This Privacy Policy (hereinafter the “Policy”) is of great importance to HOBBY ART TRADE Sp Z.O.O. (hereinafter “Brushme”) and is intended to regulate the relations between us and any natural person, individual entrepreneur or legal entity (hereinafter the “User”) regarding the processing of personal data Brushme may receive from the User in the process of using the Website https://brushme.com/ (hereinafter the “Website”)
The Policy is based on the requirements of the current EU General Data Protection Regulation 2016/679 (hereinafter the “GDPR”) and other applicable European data protection legislation, and is an integral part of the agreement between the User and Brushme regarding the use of this Website.
This Privacy Policy explains how Brushme uses the User’s personal information.
Brushme may collect some of the User’s personal data in the manner and for the purposes described below through this Website.
Brushme values the personal data of each Website User and uses the User’s personal data to provide and improve services.
GENERAL PROVISIONS
Personal data are any information relating to an identified or identifiable natural person.
Personal data controller is a natural or legal person who/which (alone or jointly with other persons) determines the purposes and methods of current or future processing of any personal information. As part of this Policy, Brushme acts as the Controller of the User’s personal data when the User uses the Website.
Processing of personal data is any activity or a number of activities such as collection, registration, accumulation, storage, adaptation, alteration, updating, use and dissemination (distribution, sale, transfer), depersonalisation, destruction of personal data, including with the use of (automated) information systems.
This Policy applies to all personal data of the User that may be obtained by Brushme during the Client’s use of the Website.
The legal basis for processing personal data is the User’s consent in accordance with Article 6 (1), item (a), of the GDPR.
Brushme processes the User’s personal data only if one of the following conditions specified in Article 6 of the GDPR is met, including, but not limited to:
- the User has given consent to processing of personal data;
- processing is necessary for the conclusion or performance of an agreement with the User;
- such processing is required by the legislation of the country in which the User is located.
PERSONAL DATA COLLECTED AND PROCESSED BY BRUSHME AND THE WAY THEY ARE COLLECTED
In order to carry out its activities and perform its obligations, Brushme processes the User’s personal data provided by him/her when using the Website, which are divided into two types.
The first type is personally identifiable information — data the User directly and knowingly provides to Brushme. This includes information the User enters when creating an account, filling out forms on the Website, as well as data the User generates while using the Website, such as feedback, retrospective interactions, actions created, etc.
In the process of using the Website, depending on the situation, Brushme may ask the User to provide the following personal data: full name, email, country, postal code, city, street, building, other notes (optional, provided upon request of the User in the scope determined by him/her).
The second type is non-personally identifiable information — data Brushme collects automatically when the User uses the Website and services. In particular, with each visit to the Website, information about the website user’s device is automatically collected, including: browser type and version; operating system; IP address, time zones, languages. The processing of such information is necessary for viewing the content of the Website. Such information will be deleted after achievement of the purposes for which it was collected. Such data are used only to operate and improve the Website.
PURPOSE OF OBTAINING PERSONAL DATA
The purpose of obtaining and processing personal data is:
- Identification of the registered User on the Website for the purpose of providing the User with access to the personalised resources of the Website and/or creating an account after receiving the User’s consent to the creation of an account.
- Placement of an order and measures aimed at its performance.
- Performance of the agreement where the User is one of the parties, or to take measures upon request of the User before concluding the agreement: Brushme uses the User’s personal data to perform obligations under a sale and purchase agreement, a service agreement or other agreement where the User is one of the parties, as well as to conclude an agreement with a freight forwarding/courier organisation or other third parties, if necessary for Brushme to perform its obligations to the User.
- Marketing purposes, namely, conducting statistical and other research based on depersonalised data, as well as providing the User with information about services, current promotions and special offers related to the services provided by Brushme using the Website.
Brushme processes the User’s personal data for marketing purposes, taking into account the legitimate interests and relations the User has established with the Website.
Brushme may send to the User emails regarding the functionality of the Website or other communications, which may also contain marketing materials related to the Brushme services the User has registered for or is interested in. The processing of the User’s personal data for such marketing tasks will be based on the legitimate interests of Brushme.
In any case, when receiving marketing emails from Brushme, the User as the data subject always has the right to withdraw consent and/or unsubscribe from marketing emails from Brushme at any time. The User may opt out of receiving marketing or promotional materials by following the instructions in Brushme’s marketing emails.
- Improvement of the Website: Brushme uses information about the User’s use of the Website to better understand network behaviour and trends, identify potential outages and technical problems in order to improve the quality of the Website’s services.
- Receiving feedback from the User, including sending messages and requests regarding the use of the Website, provision of services, processing of requests and applications from the User.
- Determining the User’s location for security and fraud prevention.
- Confirmation of the authenticity and completeness of the personal data provided by the User.
- Providing the User with effective customer and technical support in case of problems related to the use of the Website, products and services provided by Brushme.
TERMS OF PERSONAL DATA PROCESSING
6.1. The terms of personal data processing are determined taking into account the purposes of processing, but not longer than the ones defined by the GDPR.
6.4. Brushme may over time minimise the User’s personal data Brushme uses, or even anonymise such data so that they can no longer be personally linked to the User. In such case, Brushme will be able to use such information without further informing the User.
COOKIES
This Website uses cookies or other technologies/tools such as pixels, local storage, tags, identifiers or external services (hereinafter “cookies”) used when the User visits or uses the Website. Cookies are small text files stored by the browser on the User’s device to record certain information or image files, such as pixels. The next time the User visits the Website on the same device, the information stored in the cookies will subsequently be transferred either to the Brushme website (first-party cookies) or to another website to which the cookie belongs (third-party cookies).
Thanks to the stored and returned information, the corresponding website can recognise that the User has already accessed and visited it using the browser used on such device. Brushme uses such information to be able to design and reproduce the Website in an optimal way according to the User’s preferences.
Brushme uses cookies and other tracking technologies on our Website for a number of purposes, including to provide functionality to the Website, improve the user experience, understand online behaviour of people interacting with our Website, and provide advertising to Users taking into account their interests.
Main cookies used by the Website:
“Necessary” coоkies allowing the use of services available on the Website, such as authentication cookies used for services that require authentication on the Website, cookies used for security purposes, such as those used to detect authentication fraud on the Website;
“Functional and analytical” coоkies allowing to “remember” the settings selected by the User and personalise the User’s interface, for example, regarding the User’s selected language or region, font size, appearance of the website and to collect information about how to use the pages of the Website, etc.;
“Advertising” coоkies allowing Website Users to provide advertising content that is more relevant to their interests.
The User can disable cookies by changing his/her browser settings, but this may affect the operation of the Website.
This section provides additional information about the processes and tools of the Website, especially from external partners.
Using Google Analytics
The Website uses the Google Analytics web analytics service from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).
Data processing serves for the analysis of this Website and its visitors, as well as for marketing and advertising purposes. For this purpose, Google will use the information received on behalf of the operator of this website to evaluate the User’s use of the website, compile reports on website activity and provide the website operator with other services related to website activity and use of the Internet. Among other things, the following information may be collected: IP address, date and time of access to the page, click path, information about the browser you use, and the device used by the User, the pages visited, the URL of the referrer (website through which the User accesses the website), location data, purchasing activity.
Google Analytics uses technologies such as cookies, web storage in the web browser and web beacons allowing the analysis of the User’s use of the website. The information generated in such way about the User’s use of this website is usually transmitted to a Google server in the USA and stored there. There is no adequacy decision from the EU Commission for the USA. The transfer of data is based, among other things, on standard contractual clauses as appropriate guarantees for the personal data protection, which can be viewed at https://policies.google.com/privacy/frameworks and https://business. safety.google/adsprocessorterms/. Google and US government authorities have access to User data. Google may associate the User’s data with other data, such as his/her search history, personal accounts, usage data from other devices and any other data Google has about the User.
IP anonymisation is activated on this website. As a result, the User’s IP address will be shortened in advance by Google in the European Union member states or in other member states of the Agreement on the European Economic Area. Only in exceptional cases the full IP address will be transferred to a Google server in the USA and shortened there.
The User’s personal data are processed on the basis of Article 6, paragraph 1, item f, of the GDPR due to Brushme’s overriding legitimate interest in the creation of a needs-oriented website and a targeted design. The User has the right to object to such processing of his/her personal data at any time for reasons related to his/her specific situation.
The User can prohibit Google from collecting the data generated by Google Analytics and related to your use of the website (including the IP address), as well as the processing of such data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout/eula.html?hl=en.
To prevent the collection and storage of Google Analytics data on different devices, the User can install an opt-out cookie. Opt-out cookies prevent future collection of the User’s data when the User visits this website. The User must abandon all systems and devices he/she uses for this to be effective. If the User deletes the opt-out cookie, requests will be sent to Google again. If the User clicks here, an opt-out cookie will be installed: Deactivate Google Analytics.
Further information on the data protection and use terms and conditions can be found at https://www.google.com/analytics/terms/de.html or at
https://policies.google.com/?hl=en&gl=en and at https://policies.google.com/technologies/cookies?hl=en .
Using Retargeting with ad:C Media
Brushme uses the retargeting technology of ad:C Media GmbH (Marktplatz 10, 93128 Regenstauf; “ad:C media”) on our website.
The purpose of the program is to specifically target website visitors who have already expressed an interest in the Brushme store and products with personalised interest-based advertising.
Display of advertisements is based on cookie-based analysis of previous usage behaviour, although no personal data are stored. A cookie file is stored on the User’s computer or mobile device to collect anonymous data about the User’s interests and, thus, to adapt advertisements to the stored information. This means that the User will be shown advertisements that most likely correspond to his/her product and informational interests.
The User’s personal data are processed on the basis of Article 6, paragraph 1, item f, of the GDPR due to Brushme’s overriding legitimate interest in targeting website visitors with interest-based advertising. The User has the right to object to such processing of his/her personal data at any time for reasons related to his/her specific situation.
To prevent the collection and storage of data by ad:C media files on different devices, the User can install opt-out cookies here: https://ad.adc-serv.net/. Opt-out cookies prevent future collection of the User’s data when the User visits this website. The User must abandon all systems and devices he/she uses for this to be effective. If the User deletes the opt-out cookie, requests will be sent to ad:C media again.
Using Facebook Pixel
The website uses the Custom Audiences remarketing function from Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Facebook”).
Meta Platforms Ireland and Brushme are jointly responsible for the collection of the User’s data during the integration of the service and the transfer of such data to Facebook. The basis for this is the agreement between Brushme and Meta Platforms Ireland on the joint processing of personal data, which defines the relevant obligations. The agreement is available at https://www.facebook.com/legal/controller_addendum. After that, Brushme is, in particular, responsible for performing the information obligations under Articles 13 and 14 of the GDPR, for complying with the security requirements under Article 32 of the GDPR regarding the correct technical implementation and configuration of the service, as well as for complying with the obligations under Articles 33 and 34 of the GDPR to the extent the personal data breach affects Brushme’s obligations under the joint processing agreement. Meta Platforms Ireland Limited is responsible for ensuring the rights of affected persons in accordance with Articles 15–20 of the GDPR, complying with the security requirements under Article 32 of the GDPR regarding the security of the service and performing the obligations under Articles 33 and 34 of the GDPR, as a breach of personal data protection affects the obligations of Meta Platforms Ireland under the joint data processing agreement.
The purpose of the program is to target website visitors with interest-based advertising on the Facebook social network. For this, the Facebook remarketing tag is implemented on the website. This tag is used to establish a direct connection to the Facebook servers when the User visits the website. This sends information to the Facebook server about which Brushme pages the User has visited. Facebook assigns this User information to the user’s personal Facebook account. When the User visits the Facebook social network, he/she will be shown personalised interest-based Facebook advertising.
User data may be transferred to the USA. There is no adequacy decision from the EU Commission for the USA. The transfer of data is based, among other things, on standard contractual clauses as adequate guarantees for the personal data protection, which can be viewed at https://www.facebook.com/legal/EU_data_transfer_addendum.
The User’s personal data are processed on the basis of Article 6, paragraph 1, item f, of the GDPR due to Brushme’s overriding legitimate interest in targeting website visitors with interest-based advertising. The User has the right to object to such processing of his/her personal data at any time for reasons related to his/her specific situation. The User can disable the Custom Audiences remarketing function here.
Further information on the collection and use of data by Facebook, the User’s rights in this regard and privacy protection options can be found in Facebook’s data protection information at https://www.facebook.com/about/privacy/.
Using Google Ads Conversion Tracking
Brushme uses the Google Ads online advertising program on our website and conversion tracking (visit action evaluation) in this context. Google Conversion Tracking is an analysis service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
If the User clicks on an advertisement placed by Google, a conversion tracking cookie will be stored on the User’s computer. Such cookies have a limited period of validity, do not contain any personal data and are therefore not used to identify an individual. If the User visits certain pages of the website and the cookie has not yet expired, Google and Brushme can recognise that the User has clicked on an advertisement and been redirected to that page. Each Google Ads client receives different cookies. Therefore, it is not possible to track cookies through the websites of Ads clients.
Information collected by conversion cookies is used to generate conversion statistics. Here, Brushme learns the total number of users who have clicked on one of our ads and have been redirected to a page with a conversion tracking tag. However, Brushme does not receive any information that can be used to identify users.
User data may be transferred to Google LLC servers in the USA. There is no adequacy decision from the EU Commission for the USA. The transfer of data is based, among other things, on standard contractual provisions as adequate guarantees for the personal data protection, which can be viewed at https://policies.google.com/privacy/frameworks
and at https://business.safety.google/adscontrollerterms/.
The User’s personal data are processed on the basis of Article 6, paragraph 1, item f, of the GDPR due to Brushme’s overriding legitimate interest in targeting website visitors with interest-based advertising. The User has the right to object to such processing of his/her personal data at any time for reasons related to his/her specific situation.
The User can turn off personalised advertising for him/herself in the Google advertising settings. Instructions can be found at https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=en&visit_id=638336500691679595-3492828221&rd=1.
In addition, the User can prohibit the use of cookies by third parties by visiting the deactivation page of the Network Advertising Initiative at. Additional information about the opt-out mentioned there can be applied at https://www.networkadvertising.org/choices/. In such case, the User will not be included in the traffic tracking statistics.
Additional information and Google’s privacy policy can be found at https://www.google.com/policies/privacy/.
Using Remarketing or “Similar Target Groups” Function of Google Inc.
Brushme uses the remarketing or “similar target groups” function of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) on our website.
The application serves to analyse visitors’ behaviour and interests. Google uses cookies to analyse website usage, which is the basis for interest-based advertising. Cookies record website visits, as well as anonymous website usage data. Personal data of site visitors are not stored. If you subsequently visit another website on the Google Display Network, the User will be shown advertisements that are likely to take into account the products and information areas the User has previously visited.
User data may be transferred to Google LLC servers in the USA. There is no adequacy decision from the EU Commission for the USA. The transfer of data is based, among other things, on standard contractual clauses as adequate guarantees for the personal data protection, which can be viewed at https://policies.google.com/privacy/frameworks.
The User’s personal data are processed on the basis of Article 6, paragraph 1, item f, of the GDPR due to Brushme’s overriding legitimate interest in targeting website visitors with interest-based advertising. The User has the right to object to such processing of his/her personal data at any time for reasons related to his/her specific situation.
The User can permanently disable the use of Google cookies by visiting the link below and downloading and installing the plug-in provided there: https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=en&visit_id=638336500691679595-3492828221&rd=1.
In addition, the User can prohibit the use of cookies by third parties by going to the deactivation page of the Network Advertising Initiative at https://www.networkadvertising.org/choices/ and applying the additional opt-out information provided there.
Further information on Google remarketing and the corresponding data protection declaration can be found at https://www.google.com/privacy/ads/.
USER RIGHTS AS A PERSONAL DATA SUBJECT UNDER THE GDPR
The Right to Information
Brushme is ready to provide Users with information about which of their personal data are being processed.
If the User wishes to know which of his/her personal data are processed by Brushme, the User can request such information at any time, including by contacting the Administration. The list of data Brushme must provide to the User can be found in Articles 13 and 14 of the GDPR. At the same time, the appealing User must inform Brushme of his/her specific requirements so that Brushme can legally consider the request and give an answer.
In case Brushme is unable to identify the User’s identity through the exchange of electronic messages or when contacting the User by telephone, or in case of reasonable doubts about the User’s identity, Brushme may ask the User to provide an identity document. Only in such way Brushme can avoid disclosing the User’s personal data to a person who can impersonate the User.
Brushme processes requests in the shortest possible time, but at the same time asks to remember that providing a complete and legal answer regarding personal data is a complex process that can last up to a month.
The Right to Correct User Data
If the User discovers that some of the personal data processed by Brushme about him/her are incorrect or out-of-date, the User has the right to inform Brushme about this. In such case, Brushme may ask the User to provide an identity document.
If the User intends to correct the personal data processed by Brushme, he/she can edit them him/herself by logging into his/her personal account in the online service or by contacting the Website Administration.
In some cases, Brushme cannot change the User’s personal data. In particular, this may be the case when the User’s personal data have already been used in the process of performing the agreement and/or they are contained in a tax document executed in accordance with the Tax Law and not subject to correction.
Withdrawal of Consent to the Processing of Personal Data and the Right to be Forgotten
In case Brushme processes the User’s personal data on the basis of consent to the processing of personal data (in particular, for the purpose of marketing/advertising mailings), further processing can be stopped at any time. It is enough to withdraw consent to such processing.
The User can also exercise his/her right to be forgotten. In the cases provided for by Article 17 of the GDPR, Brushme will destroy the User’s personal data it processes, with the exception of personal data Brushme is obliged to keep in accordance with the requirements of the law.
Likewise, in such case, for security purposes, Brushme may ask the User to provide an identity document.
Request to stop processing (the right to limit processing in accordance with Article 18 of the GDPR);
Demand to transfer data to another administrator (the right to transfer data in accordance with Article 20 of the GDPR);
Objection to the processing of his/her personal data (the right to object in accordance with Article 21 of the GDPR).
PERSONAL DATA PROTECTION
Brushme guarantees protection of personal data and confidential information from accidental loss or destruction, from illegal processing, including illegal destruction or access to personal data not provided for by the terms of this Policy.
Brushme uses exclusively safe and secure resources to store confidential information and personal data, including cloud media.
Brushme uses a comprehensive data security program, which includes commercially reasonable administrative, physical and technological security measures, to protect the User’s personal information from unauthorised access, use, unauthorised or accidental destruction, alteration or disclosure.
As a data controller, Brushme takes appropriate technical and organisational measures to ensure that only those personal data that are necessary for each specific processing purpose are processed by default.
PERSONAL DATA EXCHANGE BY BRUSHME
Brushme may provide User data:
- to its employees who need to have access to the data in order to be able to perform our obligations or actions on behalf of the User;
- legal entities processing the User’s personal data on behalf of Brushme and participating in the performance of Brushme’s activities, that is:
- our subcontractors who support Brushme in the performance of contracts, orders and customer service, for example in the processing of correspondence or in the customer service process, or in the operation of sales stores, or other intermediaries in the sale of our products, including services or experts acting on our behalf;
- advertising agencies or other organisations that organise or conduct, or cooperate with, or that are intermediaries in the organisation or conduct of Brushme marketing campaigns;
- organisations operating Brushme’s ICT systems or providing ICT facilities, including IT platforms, or server or website locations;
- legal entities providing Brushme with consulting, advisory, auditing services or legal, tax and accounting assistance;
- research agencies acting on behalf of Brushme;
- entities providing Brushme with services related to the safety of people and property;
- advertising agencies or organisations that conduct or organise, cooperate with or act as intermediaries in the conduct or organisation of Brushme marketing campaigns, or cooperate with in customer service or operation of sales stores or other entities that are intermediaries in the sale of our goods, including services — for the calculation of the salary due to them;
- organisations operating postal and courier services — for the delivery of correspondence or parcels (in particular, DHL Group, General Logistics Systems BV, DPD Dynamic Parcel Distribution GmbH & Co. KG, InPost S.A.);
- organisations carrying out cargo transportation or providing freight forwarding services — for the delivery of cargo shipments;
- entities carrying out payment activities (banks, payment institutions, payment systems, in particular, the Mollie payment system);
- entities carrying out credit activities (banks) — for lending for the purchase of Brushme products;
- insurance companies — for the insurance of cargo transportation;
- business entities purchasing receivables in case of non-payment of the price for the purchased goods or a fee for performing the order on time or other amounts due to Brushme.
CHANGES TO THIS POLICY
1. Any changes Brushme may make to this Privacy Policy in the future will be posted on the Website. New terms may be displayed on screen, and the User may be required to read and accept them in order to continue using any/all Brushme services. Continued use of the Website after such an update will mean that the Website User has agreed to the Privacy Policy and/or any changes made to it by his/her actions.
CONTACT INFORMATION
14.1. For issues of the personal data protection, privacy, or any other questions, comments or suggestions regarding this Policy, please contact us at the email address support@brushme.com