Privacy Policy

Publication date: 13.12.2023 update 26.09.2024

LAST UPDATE CONCERNED: Addition of information about the Tawk.to tool

Addition of a record in point 11 DATA RECIPIENTS, 11.2. The recipients of the Customer's personal data are the following entities: 13. imoje, operated by ING BANK Śląski S.A. with its registered office in Katowice.

The website administrator is Agnieszka Przybyszewska, conducting a sole proprietorship under the name "BeBobi Agnieszka Przybyszewska", with its registered office at Janiny Porazińskiej 19 in Poznań, 60-195 Poznań, NIP: 5291698432, e-mail: hello@bebobi.pl .

If you have any questions or concerns regarding the Privacy Policy, you can contact us at any time by sending a message to hello@bebobi.pl

Definitions:

 

1.Personal data – information about a natural person identified or identifiable through one or more specific factors defining physical, physiological, genetic, mental, economic, cultural or social identity, including IP address of the device, location data, internet identifier and information collected via cookies and other similar technology.

2.Policy – this Privacy Policy.

3.GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

4.Service – an internet service operated by the Administrator at www.bebobi.pl .

5.User – any natural person visiting the Service or using one or more services or functionalities described in the Policy.

 

Other terms written with a capital letter are given the meaning contained in the Regulations of the website www.bebobi.pl available here.

 

Most important information

Here is a brief summary of the most important rules related to the protection of your personal data.

• When you create a User Account through the website, place an Order, subscribe to the newsletter, submit a complaint, withdraw from the Agreement or simply contact us, you provide us with your personal data, and we guarantee that your data will remain confidential and secure.
• We only share your personal data with trusted and verified entities providing services to us related to the operation of the Store, the execution of which requires the processing of personal data.
• We use Google Analytics analytical tools, which collect information about your website visits, such as the subpages you viewed, the time you spent on the page, or transitions between individual subpages. For this purpose, cookies from Google LLC regarding the Google Analytics service are used. Within the mechanism for managing cookie settings, you have the option to decide whether we can also use marketing functions within the Google Analytics service or not.
• We use marketing tools such as Facebook Pixel to target ads to you. This involves the use of cookies from Facebook. Within the cookie settings, you can decide whether you consent to our use of Facebook Pixel in your case or not.
• We use Google Ads remarketing tools. This involves the use of cookies from Google LLC regarding the Google Ads service. Within the mechanism for managing cookie settings, you have the option to decide whether we can use Google Ads in your case or not.
• We embed video recordings from YouTube on the website. When you play such recordings, cookies from Google LLC regarding the YouTube service are used.

• We provide the ability to use social functions, such as sharing content on social networks and subscribing to a social profile. The use of these functions involves the use of cookies of social network administrators such as Facebook, Instagram, YouTube, Pinterest.
• We use our own cookies for the proper functioning of the website.

 

If the above information is not sufficient for you, below you will find further details.

 

Personal data administrator

The administrator of your personal data in the understanding of GDPR regulations is Agnieszka Przybyszewska, conducting a sole proprietorship under the name "BeBobi Agnieszka Przybyszewska", with its registered office at Janiny Porazińskiej 19 in Poznań, 60-195 Poznań, NIP: 5291698432..

 

Contact with the Administrator is possible via e-mail address hello@bebobi.pl or correspondence address: BeBobi Agnieszka Przybyszewska, ul. Senatorska 37, 60-326 Poznań.

 

Purposes, legal bases and periods of personal data processing

We indicate them below, separately for each purpose of data processing.

 

 

1.Data processing in connection with the use of the Service

1.1.In connection with the User's use of the Service, the Administrator collects data to the extent necessary to provide individual offered services, as well as information about the User's activity on the Service. Below are described detailed rules and purposes of processing Personal Data collected during the User's use of the Service.

2.Purposes and legal bases of data processing in the Service

USE OF THE SERVICE

2.1.Personal data of all persons using the Service (including IP address or other identifiers and information collected via cookies or other similar technologies), and who are not registered Users (i.e. persons who do not have a Customer Account in the Service), are processed by the Administrator:

2.1.1.for the purpose of providing services electronically in the scope of making content collected in the Service available to Users – then the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR);

2.1.2.for analytical and statistical purposes – then the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in conducting analyses of User activity, as well as their preferences in order to improve the functionalities used and services provided;

2.1.3.for the purpose of possible establishment and assertion of claims or defense against claims – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in the protection of his rights;

2.1.4.for marketing purposes of the Administrator and other entities, in particular related to presenting behavioral advertising – the rules for processing Personal Data for marketing purposes are described in the MARKETING section.

 

2.2.User activity on the Service, including their Personal Data, is recorded in system logs (a special computer program used to store chronological records containing information about events and actions related to the IT system used to provide services by the Administrator). The information collected in the logs is processed primarily for purposes related to the provision of services. The Administrator also processes them for technical, administrative purposes, for the purpose of ensuring the security of the IT system and managing this system, as well as for analytical and statistical purposes – in this regard, the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR).

REGISTRATION IN THE SERVICE

2.3.Persons who register in the Service are asked to provide data necessary for the creation and operation of the Customer Account. In order to facilitate the service, the User may provide additional data, thereby consenting to their processing. Such data can be deleted at any time. Providing data marked as mandatory is required for setting up and operating the Customer Account, and failure to provide them results in the inability to set up an Account. Providing other data is voluntary.

2.4.Personal data is processed:

2.4.1.for the purpose of providing services related to the maintenance and operation of the Customer Account in the Service – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR), and as regards optionally provided data – the legal basis for processing is consent (Article 6(1)(a) GDPR);

2.4.2.for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in conducting analyses of User activity in the Service and how the Account is used, as well as User preferences in order to improve the functionalities used;

2.4.3.for the purpose of possible establishment and assertion of claims or defense against claims – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in the protection of his rights;

2.4.4.for marketing purposes of the Administrator and other entities – the rules for processing Personal Data for marketing purposes are described in the MARKETING section.

2.5.If the User places any Personal Data of other persons in the Service (including their name and surname, address, telephone number or e-mail address), they may do so only on condition that they do not violate legal provisions and personal rights of these persons.

PLACING ORDERS IN THE SERVICE

2.6.Placing an Order by a Service User involves the processing of their Personal Data. Providing data marked as mandatory is required for the acceptance and processing of the Order, and failure to provide them results in the inability to fulfill the Order. Providing other data is optional.

2.7. Personal data is processed:

2.7.1. for the purpose of fulfilling the placed Order – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR); as regards optionally provided data, the legal basis for processing is consent (Article 6(1)(a) GDPR);

2.7.2. for the purpose of fulfilling statutory obligations incumbent on the Administrator, resulting in particular from tax regulations and accounting regulations – the legal basis for processing is a legal obligation (Article 6(1)(c) GDPR);

2.7.3. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in conducting analyses of User activity in the Service, as well as User purchasing preferences in order to improve the functionalities used;

2.7.4. for the purpose of possible establishment and assertion of claims or defense against claims – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in the protection of his rights.

2.7.5. for the purpose of making available to the entity providing IT support in the scope of issuing, maintaining and ensuring access to e-receipts, the customer's phone number or e-mail address, which may be processed for the needs of:

a. verifying whether a given phone number or e-mail address has been registered in the entity's own products and, in the event of positive verification, providing the customer with a view of e-receipts and additional information from the process of their issuance within these products

b. sending SMS messages and other notifications to customers confirming the issuance of an e-receipt to the IT system of the entity providing IT support for e-receipts.

SUBMITTING COMPLAINTS AND WITHDRAWING FROM THE AGREEMENT

2.8.Submitting a complaint by the Service User or withdrawing from the Agreement involves the processing of their Personal Data. Providing data marked as mandatory is required for the acceptance and processing of the complaint and the exercise of the right to withdraw from the Agreement, and failure to provide them results in the inability to perform these services. Providing other data is optional.

2.9.Personal data is processed:

2.9.1.for the purpose of accepting and processing complaints and exercising the right to withdraw from the contract – the legal basis for processing is the necessity of processing for the fulfillment of a legal obligation (Article 6(1)(c) GDPR); as regards optionally provided data, the legal basis for processing is consent (Article 6(1)(a) GDPR);

2.9.2.for the purpose of possible establishment and assertion of claims or defense against claims – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in the protection of his rights.

CONTACT FORMS

2.10.The Administrator provides the possibility to contact them using a dedicated e-mail address for contact and electronic contact forms. Using the form requires providing Personal Data necessary to establish contact with the User and respond to the inquiry. The User may also provide other data to facilitate contact or handling the inquiry. Providing data marked as mandatory is required for accepting and handling the inquiry, and failure to provide them results in the inability to handle it. Providing other data is voluntary.

2.11.Personal data is processed:

2.11.1.for the purpose of identifying the sender and handling their inquiry sent via the provided form – the legal basis for processing is the necessity of processing for the performance of the service contract (Article 6(1)(b) GDPR); as regards optionally provided data, the legal basis for processing is consent (Article 6(1)(a) GDPR);

2.11.2.for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR), consisting in conducting statistics of inquiries submitted by Users via the Service in order to improve its functionalities.

3.Marketing

3.1.The Administrator processes Users' Personal Data for the purpose of carrying out marketing activities, which may include:

3.1.1.sending email notifications about interesting offers or content, which in some cases contain commercial information (newsletter service);

3.1.2.conducting other types of direct marketing activities for goods and services (sending commercial information electronically and telemarketing activities).

3.2.In order to carry out marketing activities, the Administrator sometimes uses profiling. This means that, through automated data processing, the Administrator assesses selected factors concerning Users to analyze their behavior or create a future forecast. This allows for better tailoring of displayed content to the User's individual preferences and interests.

NEWSLETTER

3.3.The Administrator provides a newsletter service to individuals who have provided their email address for this purpose. Providing data is required to provide the newsletter service, and failure to provide it will result in the inability to send it. This form of communication with the User may include profiling.

3.4.Personal data are processed:

3.4.1.for the purpose of providing the newsletter service - the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6 para. 1 lit. b GDPR);

3.4.2.in the case of sending marketing content to the User as part of the newsletter - the legal basis for processing, including with the use of profiling, is the legitimate interest of the Administrator (Art. 6 para. 1 lit. f GDPR) in connection with the expressed consent to receive the newsletter;

3.4.3.for analytical and statistical purposes - the legal basis for processing is the legitimate interest of the Administrator (Art. 6 para. 1 lit. f GDPR), consisting in conducting analyses of Users' activity on the Website to improve the functionalities used;

3.4.4.for the purpose of establishing and pursuing claims or defending against claims - the legal basis for processing is the legitimate interest of the Administrator (Art. 6 para. 1 lit. f GDPR), consisting in protecting his rights.

DIRECT MARKETING

3.5.The User's personal data may also be used by the Administrator to send marketing content through various channels, i.e., via e-mail, MMS / SMS, or telephone. Such actions are taken by the Administrator only if the User has given their consent, which can be withdrawn at any time.

4.Social media

4.1.The Administrator processes the Personal Data of Users visiting the Administrator's profiles on social media (Facebook, YouTube, Instagram, Twitter). This data is processed solely in connection with maintaining the profile, including for the purpose of informing Users about the Administrator's activities and promoting various events, services, and Goods. The legal basis for processing Personal Data by the Administrator for this purpose is their legitimate interest (Art. 6 para. 1 lit. f GDPR), consisting in promoting their own brand.

5. Posting comments

5.1. The Administrator provides the ability to post comments on the Website. Providing data in fields marked as "required field" is voluntary, but failure to provide them will result in the inability to post a comment. Publicly visible data for all Users is: [User's nick / login.

5.2.Personal data are processed:

5.2.1.for the purpose of publishing a comment as part of the functionalities provided by the Administrator - the legal basis for processing is the necessity of processing for the provision of the service (Art. 6 para. 1 lit. b) GDPR);

5.2.2.for the purpose of comment moderation (including spam elimination) and identifying the person posting the published comment - in which case the legal basis for processing is the legitimate interest of the Administrator (Art. 6 para. 1 lit. f GDPR), consisting in approving and publishing comments added by Users.

6.Cookies and similar technology

6.1.Cookies are small text files installed on the device of a User browsing the Website. Cookies collect information that facilitates the use of the website – e.g., by remembering the User's visits to the Website and their actions.

“SERVICE” COOKIES

6.2.The Administrator uses so-called service cookies primarily to provide the User with electronic services and to improve the quality of these services. In this regard, the Administrator and other entities providing analytical and statistical services on their behalf use cookies, storing information or gaining access to information already stored on the User's telecommunications terminal device (computer, phone, tablet, etc.). Cookies used for this purpose include:

6.2.1.cookies with data entered by the User (session ID) for the duration of the session (user input cookies);

6.2.2.authentication cookies used for services requiring authentication for the duration of the session (authentication cookies);

6.2.3.security cookies, e.g., used to detect authentication abuses (user-centric security cookies);

6.2.4.multimedia player session cookies (e.g., flash player cookies), for the duration of the session (multimedia player session cookies);

6.2.5.persistent cookies used to personalize the User interface for the duration of the session or slightly longer (user interface customization cookies).

“MARKETING” COOKIES

6.3.The Administrator and its trusted partners also use cookies for marketing purposes. For this purpose, the Administrator and trusted partners store information or gain access to information already stored on the User's telecommunications terminal device (computer, phone, tablet, etc.).

7.Analytical and marketing tools used by the Administrator's partners

7.1.The Administrator and its Partners use various solutions and tools for analytical and marketing purposes. Below is basic information about these tools. Detailed information on this matter can be found in the privacy policy of the respective partner.

GOOGLE ANALYTICS

7.2.Google Analytics cookies are files used by Google to analyze how the User uses the Website, to create statistics and reports on the functioning of the Website. Google does not use the collected data to identify the User or combine this information to enable identification. Detailed information on the scope and rules of data collection in connection with this service can be found at the link: https://www.google.com/intl/pl/policies/privacy/partners.

GOOGLE ADS

7.3.Google Ads is a tool that allows measuring the effectiveness of advertising campaigns carried out by the Administrator, enabling the analysis of data such as keywords or the number of unique users. The Google Ads platform also allows displaying our ads to people who have visited the Website in the past. Information on data processing by Google in the scope of the above service is available at the link: https://policies.google.com/technologies/ads?hl=pl.

 

FACEBOOK PIXELS

7.4.Facebook pixels are a tool that allows measuring the effectiveness of advertising campaigns carried out by the Administrator on Facebook. The tool enables advanced data analytics to optimize the Administrator's activities, also using other tools offered by Facebook. Detailed information on data processing by Facebook can be found at this link: https://pl-pl.facebook.com/help/443357099140264?helpref=about_content.

SOCIAL PLUGINS

7.5.The Website uses social media plugins (Facebook, Google+, LinkedIn, Twitter, Instagram, Pinterest). The plugins allow the User to share content published on the Website on the selected social media platform. The use of plugins on the Website means that the social media service receives information about the User's use of the Website and can attribute it to the User's profile created on that social media platform. The Administrator has no knowledge of the purpose and scope of data collection by social media platforms. Detailed information on this topic can be found at the links below:

7.5.1.Facebook: https://www.facebook.com/policy.php

7.5.2.Google: https://privacy.google.com/take-control.html?categories_activeEl=sign-in

7.5.3.LinkedIn: https://www.linkedin.com/legal/privacy-policy?_l=pl_PL

7.5.4. Twitter: https://twitter.com/en/privacy

7.5.5. Instagram: https://about.instagram.com/blog/announcements/instagram-community-data-policy

7.5.6.Pinterest: https://policy.pinterest.com/en/privacy-policy

 LIVE COMMUNICATION - CHAT (Tawk.to)

 7.6. tawk.to collects data such as: user's IP address, data related to website interaction (e.g., page browsing, time spent on the page), data provided during chat (e.g., question, contact information). This data is collected to improve customer service and adapt the website's operation to user needs. 

7.7. The collected data may be transferred and processed by Tawk.to in accordance with their privacy policy, which can be found at: https://www.tawk.to/legal/. The user has the right to access, rectify, and delete their data. More information about user rights can be found in the section on personal data protection. 

8.Managing cookie settings

8.1.The use of cookies to collect data through them, including gaining access to data stored on the User's device, requires the User's consent. This consent can be withdrawn at any time.

8.2.Permission is only not required for cookies whose use is necessary for the provision of a telecommunications service (data transmission for content display).

8.3.Withdrawal of consent for the use of cookies is possible through browser settings. Detailed information on this can be found at the following links:

8.3.1.Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

8.3.2.Mozilla Firefox: http://support.mozilla.org/en-US/kb/cookies

8.3.3.Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=en&answer=95647

8.3.4.Opera: http://help.opera.com/Windows/12.10/en/cookies.html

8.3.5.Safari: https://support.apple.com/kb/PH5042?locale=en-GB

8.4.The User can verify the status of their current privacy settings for the browser they are using at any time using the tools available at the links below:

8.4.1.http://www.youronlinechoices.com/en/your-choices

8.4.2.http://optout.aboutads.info/?c=2&lang=EN

9.Personal Data processing period

9.1.The period of data processing by the Administrator depends on the type of service provided and the purpose of processing. As a rule, data are processed for the duration of the service provision or order fulfillment, until the expressed consent is withdrawn or an effective objection to data processing is raised in cases where the legal basis for data processing is the legitimate interest of the Administrator.

9.2.The data processing period may be extended if processing is necessary to establish and pursue any claims or defend against claims, and after this period only if and to the extent required by law. After the processing period, the data is irrevocably deleted or anonymized.

10.User's rights

10.1.The User has the right to access the content of their data and request its rectification, erasure, restriction of processing, the right to data portability, and the right to object to data processing, as well as the right to lodge a complaint with the supervisory authority dealing with Personal Data protection.

10.2.To the extent that the User's data is processed based on consent, this consent can be withdrawn at any time by contacting the Administrator via email at hello@bebobi.pl.

10.3.The User has the right to object to the processing of data for marketing purposes if the processing takes place in connection with the Administrator's legitimate interest, and also - for reasons related to the User's particular situation - in other cases where the legal basis for data processing is the Administrator's legitimate interest (e.g., in connection with the implementation of analytical and statistical purposes).

11.Data recipients

11.1.In connection with the provision of services, Personal Data will be disclosed to external entities, including in particular providers responsible for IT system maintenance, entities such as banks and payment operators, accounting service providers, couriers (in connection with order fulfillment), or marketing agencies (in the scope of marketing services).

11.2.The recipients of the Client's personal data are the following entities:

1)HOSTIDO PL Gałązka Sp.j. with its registered office in Gdańsk for the purpose of storing personal data on the server,

2)MD Target Sp. z o.o with its registered office in Poznań and Fakturownia Sp. z o.o. with its registered office in Warsaw – for the purpose of using the invoicing system where your data is processed if we issue an invoice for you,

3)MD Target Sp. z o.o. with its registered office in Poznań – for the purpose of using accounting services that involve the processing of your data when we issue an invoice for you, and for the purpose of using IT support services that involve the possibility for the service provider to access your personal data.

4)General Logistics Systems Poland Sp. z o.o – in order to use courier services, which involves the processing of your data when we send a parcel to you.

5)FedEx Express Poland sp. z o.o. / DPD / DHL PARCEL / DHL EXPRESS - in order to use courier services, which involves the processing of your data when we send a parcel to you.

6)Inpost Sp. z o.o. - in order to use courier services, which involves the processing of your data when we send a parcel to you.

7)PayU – in order to use the online payment system, which involves the processing of your data when you have chosen the online payment method.

8)PayPal – in order to use the online payment system, which involves the processing of your data when you have chosen the online payment method.

9)Paynow – in order to use the online payment system, which involves the processing of your data when you have chosen the online payment method.

10)Przelewy24 - in order to use the online payment system, which involves the processing of your data when you have chosen the online payment method.

11)PayPo - in order to use the online payment system, which involves the processing of your data when you have chosen the online payment method.

12)Platforma Detalistów sp. z o.o. - in order to handle e-receipts sent by email during order fulfillment.

13) imoje, operated by ING BANK ŚLĄSKI S.A. with its registered office in Katowice.

14) Tawk.to - for live communication (chat) with users and tracking activity on the website.

11.3.Subject to the User's consent, their data may also be shared with other entities for their own purposes, including marketing purposes.

11.4.The Administrator reserves the right to disclose selected information about the User to competent authorities or third parties who request such information, based on an appropriate legal basis and in accordance with applicable law.

11.5.If a comment is added on the Website, the information provided by the User will be made public along with the content of the comment.

12.Transfer of data outside the EEA

12.1.The level of Personal Data protection outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Administrator transfers Personal Data outside the EEA only when necessary, and with an adequate level of protection, primarily through:

12.1.1.cooperation with entities processing Personal Data in countries for which a relevant decision of the European Commission has been issued confirming an adequate level of Personal Data protection;

12.1.2.the use of standard contractual clauses issued by the European Commission;

12.1.3.the use of binding corporate rules approved by the competent supervisory authority;

12.2.The Administrator always informs about the intention to transfer Personal Data outside the EEA at the stage of their collection.

13.Personal Data Security

13.1.The Administrator continuously conducts risk analysis to ensure that Personal Data is processed securely – primarily ensuring that only authorized persons have access to the data and only to the extent necessary due to the tasks they perform. The Administrator ensures that all operations on Personal Data are recorded and performed only by authorized employees and associates.

13.2.The Administrator takes all necessary actions to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures in each case where they process Personal Data on behalf of the Administrator.

14.Changes to the Privacy Policy

14.1.The Administrator reserves the right to change this Policy for important reasons, i.e., in the event of changes in law or technological changes. Each change to the Privacy Policy is published on the Store's website and applies to Orders placed after its effective date.

14.2.The current version of the Policy is effective from September 09, 2024, data dfo