Privacy Policy

The Controller collects and processes your personal data in connection with the use of the online store structurababy.com and the conclusion of contracts with the Company pursuant to Article 6(1) of Regulation (EU) 2016/679 (GDPR), and in particular on the basis of the following grounds:

• Explicit consent provided by you as the customer;
• Performance of the Controller’s obligations under a contract concluded with you;
• Compliance with a legal obligation applicable to the Controller;
• The legitimate interests of the Controller or a third party.

The Controller processes the following categories of personal data and information for the following purposes and on the following legal grounds:

• Your identifying information (email address, name, address, phone number, etc.)

Purpose for which the data is collected: 1) contacting the user and sending information to them, 2) user registration in the online store, 3) sending newsletters, emails with special offers, promotions, promo codes, news, and new functionalities; and 4) responding to inquiries submitted through our website form.

Legal basis for processing your personal data – By accepting the Terms and Conditions and registering in the online store, placing an order without registration, or entering into a written contract, a contractual relationship is established between you and the Controller. On this basis, we process your personal data pursuant to Article 6(1)(b) GDPR.

Your data used for sending newsletters and emails, as well as for responding to inquiries submitted through our website form, is processed based on your explicit consent — Article 6(1)(a) GDPR.

Your data for receiving emails, as well as for responding to inquiries submitted through our website form, is processed based on your explicit consent — Article 6(1)(a) GDPR, and in order to take steps at your request prior to entering into a contract — Article 6(1)(b) GDPR.

Personal data is collected by the Controller from the individuals to whom it relates. The Controller does not carry out automated decision-making using data. The Company does not collect data relating to persons under 18 years of age. When processing and storing personal data, the Controller may also process and store personal data for the purpose of fulfilling its obligations to the National Revenue Agency, the Ministry of Interior, and other state and municipal authorities.

The Controller stores your personal data for no longer than the duration of your account’s existence in the online store or until completion of an order placed as a “guest.” After deletion of your account or completion of the order, the Controller takes the necessary steps to delete and destroy all your data without undue delay or to anonymize it (i.e., convert it into a form that does not reveal your identity).

The Controller stores personal data that it is required to retain under applicable legislation for the legally prescribed period, which may exceed the duration of your online store account or the completion of your order.

The Controller stores the personal data of the legal representatives of its business partners for the duration of the contract, in order to comply with the Controller’s legitimate interests and legal obligations, and this period may exceed the duration of the concluded contract.

The Controller stores your personal data provided in connection with online orders for a period of 5 years for the purpose of protecting the Controller’s legal interests in judicial or administrative disputes with users of the online store, while accounting documents are retained for the legally required retention period.

The Controller will notify you if the retention period of the data needs to be extended due to compliance with a legal obligation or in view of the Controller’s legitimate interests or another reason.

The Controller may transfer part or all of your personal data to personal data processors for the fulfillment of the processing purposes to which you have consented, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

The Controller does not transfer your data to third countries. The Controller will notify you in the event of an intention to transfer part or all of your personal data to third countries or international organizations.

Withdrawal of consent for the processing of your personal data

If you do not wish all or part of your personal data to continue being processed by the Company for a specific or all processing purposes, you may withdraw your consent for processing at any time by completing the form on our website or by submitting a free-form request.

The Controller may request that you verify your identity and confirm that you are the individual to whom the data relates.

Upon withdrawal of consent for the processing of personal data that is mandatory for the creation and maintenance of an account in the online store, your account will become inactive. You will still be able to browse the online store and the offered products and place orders as a guest, or create a new registration.

If you have placed an order that is currently being processed, the earliest moment at which you may withdraw your consent for processing is upon successful completion of the order.

You may withdraw your consent for the processing of your personal data for direct marketing purposes at any time.

Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out by the Controller prior to the withdrawal.

Right of access

You have the right to request and obtain confirmation from the Controller as to whether personal data relating to you is being processed.

You have the right to access the data relating to you, as well as information concerning the collection, processing, and storage of your personal data. Upon request, the Controller shall provide you with a copy of the personal data being processed in relation to you in electronic or another appropriate form. Access to the data is provided free of charge, but the Controller reserves the right to impose an administrative fee in the event of repetitive or excessive requests.

Right to rectification or completion

You may correct or complete inaccurate or incomplete personal data relating to you directly through your profile on the website or by submitting a request to the Controller.

Right to erasure (“right to be forgotten”)

You have the right to request that the Controller erase part or all of your personal data, and the Controller is obliged to erase it without undue delay where one of the following grounds applies:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
• you object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
• the personal data has been processed unlawfully;
• the personal data must be erased for compliance with a legal obligation under EU law or the law of a Member State applicable to the Controller;
• the personal data has been collected in relation to the offering of information society services.

The Controller is not obliged to erase personal data if it stores and processes it:

• for exercising the right of freedom of expression and the right to information;
• for compliance with a legal obligation requiring processing under EU law or the law of a Member State applicable to the Controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
• for reasons of public interest in the area of public health;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
• for the establishment, exercise, or defense of legal claims.

The right to erasure is exercised by submitting a request through the Customer’s account in the online store or via email, together with verification of identity as the account holder. After verifying the identity of the person submitting the request, the Controller deletes all data processed for the Customer, with the exception of their email address and technical information related to the functioning of the online store/contact form that cannot in any way be linked to the identity of the Customer.

If you have placed an order/request that is currently being processed, the earliest moment at which you may request to be “forgotten” is upon successful completion of the order.

Upon deletion of your personal data, your account will become inactive. You will still be able to browse the online store and the offered products and place orders as a guest, or create a new registration.

The Controller does not delete data that it is legally obliged to retain, including for defense against legal claims brought against it or for establishing and defending its legal rights.

Right to restriction of processing

You have the right to request that the Controller restrict the processing of your data where:

• you contest the accuracy of the personal data, for a period allowing the Controller to verify the accuracy of the data;
• the processing is unlawful, but you do not wish the personal data to be erased and instead request restriction of its use;
• the Controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
• you have objected to the processing pending verification of whether the Controller’s legitimate grounds override your interests.

If you exercise your right to restriction, the Company will suspend the processing of your data but will not remove publications you have made in the online store.

Right to data portability

If you have provided consent for the processing of your personal data, or the processing is necessary for the performance of a contract with the Controller, or your data is processed by automated means, you may, after identifying yourself before the Controller:

• request that the Controller provide your personal data in a readable format and transfer it to another Controller;
• request that the Controller directly transfer your personal data to another controller specified by you, where technically feasible.

Right to receive information

You may request that the Controller inform you about all recipients to whom personal data subject to rectification, erasure, or restriction of processing has been disclosed. The Controller may refuse to provide this information if doing so would be impossible or would require disproportionate effort.

Right to object

You may object at any time to the processing of personal data by the Controller.

Your rights in the event of a personal data security breach

If the Controller identifies a personal data security breach that is likely to result in a high risk to your rights and freedoms, it will notify you without undue delay of the breach, as well as of the measures that have been taken or are about to be taken.

The Controller is not obliged to notify you if:

• it has implemented appropriate technical and organizational protection measures regarding the data affected by the security breach;
• it has subsequently taken measures ensuring that the breach is unlikely to result in a high risk to your rights;
• the notification would require disproportionate effort.

For the purposes of processing your personal data and providing the service in its full functionality and in consideration of your interests, the Controller may disclose your data to distributors of the goods for the purpose of delivery to the specified address, with such parties acting as personal data processors. These processors comply with all requirements for lawful and secure processing and storage of your personal data.