawal.

Right to object

You have the right to object at any time to the processing of your personal data based on our legitimate interest (Article 6 (1) (f) of the GDPR), including profiling based on this provision (if it occurs). In such a situation, we will not process your personal data for these purposes, unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or there are grounds for the establishment, exercise or defence of legal claims.

You also have the right to object at any time to the processing of your personal data, if your personal data is processed for direct marketing purposes by traditional (paper) method - in this case, we will not process your personal data for such purposes.

Complaint to the President of the Personal Data Protection Office

You also have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data violates the provisions of the GDPR. The supervisory body in Poland is the President of the Personal Data Protection Office (PUODO) with its seat in Warsaw, Stawki 2 st, which you can contact:

● by correspondence address: Stawki 2 st, 00-193 Warsaw/ Poland;
● via electronic inbox available on the website: https://uodo.gov.pl/pl/p/kontakt;
● via phone call: 22 531 03 00, 606-950-000.

If you wish to exercise your rights, contact the Data Protection Officer appointed by the Data Controller: iod@yope.me, Chmielna 132/134 st, 00-805 Warszawa with annotation “DPO”.

Exercising your rights

If you wish to exercise your rights related to processing of your personal data, please contact our Data Protection Officer: iod@yope.me, or via correspondence address: ul. Chmielna 132/134 st, 00-805 Warsaw/Poland with annotation “DPO”.

 All requests regarding the protection of personal data will be realized immediately, but not later than within one month of their submission. This period may be extended by another two months in the event of a complex nature of the request.

IV. IV. Transfer of data to third countries and international organisations 

Some of the tools or solutions we use require the transfer of personal data outside the European Economic Area to third countries (e.g. some cloud services or marketing tools). If such a data transfer is necessary, we make every effort to ensure the highest possible standards of security for the processing of your data and the protection of your privacy, and we select only service providers that ensure such protection.

All data transfers take place on the basis and within the scope permitted by law, in particular pursuant to Chapter V of the GDPR, which provides for the conditions for the transfer of data to third countries with appropriate safeguards (in particular, with the Standard Contractual Clauses).

V. V. Profiling and automated decision-making

Some of our services may involve data processing which results in profiling in order to better adapt our offer to your needs and interests. The consequence of profiling will be assigning a profile to you in order to conduct analysis or predict your preferences, behaviors and attitudes.

More information about the processing of your data in the form of profiling can be found in our Cookie Policy when using our websites or in information related to our individual services that you use.

We do not process personal data in a way that leads to automated decision-making.

VI. Use of cookies 

Our websites use cookies. Personal data collected by cookies enable the monitoring of user behavior on the web and is used based on your consent when entering the website or by managing settings of your browser.

What are cookies? 

Cookies are small text files with information that are saved on your end device (e.g. telephone, computer). They save information about your behavior when visiting our website and using our online store. The cookies we use are safe for your device. In particular, it is not possible for viruses or other unwanted software or malware to enter this way.

For what purpose do we use cookies?

We use cookies to enable the use of our services (cookies necessary to maintain the session in the browser), as well as cookies remembering your preferences when using our website (e.g. the type of software you use, font, resolution, etc.), collecting information necessary to improve the quality of our services ( e.g. observing what content is of great interest), as well as to better adapt advertising content to your interests.

Cookies Policy

More information on the cookies we use and how to configure the settings can be found in our Cookies Policy.

VII. Changes to Privacy Policy

We reserve the right to change this Privacy Policy by publishing new content on our website. After such the change, the Privacy Policy will be published on the website with a new date.

In the event of a change in the Privacy Policy requiring the fulfillment of the information obligation, in accordance with the law on the protection of personal data, we will inform you directly about such a change through traditional or electronic correspondence or by displaying the announcement when you enter our website or in another way ensuring the easiest access to this information.

Privacy Policy version 1.1 published 13.10.2022.