ZASA WOOL & CASHMERE PANTS

1.1. This Privacy Policy of the Online Store is of informative nature, which means it is not a source of obligations for Service Recipients or Customers of the Online Store. The Privacy Policy primarily contains principles related to the processing of personal data by the Administrator in the Online Store, including the grounds, purposes, and duration of personal data processing, as well as the rights of individuals whose data is being processed. It also provides information regarding the use of cookies and analytical tools in the Online Store.

1.2. The data controller for personal data collected through the Online Store is Samanta Bilewska conducting business under the name The Amdra Samanta Bilewska, registered in the Central Register and Information on Economic Activity of the Republic of Poland maintained by the Minister responsible for the economy, with a registered office at ul. Mokotowska 45/17, 00-551 Warszawa, Poland and a correspondence address at ul. Mokotowska 45/17, 00-551 Warszawa. TAX ID: 7010813889, REGON: 369813993, email address: hello@theamdra.com, referred to as the "Controller," who is also the Service Provider of the Online Store and the Seller. 

1.3. Personal data in the Online Store are processed by the Controller in accordance with applicable legal regulations, particularly with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as "GDPR." Official text of the GDPR: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

1.4. Using the Online Store, including making purchases, is voluntary. Similarly, providing personal data by the Service Recipient or Customer of the Online Store is voluntary, subject to two exceptions: (1) entering into agreements with the Controller – failure to provide the necessary personal data, indicated on the Online Store's website and in the Online Store's Terms and Conditions and this privacy policy, for concluding and executing a Sales Agreement or an Agreement for Electronic Services with the Controller results in the impossibility of concluding that agreement. Providing personal data in such a case is a contractual requirement, and if the individual whose data is concerned wishes to conclude a specific agreement with the Controller, they are obliged to provide the required data. The scope of data required for entering into an agreement is always specified on the Online Store's website and in the Online Store's Terms and Conditions; (2) statutory obligations of the Controller – providing personal data is a statutory requirement resulting from universally applicable legal regulations imposing on the Controller the obligation to process personal data (e.g., processing data for tax or accounting purposes), and failure to provide such data will prevent the Controller from fulfilling these obligations.

1.5. The Controller takes special care to protect the interests of individuals whose personal data is processed, and in particular ensures that the data collected by them is: (1) processed lawfully; (2) collected for specified, lawful purposes and not subjected to further processing incompatible with those purposes; (3) relevant and adequate in relation to the purposes for which it is processed; (4) stored in a form enabling the identification of the individuals it concerns, for no longer than is necessary for the purposes of processing; and (5) processed in a manner ensuring adequate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, by using appropriate technical or organizational measures.

1.6. Taking into account the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Controller implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with this Regulation and that such processing is documented. These measures are subject to periodic review and updates as necessary. The Controller employs technical measures to prevent unauthorized acquisition or modification of electronically transmitted personal data.

1.7. All words, phrases, and acronyms appearing in this privacy policy and beginning with a capital letter (e.g., Seller, Online Store, Electronic Service) shall be understood in accordance with their definitions provided in the Online Store's Terms and Conditions available on the Online Store's website.

2.1. The Controller is authorized to process personal data in cases where – and to the extent that – at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Controller is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.

2.2. Processing of personal data by the Controller requires, in each case, the existence of at least one of the grounds specified in section 2.1 of the privacy policy. Specific legal bases for the processing of personal data of Service Recipients and Customers of the Online Store by the Controller are indicated in the next section of the privacy policy – in relation to the specific purpose of processing personal data by the Controller.

3.1. The purpose, basis, duration, and recipients of personal data processed by the Controller in the Online Store are determined by the actions taken by a particular Service Recipient or Customer in the Online Store or by the Controller. For example, if a Customer chooses to make a purchase in the Online Store and selects personal pickup of the purchased Product instead of courier delivery, their personal data will be processed for the purpose of performing the concluded Sales Agreement but will not be disclosed to the carrier handling shipments on behalf of the Controller.

3.2. The Controller may process personal data within the Online Store for the following purposes, based on the legal grounds and for the periods indicated below:

Purpose of Data Processing: Execution of a Sales Agreement or an Agreement for Electronic Services or taking actions at the request of the data subject prior to the conclusion of the aforementioned agreements

Legal Basis for Data Processing: Article 6(1)(b) of the GDPR (performance of a contract) – processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract

Data Retention Period: Data are retained for the period necessary for the performance, termination, or expiration of the concluded Sales Agreement or Agreement for Electronic Services in another way.

Purpose of Data Processing: Direct marketing

Legal Basis for Data Processing: Article 6(1)(f) of the GDPR (legitimate interests pursued by the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller, which consist of safeguarding the interests and good reputation of the Controller, its Online Store, and aiming to sell Products

Data Retention Period: Data are retained for the period of the existence of the legitimate interest pursued by the Controller, but not longer than for the period of limitation of claims by the Controller against the data subject resulting from the Controller's business activities. The limitation period is determined by legal regulations, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and for a sales agreement, two years). The Controller cannot process data for direct marketing if the data subject effectively objects to such processing.

Purpose of Data Processing: Marketing

Legal Basis for Data Processing: Article 6(1)(a) of the GDPR (consent) – the data subject has given consent for the processing of their personal data for marketing purposes by the Controller

Data Retention Period: Data are retained until the data subject withdraws their consent for further processing of their data for this purpose.

Purpose of Data Processing: Expression of opinions by the Customer about the concluded Sales Agreement

Legal Basis for Data Processing: Article 6(1)(a) of the GDPR – the data subject has given consent for the processing of their personal data for the purpose of expressing opinions

Data Retention Period: Data are retained until the data subject withdraws their consent for further processing of their data for this purpose.

Purpose of Data Processing: Maintenance of tax records

Legal Basis for Data Processing: Article 6(1)(c) of the GDPR in conjunction with Article 86(1) of the Tax Ordinance of 17 January 2017 (Journal of Laws of 2017, item 201) – processing is necessary for compliance with a legal obligation to which the Controller is subject

Data Retention Period: Data are retained for the period required by legal regulations imposing on the Controller the obligation to retain tax records (until the expiry of the limitation period for tax obligations, unless tax laws provide otherwise).

Purpose of Data Processing: Establishment, assertion, or defense of claims that may be raised by the Controller or against the Controller

Legal Basis for Data Processing: Article 6(1)(f) of the GDPR (legitimate interests pursued by the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller, which consist of establishing, asserting, or defending claims that may be raised by the Controller or against the Controller

Data Retention Period: Data are retained for the period of the existence of the legitimate interest pursued by the Controller, but not longer than for the period of limitation of claims that may be raised against the Controller (the basic limitation period for claims against the Controller is six years).

Purpose of Data Processing: Use of the Online Store's website and ensuring its proper functioning

Legal Basis for Data Processing: Article 6(1)(f) of the GDPR (legitimate interests pursued by the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller, which consist of operating and maintaining the Online Store's website

Data Retention Period: Data are retained for the period of the existence of the legitimate interest pursued by the Controller, but not longer than for the period of limitation of claims by the Controller against the data subject resulting from the Controller's business activities. The limitation period is determined by legal regulations, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and for a sales agreement, two years).

Purpose of Data Processing: Conducting statistics and analyzing traffic on the Online Store's website

Legal Basis for Data Processing: Article 6(1)(f) of the GDPR (legitimate interests pursued by the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller, which consist of conducting statistics and analyzing traffic on the Online Store's website in order to improve the functioning of the Online Store and increase the sales of Products

Data Retention Period: Data are retained for the period of the existence of the legitimate interest pursued by the Controller, but not longer than for the period of limitation of claims by the Controller against the data subject resulting from the Controller's business activities. The limitation period is determined by legal regulations, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and for a sales agreement, two years).

4.1. For the proper functioning of the Online Store, including the execution of concluded Sales Agreements, the Administrator must utilize the services of external entities (such as software providers, couriers, or payment service providers). The Administrator only engages the services of processing entities that provide sufficient guarantees of implementing appropriate technical and organizational measures to ensure that the processing complies with the requirements of the GDPR and protects the rights of the data subjects.

4.2. Data transmission by the Administrator does not occur in every case or to all recipients or categories of recipients indicated in the privacy policy. The Administrator only transmits data when necessary for the accomplishment of a specific purpose of personal data processing and only to the extent necessary for its implementation. For example, if a Customer chooses in-store pickup, their data will not be transmitted to a carrier cooperating with the Administrator.

4.3. The personal data of Service Recipients and Customers of the Online Store may be transferred to the following recipients or categories of recipients:

4.3.1. carriers / freight forwarders / courier brokers / entities handling warehouse and/or shipping processes – in the case of a Customer who chooses to have the Product delivered by postal or courier service, the Administrator provides the collected personal data of the Customer to the selected carrier, freight forwarder, or intermediary executing shipments on behalf of the Administrator. If the shipment originates from an external warehouse, the data is provided to the entity handling the warehouse and/or shipping process, to the extent necessary for delivering the Product to the Customer.

4.3.2. entities providing electronic payment or credit card processing services – in the case of a Customer who chooses electronic payment or credit card payment in the Online Store, the Administrator provides the collected personal data of the Customer to the chosen entity providing the above-mentioned payment services in the Online Store, at the request of the Administrator, to the extent necessary for processing the payment made by the Customer.

4.3.3. providers of survey systems for collecting opinions – in the case of a Customer who agrees to express opinions about concluded Sales Agreements, the Administrator provides the collected personal data of the Customer to the selected entity providing the survey system for collecting opinions about concluded Sales Agreements in the Online Store, at the request of the Administrator, to the extent necessary for the Customer to express opinions using the survey system.

4.3.4. providers of technical, IT, and organizational solutions enabling the Administrator to conduct business activities, including the Online Store and the provision of Electronic Services through it (in particular providers of computer software for operating the Online Store, email and hosting providers, and software providers for business management and technical support for the Administrator) – the Administrator provides the collected personal data of the Customer to the chosen provider operating on its behalf only in cases and to the extent necessary for achieving the purpose of data processing in line with this privacy policy.

4.3.5. providers of accounting, legal, and advisory services, providing support in accounting, legal, or advisory matters for the Administrator (in particular accounting firms, law firms, or collection agencies) – the Administrator provides the collected personal data of the Customer to the chosen provider operating on its behalf only in cases and to the extent necessary for achieving the purpose of data processing in line with this privacy policy.

5.1. The GDPR imposes an obligation on the Administrator to inform about automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, and – at least in those cases – to provide essential information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject. With this in mind, the Administrator provides information regarding potential profiling in this section of the privacy policy.

5.2. The Administrator may utilize profiling in the Online Store for direct marketing purposes, but decisions made based on profiling do not relate to the conclusion or refusal of Sales Agreements, or the use of Electronic Services in the Online Store. The outcome of profiling in the Online Store may include granting a discount to a specific individual, sending them a discount code, reminding them of unfinished purchases, proposing a Product that aligns with the individual's interests or preferences, or offering improved terms compared to the standard Online Store's offer. Despite profiling, the individual retains the freedom to decide whether to utilize the received discount or better terms and make a purchase in the Online Store.

5.3. Profiling in the Online Store involves the automatic analysis or prediction of an individual's behavior on the Online Store's website, such as adding a specific Product to the cart, browsing a specific Product page, or analyzing the individual's previous purchase history on the Online Store's website. A prerequisite for such profiling is that the Administrator possesses the individual's personal data to subsequently transmit, for example, a discount code.

5.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

6.1. The right of access, rectification, restriction, erasure, or portability – the data subject has the right to request from the Administrator access to their personal data, their rectification, erasure ("right to be forgotten"), or restriction of processing. They also have the right to object to processing and the right to data portability. Detailed conditions for exercising the aforementioned rights are provided in Articles 15-21 of the GDPR.

6.2. The right to withdraw consent at any time – if personal data is processed by the Administrator based on consent given (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR), the data subject has the right to withdraw their consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6.3. The right to lodge a complaint with a supervisory authority – the data subject whose data is processed by the Administrator has the right to lodge a complaint with a supervisory authority in the manner and procedure defined in the GDPR and Polish law, particularly the Act on Personal Data Protection. The supervisory authority in Poland is the President of the Office for Personal Data Protection.

6.4. The right to object – the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(e) (public task or official authority) or (f) (legitimate interests of the controller), including profiling based on these provisions. In such a case, the Administrator is no longer allowed to process the personal data unless they demonstrate compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.

6.5. The right to object to direct marketing – if personal data is processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning them for the purposes of such marketing, including profiling, to the extent that it is related to such direct marketing.

6.6. In order to exercise the rights mentioned in this section of the privacy policy, the data subject may contact the Administrator by sending an appropriate message in writing or by email to the Administrator's address provided at the beginning of the privacy policy or by using the contact form available on the Online Store's website.

7.1. Cookies are small text information in the form of text files, sent by a server and stored on the side of the person visiting the Online Store's website (e.g., on the hard drive of a computer, laptop, or on the memory card of a smartphone - depending on the device used by the visitor to our Online Store). Detailed information about cookies, as well as the history of their creation, can be found, among others, here: http://en.wikipedia.org/wiki/HTTP_cookie.

7.2. The Administrator may process data contained in cookies when visitors use the Online Store's website for the following purposes:

7.2.1. Identification of Customers as logged into the Online Store and displaying that they are logged in;

7.2.2. Remembering Products added to the cart to place an Order;

7.2.3. Remembering data filled in Order Forms, surveys, or login data for the Online Store;

7.2.4. Customizing the content of the Online Store's website to individual preferences of Customers (e.g., colors, font size, layout) and optimizing the use of the Online Store's website;

7.2.5. Conducting anonymous statistics showing how the Online Store's website is used;

7.2.6. Remarketing, i.e., analyzing the behavior characteristics of visitors to the Online Store through anonymous analysis of their actions (e.g., repeated visits to specific pages, keywords, etc.) to create their profile and provide them with advertisements tailored to their anticipated interests, even when they visit other websites in the advertising network of Google Ireland Ltd. and Facebook Ireland Ltd.

7.3. By default, most internet browsers available on the market accept saving cookies. Everyone has the option to specify the conditions for using cookies using the settings of their own internet browser. This means that, for example, you can partially limit (e.g., temporarily) or completely disable the ability to save cookies - in the latter case, however, it may affect some functionalities of the Online Store (for example, it may be impossible to proceed with the Order process through the Order Form due to the lack of remembering Products in the cart during subsequent Order steps).

7.4. The settings of the internet browser regarding cookies are important for the consent to use cookies by our Online Store - according to the regulations, such consent can also be given through the settings of the internet browser. In the absence of such consent, it is necessary to appropriately change the settings of the internet browser regarding cookies.

7.5. Detailed information on changing settings related to cookies and their independent deletion in the most popular internet browsers is available in the help section of the internet browser and on the following pages (just click on the link):

In Chrome browser
In Firefox browser
In Internet Explorer browser
In Opera browser
In Safari browser
In Microsoft Edge browser


7.6. The Administrator may use Google Analytics and Universal Analytics services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) in the Online Store. These services help the Administrator to keep statistics and analyze the traffic on the Online Store's website. The collected data is processed under the above services to generate statistics helpful in administering the Online Store and analyzing the traffic on the Online Store's website. This data is of an aggregated nature. By using the above services in the Online Store, the Administrator collects data such as the sources and medium of acquiring visitors to the Online Store, as well as their behavior on the Online Store's website, information about devices and browsers from which they visit the site, IP and domain, geographic and demographic data (age, gender), and interests.

7.7. It is possible to easily block the sharing of information about one's activity on the Online Store's website to Google Analytics - for this purpose, you can, for example, install an add-on to the browser provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=en.

8.1. Your personal data will be processed by The Amdra Samanta Bilewska, whom you can contact via email by sending a message to the address: hello@theamdra.com. You can also use traditional mail - Mokotowska 45/17, 00-551 Warszawa. 

8.2. Your personal data will be processed for the purpose of fulfilling a contract or taking actions at the request of the person whose data it concerns, before its conclusion (fulfilling an order in the online store), fulfilling a contract for the provision of services electronically or taking actions at the request of the person whose data it concerns, before its conclusion (sending a newsletter), enabling the addition of reviews and opinions about products and services, fulfilling a contract or taking actions at the request of the person whose data it concerns, before its conclusion (cooperation and product delivery). The legal basis for data processing for the specified purpose / purposes is Art. 6, sec. 1, letter b of the GDPR.

8.3. If we process your data based on consent, you have the right to withdraw it. You also have the right to lodge a complaint with the supervisory authority, request access to data concerning you from the Administrator, their correction, deletion, or limitation of processing, and to object to their processing and transfer.

8.4. Providing personal data is voluntary, with two exceptions:

Contracting with the Administrator - not providing, in cases and to the extent indicated on the Online Store's website and in the Online Store Regulations, personal data necessary to conclude and perform a Sales Agreement or an agreement for the provision of Electronic Services with the Administrator will result in the impossibility of concluding the agreement. Providing personal data is in such a case a contractual requirement, and if the person whose data it concerns wants to conclude a specific agreement with the Administrator, they are obliged to provide the required data. The scope of data required to conclude an agreement is indicated in advance on the Online Store's website and in the Online Store Regulations;

Legal obligations of the Administrator - providing personal data is a legal requirement arising from universally applicable legal provisions imposing on the Administrator the obligation to process personal data (e.g., processing data for the purpose of keeping tax or accounting books), and not providing them will prevent the Administrator from fulfilling these obligations.

8.5. Your personal data may be transferred to the following categories of recipients, depending on your choice of how the contract is executed or other processing activities:

carriers / forwarders / courier brokers
entities providing electronic payment or credit card services
credit providers / lessors
providers of survey systems
providers of services supplying the Administrator with technical, IT, and organizational solutions enabling the Administrator to conduct business activity, including the Online Store and services provided through it
providers of accounting, legal, and advisory services providing support to the Administrator (in particular, accounting office, law firm, or debt collection company),

8.6. Your personal data will be processed only until the legal obligation ceases or until the person whose data it concerns resigns from the account service in the online store (termination of the contract for the provision of electronic services).

8.7. The Administrator may use profiling for direct marketing purposes in the Online Store, but decisions made based on profiling by the Administrator do not concern the conclusion or refusal to conclude a Sales Agreement or the possibility of using Electronic Services in the Online Store. The result of using profiling in the Online Store may include granting a discount to a specific individual, sending them a discount code, reminding them of unfinished purchases, proposing a Product that may correspond to the interests or preferences of a specific individual, or offering better terms compared to the standard Online Store offer. Despite profiling, the individual still has the freedom to decide whether they want to use the received discount or better terms and make a purchase in the Online Store.

9.1. The Online Store may contain links to other websites. The Administrator encourages you to review the privacy policy established there after going to other sites. This privacy policy applies only to the Administrator's Online Store.