Privacy Policy of droste.nl

1. Who is the Data Controller?

The Data Controller of your personal data collected via the droste.nl website is Wawel S.A. with its registered office in Krakow, ul. Władysława Warneńczyka 14, 30-520 Krakow, Poland, entered into the business register under KRS: 0000014525, NIP (VAT): PL 6760076868, REGON: 350035154, BDO: 000030591. For matters related to privacy protection, you can contact us directly via email at: iodo@wawel.com.pl.

2. For what purpose, what data, and on what legal basis do we process your data?

We process your data for the following purposes:

• Newsletter delivery: We process your email address to send you commercial information and updates from the Droste brand. The legal basis is your explicit, voluntary consent (Art. 6(1)(a) GDPR). We use a Double Opt-in mechanism to ensure your safety.
• Website operation and security: During your visit, we collect basic technical data (e.g., IP address, browser type) in server log files. We do this on the basis of our legitimate interest to ensure the correct and secure operation of the website (Art. 6(1)(f) GDPR). We do not use automated decision-making, including profiling.

3. Who do we share your data with?

We operate with full transparency. Your data may be transferred only to trusted third parties that support us in providing our services (so-called data processors). These include the hosting service provider for the droste.nl website and the provider of the platform used for the technical dispatch of the newsletter.

4. Data transfer outside the European Economic Area (EEA)

We ensure that your data is fully secure and subject to strict European standards. Wawel S.A. does not transfer your personal data outside the European Economic Area (EEA).

5. How long do we keep your data?

• Newsletter: We process your email address until you withdraw your consent to receive messages from us.
• Technical data (logs): We keep this data only for a short time necessary to ensure security (up to a maximum of 7 days), after which it is deleted or anonymized.

6. What are your rights?

According to the GDPR, you have full control over your data. You have the right to:

• request access to your data and obtain a copy of it,
• request rectification (correction) of inaccurate data,
• request erasure of data (the right to be forgotten),
• request restriction of processing or to object to the processing,
• data portability,
• withdraw your consent to the newsletter at any time (most easily via the "Unsubscribe" link in the message). The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal,
• lodge a complaint with a supervisory authority, e.g., the Dutch Autoriteit Persoonsgegevens (AP) or the Polish Personal Data Protection Office (UODO).

7. Cookie Policy

Our website uses small text files called cookies.

• Essential cookies: These are necessary for the proper functioning of the website and do not require your consent.
• Other cookies (analytical, marketing): If we implement such tools on the website, we will install them only after obtaining your explicit, voluntary consent via a banner on the website. You can always change your privacy settings in your browser.