Privacy policy
Controller
The controllers of personal data collected through the muurala.com website are: Dariusz Jaworski, tax ID (NIP) 6262026311, business ID (REGON) 242837348, and Paweł Foltys, tax ID (NIP) 9690091461, business ID (REGON) 276542299 — partners conducting joint business activity under a civil partnership agreement as FJ7 S.C., registered at ul. Smyczkowa 17, 02-678 Warszawa, Poland, partnership NIP: 7010690694, REGON: 367257996, hereinafter the “Controller”.
For matters concerning personal data, contact FJ7 s.c. at hello@muurala.com.
Your personal data is processed in accordance with the Polish Personal Data Protection Act of 10 May 2018 (Journal of Laws 2018, item 1000), the Act on Providing Services by Electronic Means of 18 July 2002 (Journal of Laws No. 144, item 1204, as amended) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
Personal data
Personal data means any information that can identify you as a customer — for example your name, phone number, e-mail address, delivery address or tax ID. The words “process” and “processing” mean any operation performed on your personal data, including simply storing it.
Voluntary nature of providing data
Using the muurala.com website is voluntary — it is entirely your decision whether to use the site and the services provided through it. Providing personal data through the site is also voluntary, although some services, such as preparing a quotation, cannot be delivered without it; you are always informed of this in advance. Anyone who has provided us with their data may request access to it, its correction, updating, rectification, restriction of processing, temporary or permanent suspension of processing, erasure or transfer to another entity. Everyone has the right to object to the processing of their personal data free of charge, and to lodge a complaint with the supervisory authority — in Poland this is the President of the Personal Data Protection Office. As the Controller we process the following personal data:
- name and surname, company name,
- address (street and building/flat number, postal code, city),
- phone number,
- e-mail address,
- connection parameters (the website you came from, IP address, date and time of access, amount of data transferred, information about the browser and operating system used). This information serves site administration, visit statistics, diagnosing and solving site problems, and analysing site security.
Purposes and legal bases
We process your data in order to publish the content available on the site, to contact you in matters directly related to the operation of muurala.com — for example to conclude a sales agreement, prepare a quotation or send you an offer catalogue (Art. 6(1)(a) and (b) GDPR), to fulfil an order (Art. 6(1)(b) GDPR), for accounting purposes (Art. 6(1)(c) GDPR) and to handle complaints (Art. 6(1)(b) GDPR).
On the basis of our legitimate interest we also process data in order to ensure the security of the services provided electronically, including counteracting fraud and abuse (Art. 6(1)(c) and (d) GDPR), to conduct research and analysis of the website (Art. 6(1)(f) GDPR), to handle requests sent through the contact form where they are not directly connected with performing a contract, to pursue claims and conduct court, arbitration and mediation proceedings, to carry out statistical analysis and to store data for archiving purposes and accountability (Art. 6(1)(f) GDPR).
Only if you give your consent do we process your data in order to store data in cookies and collect data from websites and mobile applications, to send you our newsletter, to operate the website (including data collected automatically during your visits) and to prepare a personalised offer (Art. 6(1)(a) GDPR in connection with Art. 22 GDPR).
If you are under 16, we may not lawfully process your personal data for marketing purposes (Art. 8 GDPR) without confirmation from your parent or legal guardian sent to hello@muurala.com.
Retention periods
We do not process your personal data indefinitely, but only for as long as it takes to achieve the stated purpose. Afterwards the data is irreversibly deleted or destroyed; while awaiting deletion it is additionally protected by pseudonymisation.
- 6 years — for name and surname or company name, tax ID, address, e-mail and phone number processed in order to perform a contract and for as long as claims connected with its performance may be pursued,
- 6 years — for the same categories of data processed for accounting and tax purposes,
- until an effective objection is raised or the purpose is achieved, but no longer than 6 years — for data processed in order to deliver a completed order,
- until consent is withdrawn or the purpose is achieved, but no longer than 6 years — for name and e-mail address processed for the newsletter,
- until it becomes outdated or loses its usefulness, but no longer than one year — for IP address, domain name, browser and operating system type processed in order to operate the muurala.com website.
Periods counted in years run from the end of the year in which processing began. Where you exercise the right to be forgotten, such cases are considered individually.
Sharing and security of personal data
As the controller we apply the best technical and organisational measures appropriate to the risks and to the categories of data protected; in particular we protect the data against disclosure to unauthorised persons, against being taken by an unauthorised person, against processing in breach of applicable law and against alteration, loss, damage or destruction.
The server hosting the site is operated by Kei.pl (KEI.PL Sp. z o.o., ul. Zakopiańska 9, 30-418 Kraków, KRS: 0000127720, e-mail: bok@kei.pl, phone 12 262 62 00), which ensures very high standards of personal data processing security. Your personal data may be transferred outside the European Economic Area, solely in connection with Google LLC and Meta, on the basis of appropriate legal safeguards, namely standard contractual clauses approved by the European Commission.
As the controller we do not sell, lend or transfer our customers' personal data to other persons or institutions without your consent, unless the data may be disclosed to authorised state bodies at their request under applicable law, or to third parties under decisions of state bodies. Access to your personal data is held by the Controller and by employees or persons providing services connected with the website (for example developers, IT specialists, entities administering and maintaining the system, marketing service providers) — to the extent determined by the Controller and under a data processing agreement.
Your rights
We guarantee all your rights under the GDPR and Polish law. You have the right to:
- access your personal data,
- be informed about the processing of your personal data,
- rectification of your personal data,
- erasure of your personal data,
- restriction of the processing of your personal data,
- object to the processing of your personal data,
- data portability (at your request you will receive, within one month, a file containing your data in a structured, commonly used CSV format; you may also indicate the entity to which we should send it),
- object to profiling — not to be subject to automated decision-making, including profiling.
These rights are not absolute, so in some situations we may lawfully refuse to fulfil a request. If we do refuse, it is only after careful analysis and only where the refusal is necessary. We may reject an objection if we demonstrate that there are legitimate grounds for processing which override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.
You can exercise your rights by writing to FJ7 S.C., ul. Smyczkowa 17, 02-678 Warszawa, or to hello@muurala.com, and by lodging a complaint with the President of the Personal Data Protection Office under the Act of 10 May 2018 on the protection of personal data (Journal of Laws 2018, item 1000).