Privacy policy

PRIVACY AND COOKIES POLICY

1. Data Controller and definitions

The controller of the personal data of Customers / Users of the Online Store

The Data Controller may be contacted:

- by email at: info@hlsupps.com.

User - a natural person who visits the website(s) of the Online Store or uses the services or functionalitipes described in this Privacy and Cookies Policy.

Customer - a natural person with full legal capacity, a natural person who is a Consumer, a legal person, or an organizational unit without legal personality to which the law grants legal capacity, who enters into a distance sales agreement with the Seller.

Online Store - the online service operated by the Seller, available at the electronic address (website): https://hlsupps.com, through which the Customer/User may obtain information about Goods and their availability and purchase Goods or order the provision of a service.

Newsletter - information, including commercial information within the meaning of the Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws of 2020, item 344), originating from the Seller and sent to the Customer/User electronically; receiving it is voluntary and requires the consent of the Customer/User.

Account - a set of data stored in the Online Store and in the Seller's ICT system, concerning a given Customer/User and the orders placed and agreements concluded by that Customer/User, through which the Customer/User may place orders and conclude agreements.

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2. Purposes, legal grounds and duration of data processing

For the purpose of performing a distance sales agreement, the Seller processes:

- information concerning the User's device in order to ensure the proper operation of services: the computer's IP address, information contained in cookies or other similar technologies, session data, web browser data, device data, data concerning activity on the Website, including on individual subpages;

- geolocation information, if the User has consented to the service provider accessing geolocation. Geolocation information is used to provide more tailored product and service offers;

- personal data of Users: first name, surname, registered office address, correspondence address, email address, telephone number, VAT ID (NIP), bank account number, or other personal data whose provision is necessary to complete a purchase and which the Controller requires during the purchasing process.

This information does not contain data concerning the identity of Users; however, in combination with other information it may constitute personal data, and therefore the Controller provides it with the full protection available under the GDPR.

These data are processed pursuant to Article 6(1)(b) GDPR for the purpose of providing the service, i.e. the agreement for the provision of electronic services in accordance with the Terms and Conditions, and pursuant to Article 6(1)(a) GDPR in connection with consent to the use of specific cookies or other similar technologies, expressed through the appropriate web browser settings in accordance with the Telecommunications Law, or in connection with consent to geolocation. The data are processed until the Customer/User stops using the Online Store.

The Controller undertakes to take all measures required under Article 32 GDPR, i.e. taking into account the state of the art, the cost of implementation, and the nature, scope and purposes of processing, as well as the risk of infringement of the rights or freedoms of natural persons with varying likelihood and severity, the Controller implements appropriate technical and organizational measures to ensure a level of security appropriate to that risk.

3. Marketing activities of the Controller

On the Online Store website, the Data Controller may publish marketing information about its products or services. Such content is displayed by the Data Controller pursuant to Article 6(1)(f) GDPR, i.e. on the basis of the legitimate interest of the Data Controller consisting in publishing content related to the services provided and promotional campaigns in which the Data Controller is involved. At the same time, this action does not infringe the rights and freedoms of Customers/Users; Customers/Users expect to receive content of a similar nature, or even expect it, or it is the direct purpose of their visit to the website(s) of the Online Store.

4. Recipients of Users' data

The Data Controller discloses Users' personal data only to processors under concluded personal data processing entrustment agreements, for the purpose of providing services to the Data Controller, e.g. hosting and website maintenance, IT services, marketing and PR services.

5. Transfer of personal data to third countries

Personal data will not be processed in third countries.

6. Rights of data subjects

Each data subject has the right:

- of access (Article 15 GDPR) - to obtain from the Data Controller confirmation as to whether personal data concerning them are being processed. If data concerning that person are processed, they are entitled to access those data and obtain the following information: the purposes of processing, categories of personal data, recipients or categories of recipients to whom the data have been or will be disclosed, the period for which the data will be stored or the criteria used to determine that period, the right to request rectification, erasure or restriction of processing of personal data concerning the data subject, and the right to object to such processing;

- to receive a copy of the data (Article 15(3) GDPR) - to obtain a copy of the data undergoing processing, whereby the first copy is free of charge, and for subsequent copies the Data Controller may charge a reasonable fee based on administrative costs;

- to rectification (Article 16 GDPR) - to request rectification of inaccurate personal data concerning them or completion of incomplete data;

- to erasure of data (Article 17 GDPR) - to request erasure of their personal data if the Data Controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing;

- to restriction of processing (Article 18 GDPR) - to request restriction of processing of personal data where:

- the data subject contests the accuracy of the personal data - for a period enabling the Data Controller to verify the accuracy of the data,

- the processing is unlawful and the data subject opposes the erasure of the personal data and requests restriction of their use instead,

- the Data Controller no longer needs the data, but they are required by the data subject for the establishment, exercise or defence of claims,

- the data subject has objected to processing - pending verification whether the legitimate grounds of the Controller override the grounds of objection of the data subject;

- to data portability (Article 20 GDPR) - to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used and machine-readable format, and to request transmission of those data to another controller where the data are processed on the basis of the data subject's consent or a contract concluded with them and where the data are processed by automated means;

- to object (Article 21 GDPR) - to object, on grounds relating to their particular situation, to the processing of their personal data for the Controller's legitimate purposes, including profiling. The Data Controller then assesses whether there are compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subjects, or grounds for the establishment, exercise or defence of claims. If, according to the assessment, the interests of the data subject override the interests of the Controller, the Data Controller will be obliged to cease processing the data for those purposes;

- to withdraw consent at any time and without giving any reason; however, the processing of personal data carried out before the withdrawal of consent will remain lawful. Withdrawal of consent will result in the Data Controller ceasing to process personal data for the purpose for which the consent was given.

To exercise the above rights, the data subject should contact the Data Controller using the contact details provided and inform the Controller which right they wish to exercise and to what extent.

7. President of the Personal Data Protection Office

The data subject has the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office, with its registered office in Warsaw, ul. Stawki 2, who may be contacted as follows:

- by post: ul. Stawki 2, 00-193 Warsaw;

- via the electronic inbox available at: https://www.uodo.gov.pl/pl/p/kontakt;

- helpline: 606-950-000.

8. Data Protection Officer

In each case, the data subject may also contact the Controller's Data Protection Officer directly by email or in writing to the address of the Data Controller provided in Section 1 point 2 of this Privacy and Cookies Policy.

9. Changes to the Privacy Policy

The Privacy and Cookies Policy may be supplemented or updated in accordance with the Controller's current needs in order to provide Customers/Users with up-to-date and reliable information.

10. Cookies

The Online Store performs functions involving the collection of information about Customers, Users and their behaviour in the following ways:

- through information voluntarily entered in forms for purposes resulting from the function of a specific form;

- by saving cookies on end devices;

- by collecting web server logs by the hosting operator of the Online Store (necessary for the proper operation of the website).

Cookies are IT data, in particular text files, which are stored on the Customer's/User's end device and are intended for use of the Online Store website. Cookies usually contain the name of the website from which they originate, the time they are stored on the end device and a unique number.

The Online Store uses cookies only after the Customer/User of the Store has given prior consent in this respect. Consent to the use by the Online Store of all cookies is given by clicking the button: "Close" when the message about the use of cookies by the Online Store is displayed, or by closing that message.

If the Customer/User of the Online Store does not consent to the use of cookies by the Online Store, they may use the option: "I do not consent", also available in the message about the use of cookies by the Online Store, or change the settings of the web browser they are currently using (this may, however, cause the Online Store website to function incorrectly).

To manage cookie settings, select the web browser/system from the list and follow the instructions: Internet Explorer, Chrome, Safari, Firefox, Opera, Android, Safari (iOS), Windows Phone.

The legal basis for processing personal data originating from cookies is the legitimate interests of the Data Controller, consisting in ensuring high-quality services and ensuring the security of services.

Within the Online Store, two main types of cookies are used: session cookies and persistent cookies. Session cookies are temporary files that are stored on the User's end device until logging out, leaving the Online Store or closing the software (web browser). Persistent cookies are stored on the Customer's/User's end device for the time specified in the cookie parameters or until they are deleted by the Customer/User.

Functional cookies (required)

hlsupps.com

monit_token: 365 days, cookie

Identifies the store customer.

shop_monit_token: 30 minutes, cookie

Identifies the store customer.

client: 1 day, cookie

Identifies the logged-in customer / the cart of a non-logged-in customer.

affiliate: 90 days, cookie

Stores information about the identifier of the partner from whom the visit to the store originated.

ordersDocuments: cookie

Stores information about the print status of a document.

__idsui: 1095 days, cookie

A file necessary for the operation of so-called light login on the website.

__idsual: 1095 days, cookie

A file necessary for the operation of so-called light login on the website.

__IAI_SRC: 90 days, cookie

Stores only the source from which the website visit originated.

Stores information on whether the user has logged in to the website.

CPA: 28 days, cookie

Contains information about variables for CPA / CPS programs in which the website participates.

__IAIRSABTVARIANT__: 30 days, cookie

Variant identifier for an A/B test and configuration of the IdoSell RS engine.

basket_id: 365 days, cookie

Identifier of the website user's cart, assigned for the duration of the session.

page_counter: 1 day, cookie

Counter of visited pages.

LANGID: 180 days, cookie

Stores information about the language selected by the website user.

REGID: 180 days, cookie

Stores information about the region of the website user.

CURRID: 180 days, cookie

Stores information about the currency selected by the website user.

__IAIABT__: 30 days, cookie

Stores the identifier of A/B tests for the purpose of testing and improving store functionality.

__IAIABTSHOP__: 30 days, cookie

Stores the identifier of the store participating in an A/B test.

__IAIABTVARIANT__: 30 days, cookie

Stores the identifier of the variant drawn as part of an ongoing A/B test.

toplayerwidgetcounter[]: cookie

Stores the number of displays of a pop-up type message.

samedayZipcode: 90 days, cookie

Stores information about the website user's postal code, which is necessary to offer courier shipment in the SameDay service.

applePayAvailability: 30 days, cookie

Stores information about whether Apple Pay is available as a payment method for the user.

paypalMerchant: 1 day, cookie

PayPal account identifier.

toplayerNextShowTime_: cookie

Stores information about the time at which the next pop-up message is to be displayed.

rabateCode_clicked: 1 day, cookie

Stores information about closing the bar informing about an active discount.

freeeshipping_clicked: 1 day, cookie

Stores information about closing the bar informing about free delivery.

redirection: cookie

Stores information about closing the pop-up message informing about the suggested language for the store.

filterHidden: 365 days, cookie

After clicking the option to collapse a product filter, stores information about which filter is to remain collapsed after refreshing the product list.

toplayerwidgetcounterclosedX_: cookie

Stores information about closing a pop-up type message.

cpa_currency: 60 minutes, cookie

Contains information about the currency for CPA / CPS programs in which the website participates.

basket_products_count: cookie

Stores information about the number of goods in the cart.

wishes_products_count: cookie

Stores information about the number of goods on the favorites list.

HOMELANDID: 180 days, cookie

Stores information about the visitor's country.

remembered_shop_mfa: 365 days, cookie

CookieNameRememberedShopMfa

IAI S.A.

iai_accounts_toplayer: 30 days, cookie

Ensures the correct display of a pop-up message informing about the IdoAccounts login service (https://www.idosell.com/pl/tysiace-gotowych-do-uzycia-funkcji/logowanie-do-sklepu-z-konta-w-innym-serwisie/).

IdoSell

platform_id: cookie

Stores information about whether the website is displayed in a mobile application.

paypalAvailability_: 1 day, cookie

Stores information about whether PayPal is available as a payment method for the user.

ck_cook: 3 days, cookie

Stores information about whether the website user has consented to cookies.

IdoAccounts

accounts_terms: 365 days, cookie

Stores information about whether the user has accepted consent to use the IdoAccounts service.

express_checkout_login: 365 days, cookie

CookieNameExpressCheckoutLogin

Google

NID: 180 days, cookie

These cookies (NID, ENID) are used to remember the user's preferences and other information, such as preferred language, the number of results displayed on the search results page (for example 10 or 20), and whether the user wants Google SafeSearch enabled. This cookie is also necessary to offer the Google Pay payment service.

Google reCAPTCHA

_GRECAPTCHA: 1095 days, cookie

This cookie is set by Google reCAPTCHA, which protects our website against spam requests in contact forms.

PayPal

ts: cookie

This cookie is usually provided by PayPal and supports payment services on the website.

ts_c: 1095 days, cookie

This cookie is usually provided by PayPal and is used to prevent fraud.

x-pp-s: cookie

This cookie is usually provided by PayPal and supports payment services on the website.

enforce_policy: 365 days, cookie

This cookie is usually provided by PayPal and supports payment services on the website.

tsrce: 3 days, cookie

This cookie is usually provided by PayPal and supports payment services on the website.

l7_az: 60 minutes, cookie

This cookie is necessary for the PayPal login function on the website.

LANG: 1 day, cookie

This cookie is usually provided by PayPal and supports payment services on the website.

nsid: cookie

Used in the context of transactions on the Website. The cookie is required for secure transactions.

Analytical cookies

IAI S.A.

__IAI_AC2: 45 days, cookie

Conversion tracking identifier (Activity Tracking) used to collect the history of sources preceding the placement of an order, as well as the source through which the order was placed, in accordance with the last-click attribution model.

Google Ads

*-*: 14 days, cookie

Stores information about whether the "Google Customer Reviews" pop-up requesting consent to send a survey about the order has already been displayed.

Google Maps

SID: 3650 days, cookie

These contain digitally signed and encrypted records of the Google account ID of the user and the last login time. The combination of these cookies (SID, HSID) allows Google to block many types of attacks, such as attempts to steal the content of forms submitted in Google services.

Advertising cookies

Meta (Facebook)

fbsr_: cookie

Contains a signed request for the user of the Facebook App.

fbss_: 365 days, cookie

Shared Facebook session.

fbs_: 30 minutes, cookie

Session on the Facebook portal.

Meta Pixel: 999 days, tracking pixel

Meta Pixel is a piece of code that allows advertising effectiveness to be measured by understanding actions taken by users on the website and helps ensure that the store's ads are displayed to the right people.

_fbp: 90 days, cookie

Cookie used for profiling users and matching advertising to the user's profile as accurately as possible.

fr: 90 days, cookie

Cookie used for profiling users and matching advertising to the user's profile as accurately as possible.

_fbc: 730 days, cookie

Last visit to the store.

tr: cookie

Cookie used for profiling users and matching advertising to the user's profile as accurately as possible.

sb: 402 days, cookie

This cookie helps identify and apply additional security measures if someone attempts to access a Facebook account without authorization, for example by entering randomly selected passwords. It is also used to store information that enables Facebook to recover the user's account if they forget their password, or to provide additional authentication when Facebook suspects that someone has broken into the account. This includes, for example, the "sb" and "dbln" cookies, which allow the user's browser to be securely identified.

usida: cookie

Collects a combination of the user's browser and a unique identifier, used to match ads to users.

wd: 9 days, cookie

This cookie helps route traffic between servers and analyze the loading speed of Meta Products for different users. Thanks to cookies, Meta may also record the proportions and dimensions of the user's screen and windows and determine whether the user has high-contrast mode enabled, which allows Meta to correctly present its websites and applications. For example, it may use the "dpr" and "wd" files, among other things, to provide the user with optimal screen parameters for the device.

locale: 9 days, cookie

This cookie contains the location of the last logged-in user in this browser.

datr: 7 days, cookie

The purpose of the datr cookie is to identify the web browser used to connect to Facebook, regardless of the logged-in user. This cookie plays a key role in Facebook's security and site integrity functions.

hlsupps.com

RSSID: 180 days, cookie

IdoSell RS user identifier, used to display tailored product recommendations on the website.

__IAIRSUSER__: 60 minutes, cookie

IdoSell RS user identifier, used to display tailored product recommendations on the website.

Google Ads

_gcl_au: 90 days, cookie

Used by Google AdSense to experiment with advertising performance on websites using their services.

FPAU: 90 days, cookie

Cookie in which information about users and their activity on the service is collected through embedded elements for analytical and reporting purposes.

FPGCLAW: 90 days, cookie