Privacy Policy

BONITODIVING.COM WEBSITE

1. For the Owner of this website the protection of the Users' personal data is of the utmost importance. The Owner makes great efforts to ensure that Users feel safe while entrusting their personal data during their use of the website.
2. The User is a natural person, a legal person or an organisational unit without legal personality with legal capacity granted under the Act, which uses the electronic services available on the website.
3. This Privacy Policy explains the principles and scope of the processing of the User's personal data, his/her rights and obligations as well as the use of cookies.
4. The Controller shall apply state-of-the-art technical and organisational measures ensuring high level of protection of the personal data processed and preventing access by unauthorised persons.
    

I. PERSONAL DATA CONTROLLER

The Controller of your personal data is Edison One Sp. z o.o. with its registered place at ul. Wejnerta 21/23 prem. 8, entered into the Register of Entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under KRS number:  0000827064, NIP number: 5213889313 (hereafter referred to as: “the Owner”).
 

II. GOAL OF THE PERSONAL DATA PROCESSING

1. The Controller processes the User’s personal data for the following purposes:
   Proper handling of sales contracts.
2. This means that these data are needed in particular for:
   a. website registration process,
   b. conclusion of an agreement,
   c. making settlements,
   d. delivery of the goods or services ordered by the User;
   e. exercising any consumer rights of the User (e.g. withdrawal from the agreement, warranty).
   f.
    order taking, complaints, training.
3. The User may also agree to receive information on news and promotions. As a result of such a consent, the Controller will also process the User’s personal data in order to send him or her commercial information concerning, among others, new products or services, promotions or sales.
4. Personal data are also processed in order to fulfil legal obligations incumbent on the Controller and to perform tasks of the public interest, e.g. to perform security and defence-related tasks or to keep tax records.
5. Personal data may also be processed for the purpose of direct marketing of products, securing and asserting claims or protecting against claims brought by the User or third parties, as well as marketing of services and products of third parties and indirect marketing of the Controller’s own brand.
    

III. DATA TYPES

1. The Controller processes the following data types required in order to:
   a. register on the website:
   - full name,
   - e-mail address,
   b. make purchases via the website:
   - full name,
   - gender,
   - delivery address,
   - telephone number,
   - e-mail address,
   c. optional data provided by the User:
   - date of birth,
   - PESEL number (if a natural person is requested to be invoiced),
   - NIP number (if a company is requested to be invoiced).
2. In the event of a withdrawal from the agreement or the acknowledgement of a complaint, if the reimbursement is made directly to the User's bank account, the Controller will also process the information regarding the bank account number for the reimbursement.
    

IV. LEGAL BASIS FOR PERSONAL DATA PROCESSING

1. Personal data are processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88, hereinafter referred to “GDPR”.
2. The Controller processes personal data only with the prior consent of the User, expressed at the time of registration on the website or at the time of confirmation of the transaction performed on the website.
3. Consent to the processing of the User's personal data is entirely voluntary, however, failure to do so will prevent the User from registering on the website and making purchases via the website.
    

V. USER RIGHTS

1. The User may at any time request information from the Controller about the extent of the processing of personal data.
2. The User may at any time request the rectification or amendment of his/her personal data. The User can also do this independently after logging in to his or her account.
3. The user may withdraw his or her consent to the processing of the personal data at any time, without giving reasons. A request not to process personal data may relate to the specific purpose of processing indicated by the User, e.g. withdrawal of consent to receive commercial information, or to all purposes of data processing. The withdrawal of consent for all processing purposes will result in the User's account being deleted from the website, along with all of the User's personal data previously processed by the Controller. The withdrawal of the consent will not affect any action already taken.
4. The User may request at any time erasure of his/her data by the Controller without giving reasons. The request for erasure will not affect any action already taken. Data erasure will result with deletion of the User's account together with all personal data retained and processed to date by the Controller.
5. The User may at any time object to the processing of personal data, both in respect of all processing purposes of the User's personal data, and only to a limited extent, e.g. in respect of processing for a specifically indicated purpose. The objection will not affect any action already taken. The objection will result with deletion of the User's account together with all personal data retained and processed to date by the Controller.
6. The User may request restriction of the processing of personal data, either for a specific period of time or without a time limit but within a specific scope, and the Controller will be obliged to comply with such a request. The request will not affect any action already taken.
7. The User may request from the Controller to transfer his or her personal data being processed to another entity. For this purpose, the User should write a request to the Controller, indicating to which entity (name, address) the User's personal data should be transferred and in what scope. Once the User confirms his/her request, the Controller shall electronically transfer the User's personal data to the designated entity. Confirmation of the request by the User is necessary for the security of the User's personal data and to ensure that the request comes from an authorised person.
8. Within one month of receiving one of the User's requests mentioned in the previous paragraphs, the Controller shall inform the User of the action taken.
    

VI. PERSONAL DATA RETENTION PERIOD

1. In principle, personal data are only kept for as long as necessary to fulfil the contractual or statutory obligations for which it was collected. The data will be deleted immediately when their retention is no longer necessary for evidential purposes in accordance with civil law or in connection with a statutory obligation to retain data.
2. The contractual information shall be kept for evidence purposes, for a period of three years, starting from the end of the year in which the business relationship with the User is terminated. Erasure of personal data will take place after the expiry of the statutory period of limitation for the assertion of contractual claims.
3. Moreover, the Controller may keep archival information concerning the concluded transactions, as their storage is connected with the User's claims, e.g. under warranty.
4. If no agreement has been concluded between the User and the Owner, the User's personal data are retained until the User's account on the website is deleted. Account may be deleted by means of the User's request to delete the account, by withdrawing the consent to the processing of personal data, or objecting to the processing of such data.
    

VII. ENTRUSTING OF PERSONAL DATA PROCESSING TO THIRD PARTIES

1. The Controller may entrust the processing of personal data to entities cooperating with the Controller to the extent necessary for the completion of the transaction, e.g. for the preparation of the ordered goods and delivery of the shipments or forwarding of commercial information from the Controller (the latter applies to the Users who have given their consent to receive commercial information).
2. Apart from the purposes stated in this Privacy Policy, personal data of the Users will not be shared in any way with third parties or passed on to other entities for the purpose of sending marketing materials of these third parties.
3. Personal data of the website Users are not transferred outside the European Union.
4. This Privacy Policy complies with the provisions under Article 13 (1) and (2) of the GDPR.