Privacy Policy of the droste.nl website

1. Who is the controller of your data?

The controller of your personal data collected via the droste.nl website is Wawel S.A., with its registered office in Kraków, ul. Władysława Warneńczyka 14, 30-520 Kraków, Poland, entered in the Register of Entrepreneurs under KRS number: 0000014525, NIP (VAT): PL 6760076868, REGON: 350035154, BDO: 000030591. For any matters relating to privacy protection, you can contact us by e-mail at: iodo@wawel.com.pl.

2. For what purposes, what data and on what legal basis do we process it?

We process your data for the following purposes:

Sending the newsletter: We process your e-mail address in order to send you marketing information and news from the Droste brand. The legal basis is your explicit, voluntary consent (Article 6(1)(a) GDPR). We use a double opt-in mechanism to keep you safe.
Operation and security of the website: During your visit, we collect basic technical data (e.g. IP address, browser type) in server logs. We do this on the basis of our legitimate interest in ensuring the correct and secure operation of the website (Article 6(1)(f) GDPR). We do not use automated decision-making, including profiling.

3. Who do we share your data with?

We act with full transparency. Your data may only be shared with trusted entities that support us in providing our services (so-called processors). These include the hosting provider for the droste.nl website and the provider of the platform used to technically send the newsletter.

4. Transfers of data outside the European Economic Area (EEA)

We make sure that your data is fully secure and subject to strict European standards. Wawel S.A. does not transfer your personal data outside the European Economic Area (EEA).

5. How long do we keep your data?

Newsletter: We process your e-mail address until you withdraw your consent to receive messages from us.
Technical data (logs): We keep them only for the short period necessary to ensure security (up to a maximum of 30 days), after which they are deleted.

6. What are your rights?

Under the GDPR, you have full control over your data. You have the right to:

access your data and request a copy of it,
rectify (correct) inaccurate data,
have your data erased (the right to be forgotten),
restrict processing or object to processing,
data portability,
withdraw your consent to the newsletter at any time (most easily via the “Unsubscribe” link in the message). Withdrawing consent does not affect the lawfulness of mailings sent before its withdrawal,
lodge a complaint with a supervisory authority, e.g. the Dutch Autoriteit Persoonsgegevens (AP) or the Polish Personal Data Protection Office (UODO).

7. Information about cookies

Our website uses small text files called cookies.

Strictly necessary cookies: These are required for the website to function properly and do not require your consent.
Other cookies (analytics, marketing): If we implement such tools on the website, we will only install them after obtaining your explicit, voluntary consent via the banner on the website. You can always change your privacy settings in your browser.