Privacy Policy

Hello!

If you have come here, it is a sure sign that you value your privacy. We understand that, so we provide this document in which you can find, in one place, the rules for processing personal data and using cookies and other tracking technologies in connection with the operation of the shop at https://sklep.slowfashioncafe.pl/.

Formal information first: the shop operator is SFC Sp. z o.o., ul. Kalwaryjska 34/U6, 30-504 Kraków, NIP: 6793232144.

This privacy policy takes the form of questions and answers to make the information clear and readable. The table of contents below lists the questions we answer in turn.

Who is the controller of your personal data?
Who can you contact about the processing of your personal data?
What information do we have about you?
Where do we obtain your personal data?
Is your data secure?
For what purposes do we process your personal data?
How long will we retain your personal data?
Who receives your personal data?
Do we transfer your data to third countries or international organisations?
Do we use profiling? Do we make automated decisions based on your personal data?
What rights do you have in relation to the processing of your personal data?
Do we use cookies, and what are they?
On what basis do we use cookies?
Can you disable cookies?
For what purposes do we use our own cookies?
Which third-party cookies are used?
Do we track your behaviour in our shop?
Do we show you targeted advertising?
How can you manage your privacy?
What are server logs?
Is there anything else you should know?
Can this privacy policy change?

If you have any doubts about this privacy policy, you can contact us at any time at info@slowfashioncafe.pl.

1. Who is the controller of your personal data?

The controller of your personal data is SFC Sp. z o.o., ul. Kalwaryjska 34/U6, 30-504 Kraków, NIP: 6793232144.

2. Who can you contact about the processing of your personal data?

As part of implementing personal-data protection in our organisation, we decided not to appoint a data protection officer because this is not mandatory in our situation. For matters concerning personal-data protection and privacy more generally, you can contact us at info@slowfashioncafe.pl.

3. What information do we have about you?

Depending on the purpose, we may process the following information about you:

first and last name;
residential address;
business address;
tax identification number (NIP);
email address;
telephone number;
information in correspondence sent to us;
details of orders placed;
bank account number;
IP address;
image (profile photo);
activity relating to newsletters we send.

We describe the scope of the data processed precisely for each processing purpose later in this policy.

4. Where do we obtain your personal data?

In most cases, you provide it yourself when you:

register a user account;
place an order in the shop;
submit a complaint or withdraw from a contract;
subscribe to the newsletter;
add a comment or product review;
contact us.

Some information about you may also be collected automatically by tools we use:

the shop and newsletter systems collect your IP address;
the newsletter system collects information about your activity concerning newsletter content sent to you, such as message openings and link clicks.

5. Is your data secure?

We take care of the security of your personal data. We have analysed the risks associated with each data-processing activity and implemented appropriate security and personal-data protection measures. We continually monitor our technical infrastructure, train our staff, review our procedures and make necessary improvements. If you have any questions about your personal data, you can contact us at info@slowfashioncafe.pl.

6. For what purposes do we process your personal data?

There is more than one purpose. Below is a list, followed by a more detailed explanation. We have also assigned the relevant legal basis to each purpose:

registering and maintaining a user account – Article 6(1)(b) GDPR;
handling an order – Article 6(1)(b) GDPR;
handling a complaint or withdrawal from a contract – Article 6(1)(f) GDPR;
sending the newsletter – Article 6(1)(a) GDPR;
handling comments or product reviews – Article 6(1)(a) GDPR;
handling correspondence – Article 6(1)(f) GDPR;
fulfilling tax and accounting obligations – Article 6(1)(c) GDPR;
creating an archive to defend, establish or pursue possible claims and to identify returning customers – Article 6(1)(f) GDPR;
marketing our own products – Article 6(1)(f) GDPR.

User account – details

When creating a user account, you must provide the information needed to create it: an email address and password. Providing this information is voluntary but necessary to create the account.

When editing your account, you may provide additional information, particularly information that may be used when placing orders, such as your first and last name, residential or business address, NIP and telephone number. You may also set an avatar, such as a profile photo showing your image.

If you create an account through integration with a social-media account, we will access certain information stored in that account, based on your prior authorisation: your first and last name, email address and profile photo.

Our user-account system also records the IP address you used when registering the account.

You can change the information you provided when registering your account at any time. However, if you used social-media integration, information obtained from that service cannot be changed here.

We process the information you provide when creating an account to supply the electronic service that lets you use the account. This service is provided under a contract concluded according to the terms and conditions, so the legal basis for processing your personal data in this respect is Article 6(1)(b) GDPR.

The data will be retained while the user account operates. You may delete the account at any time, but this will not remove information about orders placed using it from our database. Order data is retained in our archive throughout the shop’s operation so we can identify returning customers, reconstruct their purchase history and discounts granted, and so on. This is our legitimate interest under Article 6(1)(f) GDPR.

Orders – details

When placing an order, you must provide the information needed to fulfil it. The information required may vary with the order. For example, if you order physical products, we need the delivery address. If you request a VAT invoice for a business, we need the NIP and business address. Providing the information is voluntary but necessary to place the order.

Our order-processing system also records the IP address you used when placing the order.

Every order is recorded in our database. This means that the personal data linked to the order is accompanied by information such as the products ordered, selected payment and delivery methods, and payment date.

We process order data to perform the contract concluded by placing the order (Article 6(1)(b) GDPR); issue an invoice (Article 6(1)(c) GDPR in conjunction with the provisions governing invoicing); include the invoice in accounting records and fulfil other tax and accounting obligations (Article 6(1)(c) GDPR in conjunction with the relevant tax and accounting provisions); and for archival purposes in case we need to defend, establish or pursue claims or identify a returning customer, which is our legitimate interest (Article 6(1)(f) GDPR).

Order data will be processed for the time needed to fulfil the order and then until claims arising from the contract become time-barred. After that, we may still process it for archival purposes, in case we need to defend, establish or pursue claims or identify a returning customer. We must also retain accounting records that may contain your personal data for the period required by law.

Complaints and withdrawal from contracts – details

If you submit a complaint or withdraw from a contract, you provide the personal data in your complaint or withdrawal statement, including your first and last name, residential address, telephone number, email address and bank account number. Providing this data is voluntary but necessary to submit a complaint or withdraw.

We use data provided in connection with a complaint or withdrawal to carry out the complaint or withdrawal procedure and then for archival purposes. This is our legitimate interest under Article 6(1)(f) GDPR.

The data will be processed for the time needed to complete the complaint or withdrawal procedure. Complaint documents will be retained until rights under the statutory warranty for defects expire. Withdrawal statements will be retained with accounting records for the period required by law.

Newsletter – details

When you subscribe to the newsletter, you give us your first name and email address. Providing this information is voluntary but necessary to subscribe.

Our newsletter system also records the IP address you used when subscribing, determines your approximate location and the email client you use, and tracks your actions concerning messages sent to you. We therefore also know which messages you opened and which links you clicked.

We use the information you provide when subscribing to send the newsletter. The legal basis is your consent given when subscribing (Article 6(1)(a) GDPR). For information collected automatically by the mailing system rather than supplied by you, we rely on our legitimate interest (Article 6(1)(f) GDPR) in analysing subscriber behaviour to optimise mailing activities.

You may unsubscribe at any time using the dedicated link in every newsletter email or by contacting us. Even after you unsubscribe, your data will remain in our database to identify a returning subscriber and to defend possible claims related to sending you the newsletter, particularly to demonstrate when you consented and withdrew consent. This is our legitimate interest under Article 6(1)(f) GDPR.

You may change the information supplied for the newsletter at any time using the relevant link in each newsletter email or by contacting us.

Comments and product reviews – details

To add a comment or product review, you must provide at least a username linked to it (which may contain personal data, such as your first or last name) and an email address. Providing these is voluntary but necessary to add a comment or review. You may also add an avatar (which may show your image, such as a photo) and a website address, but these are optional.

The data you provide with a comment or review is processed to publish it on the site. The basis is your consent (Article 6(1)(a) GDPR), expressed by submitting the publication form. You may withdraw consent at any time by requesting removal of the comment or review.

Your comment or review will be publicly available on the site for as long as the site is available online unless you request its removal earlier. You may also change the comment’s content and the details attributed to you as its author at any time.

Handling correspondence – details

When you contact us, you naturally provide personal data in your correspondence, particularly your email address and first and last name. Providing it is voluntary but necessary to make contact.

We process it to communicate with you on the basis of Article 6(1)(f) GDPR, our legitimate interest. After communication ends, our legitimate interest in archiving correspondence so that we can demonstrate certain facts in the future is also the legal basis (Article 6(1)(f) GDPR).

Correspondence may be archived, and we cannot say exactly when it will be deleted. You may request a history of your correspondence with us, if archived, and request its deletion, unless archiving is justified by our overriding interests, such as defending against possible claims from you.

Tax and accounting obligations – details

If we issue you an invoice, it becomes part of the accounting records retained for the period required by law. Your personal data is then processed to fulfil our tax and accounting obligations (Article 6(1)(c) GDPR in conjunction with the provisions governing those obligations).

Archive – details

We specified retention periods above for each processing purpose. They often involve archiving certain data so that we can demonstrate facts in the future, reconstruct our cooperation with a customer and correspondence exchanged, or defend, establish or pursue claims. We rely on our legitimate interest under Article 6(1)(f) GDPR.

Marketing our own products – details

Our shop uses an abandoned-cart recovery mechanism. If you start but do not finish placing an order, our system records this so we can encourage you to complete it. Actions may include sending you an email encouraging completion or showing targeted advertising while you browse the Internet.

We carry out these actions on the basis of our legitimate interest in marketing our own products under Article 6(1)(f) GDPR. You may object to them at any time.

7. How long will we retain your personal data?

Retention periods are stated separately for each processing purpose in the details above.

We retain your order data for the entire period in which our online shop operates. We believe this benefits you because you can review your purchase history at any time and use discounts if we offer them to returning customers. If you do not want your order data retained for so long, you may object to its retention for that purpose at any time. However, we consider that we have an overriding interest in retaining order data until claims under your sales contract with us become time-barred.

8. Who receives your personal data?

We use services provided by third parties, some of which involve processing your personal data. External service providers involved are:

the hosting provider, which stores data on a server;
the cloud computing provider, which stores backups that may contain your personal data;
the mailing system provider, which stores your data if you subscribe to the newsletter;
the CRM system provider, where we store your data to improve customer service and for archival purposes;
the invoicing system provider, where your data is stored to issue an invoice;
the accounting office, which processes your data shown on invoices;
the technical support provider, which accesses data if its work concerns areas containing personal data;
other subcontractors, which access data if their work requires it.

All these entities process your data under data-processing agreements with us and guarantee an appropriate level of personal-data protection.

Your data is disclosed to courier companies to the extent needed to deliver an order. These companies become independent controllers of your personal data.

When necessary, your data may be disclosed to a legal adviser or advocate bound by professional secrecy, where legal assistance requires access to it.

We also participate in the Ceneo Trusted Opinions programme. During checkout you may consent to the transfer of order-related data to survey your satisfaction with the purchase. If you consent, your data will be disclosed to Ceneo pl. Sp. z o.o., which will then become its controller. Ceneo’s processing is described in its terms at http://info.ceneo.pl/regulamin/.

Your personal data may also be sent to tax offices as needed to fulfil tax, settlement and accounting obligations, particularly in declarations, reports, statements and other accounting documents containing it.

When necessary, your personal data may also be disclosed to entities, authorities or institutions legally entitled to access it, such as police and security services, courts and prosecutors.

We also use tools that collect information about your use of the shop, particularly:

your operating system and web browser;
pages viewed;
time spent on the site;
navigation between pages;
clicks on links;
the source from which you reached our site;
your age bracket;
your gender;
your approximate location at town or city level;
your interests inferred from online activity.

In our view, this information does not itself constitute personal data. Because external tools collect it, their providers also process it under their terms and privacy policies. Generally, it is used to provide, improve and manage services, develop new services, measure advertising effectiveness, protect against fraud and abuse, and personalise content and advertising across services, websites and apps. We describe these tools in more detail later in this policy.

9. Do we transfer your data to third countries or international organisations?

Yes. Some processing of your personal data may involve transfers to third countries.

We transfer personal data to third countries because we use tools that store it on servers there, especially in the USA. Their providers guarantee an appropriate level of personal-data protection through GDPR compliance mechanisms, in particular participation in Privacy Shield or standard contractual clauses.

Personal data is stored on servers in third countries through these tools:

MailChimp, a mailing system provided by Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, for your first name, email address, IP address and statistics about your responses to messages we send;
Google services in the G-Suite package, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for all data processed through Google services, including data in files synchronised with Google Drive.

Both Rocket Science Group LLC and Google Ireland Limited ensure an appropriate level of personal-data protection through GDPR compliance mechanisms, particularly standard contractual clauses.

We also use external tools that may collect information about you that is anonymous to us, as mentioned above. Their providers often store collected information on servers worldwide, particularly in the USA.

10. Do we use profiling or make automated decisions based on your personal data?

We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.

We do use tools that may act on information gathered by tracking mechanisms, but we believe these actions do not significantly affect you because they do not differentiate your position as a customer or affect the terms of a contract you can conclude with us.

For example, we may show you personalised ads based on your earlier activity on our site or suggest products that may interest you. This is behavioural advertising. We encourage you to learn more about it, especially its privacy implications. Details and settings are available at http://www.youronlinechoices.com.

In the tools we use, we do not have access to information allowing us to identify you. The information includes:

your operating system and web browser;
pages viewed;
time spent on the site;
navigation between pages;
the source from which you reached our site;
your age bracket;
your gender;
your approximate location at town or city level;
your interests inferred from online activity.

We do not combine this information with personal data in our databases. It is anonymous and does not allow us to identify you. It is stored on the tools’ providers’ servers, which are often located around the world.

11. What rights do you have in relation to the processing of your personal data?

GDPR grants you the following potential rights:

access to your data and a copy of it;
rectification of your data;
erasure of your data, if you believe we have no basis to process it;
restriction of processing to storage or actions agreed with you if you believe our data is inaccurate or processed without a basis;
objection to processing based on legitimate interest: you should identify the particular circumstances that, in your view, justify stopping the processing. We will stop for those purposes unless we show that our grounds override your rights or that we need the data to establish, pursue or defend claims;
data portability: you may receive data you provided under a contract or with your consent in a structured, commonly used, machine-readable format and ask us to send it directly to another entity;
withdrawal of consent to processing if you previously gave it;
a complaint to the supervisory authority, the President of the Personal Data Protection Office or another competent authority, if you believe we process data unlawfully.

The rules for exercising these rights are detailed in Articles 16–21 GDPR. We encourage you to read them. These rights are not absolute and do not apply to every processing activity.

You always have the right to complain to the supervisory authority (the President of the Personal Data Protection Office) if you believe we have violated data-protection rules.

You can always ask us what data we hold about you and why we process it by emailing info@slowfashioncafe.pl. We have tried to provide comprehensive information in this policy. You can also use that address for any questions about processing your personal data.

12. Do we use cookies, and what are they?

Our shop, like almost every other website, uses cookies.

Cookies are small text items stored on your device (such as a computer, tablet or smartphone) that may be read by our computer system (our own cookies) or third-party systems (third-party cookies). They may store information that these systems can later access for specified purposes.

Some cookies we use are deleted when you end your browser session by closing it (session cookies). Others remain on your device and allow us to recognise your browser on a later visit (persistent cookies).

For more information about cookies, see, for example, https://pl.wikipedia.org/wiki/HTTP_cookie.

13. On what basis do we use cookies?

We use cookies based on your consent, except where they are necessary to provide you with an electronic service properly.

We take the position that you express consent through your browser settings or additional cookie-management software. We assume you consent to all cookies we use that your browser or additional software does not block.

Disabling or restricting cookies may prevent some shop functions from working and make this and other sites harder to use. For example, blocking cookies from social-media plugins may make buttons, widgets and social features in the shop unavailable.

14. Can you disable cookies?

Yes. You can manage cookies in your browser: block all or selected cookies, block cookies from specific sites, and delete cookies and other site and plugin data already saved.

Browsers also offer incognito mode. You can use it if you do not want visited pages and downloaded files saved in browsing and download history. Cookies created in incognito mode are deleted when all incognito windows close.

Browser extensions such as Ghostery (https://www.ghostery.com) also let you control cookies. Other software, particularly antivirus packages, may offer this function.

Online tools also let you control some types of cookies, particularly behavioural-advertising settings collectively, for example www.youronlinechoices.com/ and www.networkadvertising.org/choices.

We also offer cookie controls directly in the shop through a mechanism that lets you block cookies you do not want.

Disabling or restricting cookies may prevent some shop functions from working and make this and other sites harder to use. For example, blocking social-media plugin cookies may make buttons, widgets and social features in the shop unavailable.

15. For what purposes do we use our own cookies?

Our own cookies ensure that shop functions work correctly, such as keeping you signed into your account and remembering recently viewed products and items added to the cart.

They also store the cookie settings you choose using our cookie-management mechanism.

Our own cookies are also used for the abandoned-cart recovery mechanism.

16. Which third-party cookies are used?

The following third-party cookies operate in our shop:

Google Analytics;
Google Tag Manager;
Google Ads;
Google AdSense;
Facebook Custom Audiences;
Facebook, Twitter, LinkedIN and Pinterest social-media tools;
Disqus;
Hotjar;
YouTube.

Details of each are given below.

Google Analytics – details

We use Google Analytics, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We rely on our legitimate interest in compiling and analysing statistics to optimise our websites.

We have implemented Google Analytics tracking code on our site. It uses Google LLC cookies for Google Analytics. You can block the tracking code at any time by installing Google’s browser add-on at https://tools.google.com/dlpage/gaoptout.

Google Analytics automatically collects information about your use of our site. It is usually sent to and stored on Google servers, which may be anywhere in the world.

Because we activated IP anonymisation, your IP address is shortened before transfer. Only exceptionally is the full address sent to Google servers and shortened there. As a rule, the anonymised IP address sent by your browser through Google Analytics is not combined with other Google data.

We emphasise that through Google Analytics we do not collect data that would identify you. Data collected through it is therefore not personal data to us. We can access, in particular:

your operating system and browser;
pages you view in our shop;
time spent in the shop and on its pages;
navigation between pages;
the source from which you reached the shop.

We also use these Google Analytics Advertising Features:

demographics and interests reports;
remarketing;
advertising reporting features and user-ID.

We do not collect personal data through these Advertising Features either. We can access, in particular:

your age bracket;
your gender;
your approximate location at town or city level;
your interests inferred from online activity.

Google Analytics and Google Analytics 360 services have obtained certification to the independent ISO 27001 security standard. ISO 27001 is among the world’s most widely recognised standards and confirms that the systems supporting Google Analytics and Google Analytics 360 meet the relevant requirements.

For details on Google’s use of data from sites and apps that use its services, see https://policies.google.com/technologies/partner-sites.

Google Tag Manager – details

We use Google Tag Manager, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. It manages tags, small pieces of code that allow us to monitor traffic and user behaviour, collect information about advertising effectiveness and improve our shop. Google Tag Manager does not collect information identifying you, but it triggers other tags that may collect data.

Google Ads – details

We use remarketing features in Google AdWords, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We rely on our legitimate interest in marketing our own products or services.

When you visit our site, a Google remarketing cookie is automatically stored on your device and collects information about your shop activity. That information lets us show you ads in the Google network according to your behaviour in our shop. For example, viewing a product is recorded by the cookie and may lead us to show an ad for that product or another ad we consider suitable while you browse other websites.

We do not collect identifying data through Google Ads. Google may combine information so that it becomes personal data, but we are not responsible for that activity because Google acts under its agreement with you as a Google-services user.

Through Google AdWords we can define only the target groups for our ads. Google decides when and how to show them to you.

Further processing occurs only if you consented to Google linking your browsing history with your account and using your Google account information to personalise ads on websites. Google then uses your data to create target groups for cross-device remarketing and temporarily combines collected information with other data it holds to create those groups.

If you do not want personalised ads, manage your Google ad settings at https://adssettings.google.com/.

For details on Google’s use of data from sites and apps that use its services, see https://policies.google.com/technologies/partner-sites.

Google AdSense – details

We display ads on our pages through the Google AdSense network operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We rely on our legitimate interest in monetising the content we publish.

Because we display AdSense ads, our site contains ad tags that instruct your browser to request advertising content from Google servers. The server also sends a cookie. Cookies show ads based on your earlier visits to our or other websites and help AdSense improve ad quality. Common uses include targeting ads to topics that interest you, improving campaign performance reports and excluding ads you have already seen.

We do not collect identifying data through Google AdSense. Google may combine information so that it becomes personal data, but we are not responsible for that activity because Google acts under its agreement with you as a Google-services user.

Further processing occurs only if you consented to Google linking your browsing history with your account and using Google account information to personalise website ads. Google then uses your data to create target groups for cross-device remarketing and temporarily combines collected information with other data it holds.

If you do not want personalised ads, manage your Google ad settings at https://adssettings.google.com/.

For details on Google’s use of data from sites and apps that use its services, see https://policies.google.com/technologies/partner-sites.

Facebook Custom Audiences – details

Within Facebook Ads, provided by Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA, we use Custom Audiences to direct targeted ads to defined groups of users. We rely on our legitimate interest in marketing our own products or services.

To show you ads personalised to your behaviour in our shop, we implemented the Facebook Pixel, which automatically collects information about your use of our site. This information is usually sent to Facebook servers, which may be worldwide, particularly in the USA.

Information collected by the Facebook Pixel is anonymous to us and does not let us identify you. Your activity on our pages may place you in a target group, but we do not identify individual members.

Facebook may combine collected information with other information about you from Facebook and use it for its own purposes, including marketing. We do not control this. See Facebook’s privacy policy at https://www.facebook.com/privacy/explanation. You can also manage privacy settings in your Facebook account; see https://www.facebook.com/ads/settings.

Social-media tools – details

Our website uses plugins, buttons and other social-media tools (together, “plugins”) provided by services such as Facebook, Instagram, LinkedIN, Twitter and Pinterest.

When you view a page containing a social-media plugin, your browser informs that service’s operator of the visit. Because the plugin is part of the service embedded in our page, the browser requests its content for our page.

Plugins collect information such as your user ID, the website visited, date and time, and other browser information.

Social-media operators use some of this to personalise how you view our page. For example, an operator needs to know who you are to show which of your friends also like our page beside a “Like” button.

Operators may also use plugin-collected information for their own purposes, such as improving products, building user profiles, analysing and optimising activities, and targeting ads. We have no real control over their later use of it. Consult each service’s terms and privacy policy for details.

Plugins collect and send information to their operators even if you browse our site without being logged in to the social-media account, although the browser then sends a more limited set of information.

If you are logged in to a social-media service, its operator can directly associate your visit to our site with your profile there.

To prevent this direct association, log out of that service before visiting our site. You can also prevent plugins from loading by using suitable browser extensions, such as script blockers.

Using some plugins may publish information on your social-media profile. For example, a “Like” click may appear on your Facebook timeline. If you share content using a plugin on our site, that share will naturally be visible on your profile.

For details of operators’ purposes, scope, further processing and use, contact options, your rights and privacy settings, consult their policies:

Facebook – https://www.facebook.com/privacy/explanation;
Twitter – https://twitter.com/en/privacy;
LinkedIN – https://www.linkedin.com/legal/privacy-policy;
Instagram – https://www.facebook.com/help/instagram/155833707900388;
Pinterest – https://policy.pinterest.com/pl/privacy-policy.

Disqus – details

Our site uses the Disqus comments system operated by Disqus, Inc., 717 Market St, San Francisco, CA 94103, USA.

When you view a page with Disqus comments, Disqus sends one or more cookies to your device to identify your browser. These cookies support the comments system, particularly sign-in. They also collect information on how you use our site, such as pages visited and links clicked, to analyse activity and personalise content, including ads, displayed through Disqus.

If Disqus displays ads, it uses supporting technologies such as Google, Polymorph and ServeBid, which may set cookies to personalise marketing, link ads with later activity and limit how often ads appear.

You use Disqus as its own user under its terms and privacy policy. Disqus is an independent provider of electronic services to you. For details, see:

Hotjar – details

We use Hotjar to understand your needs better and optimise your experience on our site, which is our legitimate interest. It is provided by Hotjar Limited, Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta.

Hotjar records each visitor and lets us replay video of their movement on our site and create heat maps. We cannot access identifying information through Hotjar because it does not record form completion. We can access, in particular:

your operating system and browser;
pages viewed on our site;
time spent on our site and its pages;
navigation between pages;
the source from which you reached our site;
places where you click the mouse.

We implemented Hotjar tracking code on our site. It uses Hotjar Limited cookies. Cookie information is stored by Hotjar in a pseudonymous user profile. Neither Hotjar nor we use it to identify you.

You can object to Hotjar creating a user profile, storing information on your use of our site and using Hotjar cookies at https://www.hotjar.com/legal/compliance/opt-out.

For details of Hotjar’s data processing, see https://www.hotjar.com/legal/policies/privacy.

YouTube – details

Our pages embed YouTube widgets so you can play YouTube videos directly there. YouTube is operated by Google LLC.

Videos are embedded in privacy-enhanced mode. According to YouTube’s information, this means no cookies are saved on your device and Google collects no information about you until you play a video.

When you play a video, YouTube saves cookies on your device and learns that you played it from a particular website, even if you do not have a Google account or are not signed in. If you are signed in, Google can directly link your visit to our site with your account. Google’s privacy policy describes the purposes and scope of collection and further processing, as well as contact, rights and privacy settings.

If you do not want Google to link video playback data directly with your profile, log out before playing a video. You can also block plugins from loading using suitable browser extensions, such as script blockers.

Google uses information in cookies associated with embedded YouTube videos to keep widgets functioning correctly and securely, analyse and optimise YouTube services, and for personalisation and advertising.

When you play YouTube videos, you use electronic services provided by Google LLC, an independent provider. For details of using YouTube and privacy, see:

terms: https://www.youtube.com/t/terms;
privacy policy: https://policies.google.com/privacy.

17. Do we track your behaviour in our shop?

Yes. We use Google Analytics, Google AdWords, Hotjar and Facebook Custom Audiences, which collect information about your activity in our shop. These tools are described in detail in the section on third-party cookies, so we do not repeat that information here.

18. Do we show you targeted advertising?

Yes. With Facebook Ads and Google Ads, we may target ads to groups defined by criteria such as age, gender, interests, profession, work and previous activity in our shop. These tools are described in detail in the section on third-party cookies.

19. How can you manage your privacy?

Many parts of this policy explain options for managing your privacy, including individual tools, behavioural advertising and cookie consent. For convenience, here is a list:

cookie settings in your browser;
browser extensions for cookie management, such as Ghostery;
additional cookie-management software;
your browser’s incognito mode;
behavioural-advertising settings, such as youronlinechoices.com;
the cookie-management mechanism on our site;
Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout;
Google Ads settings: https://adssettings.google.com/;
Facebook Ads settings: https://www.facebook.com/ads/settings;
Hotjar opt-out: https://www.hotjar.com/legal/compliance/opt-out.

20. What are server logs?

Using the shop sends requests to the server hosting it. Every request is recorded in server logs.

Logs include your IP address, server date and time, and information about your browser and operating system. They are recorded and retained on the server.

Log data is not associated with specific people using the site and is not used to identify you.

Logs are only auxiliary material for site administration and are disclosed only to people authorised to administer the server.

21. Is there anything else you should know?

Processing personal data, using cookies and managing privacy generally are complex. We have done our best to give you extensive information about matters important to you. If anything is unclear, you want to learn more or simply discuss your privacy, email info@slowfashioncafe.pl.

22. Can this privacy policy change?

Yes. We may amend this policy, particularly because of technological changes in our shop or changes in law. If you are a registered shop user, you will receive a message about every change. All archived versions of the policy are also linked below.