Privacy Policy

PROTECTION OF PERSONAL DATA AND PRIVACY POLICY

A data controller for personal data of the Customers / Consumers of the website shop.driftmaters.gp is: Drift Masters Grand Prix Sp. z o.o., hereinafter referred to as the “Data Controller”.

The Data Controller may be contacted:

• by mail at: Drift Masters
  ul. Otolińska 25
  09-407 Płock,
  Poland with the following annotation on the envelope:
  RODO;
• by e-mail at shop@driftmasters.gp.

The Data Controller appointed a Personal Data Protection Officer, who may be contacted:

• by mail at the above address;
• by e-mail at the above address.

The Customer’s personal data are processed by the Data Controller to:

• take actions requested by the Customer before the agreement date;
• enter into and perform the agreement for a period necessary to perform the agreement and make related settlements;
• fulfil the Data Controller’s legal obligations on the basis of the GDPR POLICY, including:
  • a) obligations under the statutory defect warranty - during the period of liability under the statutory defect warranty;
  • b) obligations connected with the withdrawal from or termination of the agreement - by the expiry of a period of limitation of claims thereunder;
  • c) obligations connected with the issue and retention of invoices and documents required by tax law and accounting regulations - by the invoice or other document date and then for the retention period set out by tax and accounting regulations;
  • d) the retention of data to prove that settlement and other obligations stemming from personal data protection regulations have been met - for the term of related liability;
• meet legitimate interests of the Data Controller, existing in the case of:
  • a) the identification, defence and pursue of claims - by the expiry of a period of limitation of claims arising from the agreement or actions taken by the Data Controller in connection with the agreement or requests made before the agreement date (no more than 10 years from the completion of the agreement or requests made before the agreement date or from the issue of a valid court ruling);
  • b) the development of lists, analyses and statistics for the Data Controller’s internal purposes, including in particular reporting, product development tests and planning, service development and quality improvement plans, R&D in IT systems - during such actions before the agreement date and until the completion of the agreement, and then no longer than by the expiry of a period of limitation of claims under such an agreement or actions taken by the Data Controller in connection with the agreement or requests made before the agreement date;
  • c) the assurance of safety of networks and information - for the whole data retention period, i.e. by the expiry of a period of limitation of claims under the agreement or actions taken by the Data Controller in connection with the agreement or requests made before the agreement date and by the expiry of the Data Controller’s liability for settlements and other obligations imposed by personal data protection regulations;
  • d) Customer service support, including its adjustment to needs arising from orders, complaints, requests - for the whole term of the agreement or until the completion of actions taken at request before the agreement date;
  • e) marketing purposes, including profiling, i.e. to deliver information about promotions, products and services, events, actions and the Data Controller’s special offers - for the whole term of the agreement until the completion date; f) protection against attempted frauds - during related proceedings.

The Customer’s personal data are given voluntarily. The Customer is not obliged to give any data and the delivery of such data is not obligatory by law and is solely a contractual obligation. Personal data may be given solely if the Customer agrees and at the Customer’s discretion. However, personal data may be necessary to:

• A. make and perform the Order;
• B. issue an invoice and make tax settlements;
• C. create the Account;
• D. send the Newsletter to the Customer;
• E. handle, review and resolve the Customer’s complaints and statements of withdrawal and perform related obligations of the Data Controller;
• F. handle and arrange matters requested by the Customer before the agreement date or after the termination of the agreement;
• G. in the case of optional data - it may be impossible, for example, to contact the Customer in the defined optional way or to refund amounts due into the Customer’s bank account. H. The Customer’s personal data may be shared by the Data Controller with:
  • the Data Controller’s employees and business partners who must access the Customer’s data to fulfil the Data Controller’s obligations or perform actions on behalf of the Data Controller for Customers;

• • entities processing the Customer’s personal data on the Data Controller’s behalf and taking part in activities performed by the Data Controller, i.e.:
    • a) subcontractors supporting the Data Controller in the performance of agreements, orders and customer service, e.g. by handling correspondence or customer service process or operating shops, or other entities taking part in the sale of products and services, or experts acting at the Data Controller’s request;
    • b) advertising agencies or other entities organising or handling or cooperating or acting as an intermediary in the organisation or operation of the Data Controller’s marketing actions;
    • c) entities operating the Data Controller’s telecommunications and IT systems or providing telecommunications and IT tools, including IT platforms, or place in the servers or on websites to the Data Controller;
    • d) entities providing advisory, consultation, audit or legal, tax or book-keeping services to the Data Controller;
    • e) R&D agencies acting at the Data Controller’s request;
    • f) entities providing the Data Controller with security services in relation to people and property;
    • g) other data controllers being:
      • advertising agencies or other entities organising or handling or cooperating or acting as an intermediary in the organisation or operation of the Data Controller’s marketing actions;
      • entities carrying out post office or courier activity - to deliver correspondence or parcels;
      • entities providing transport or freight forwarding services - to deliver Goods;
      • entities carrying out payment activity (banks, payment institutions) - to make refunds or provide direct debit;
      • entities carrying out lending activities (banks) - to offer loans for the purchase of goods, including services and returns;
      • insurance companies - to insure the shipment of Goods;
      • entities buying debts - if the price of the Goods bought or a fee for the order is not paid on time or other amounts due to the Data Controller are not settled.

The Customer / Consumer has:

• the right of access to data, including information about personal data, and the right to receive copies of such data;
• the right of rectification if personal data are incorrect and the right of supplementation of incomplete data;
• the right of erasure;
• the right to restrict the personal data processing;
• the right to data portability;
• the right to lodge a complaint with a personal data protection authority, i.e. the Personal Data Protection Office if the personal data processing is found to be violating personal data processing regulations.

The withdrawal of the consent is without prejudice to the compliance of data processing based on the consent given before such withdrawal.

The Customer has the right to object against the processing of the Customer’s personal data:

• for marketing, including profiling, purposes;
• for purposes resulting from the Data Controller’s legitimate interest other than marketing on grounds relating to the Customer’s particular situation.

The Customer / Consumer may exercise the above rights at any time by making a relevant request.

The Customer / Consumer may submit the above requests to the Data Controller by delivering a written statement:

• by e-mail to shop@driftmasters.gp
• in writing to: Drift Masters Płock 09-407, ul. Otolińska 25 with the annotation: RODO.

The Data Controller must inform the Customer / Consumer about actions taken in connection with such requests without unnecessary delay, however no later than within one month of the receipt of the request. If necessary, this time limit may be extended by further two months given the complicated nature of the request or the number of requests.

If the Data Controller fails to take actions connected with the Customer’s / Consumer’s request, as mentioned above, it must immediately, however no later than within one month of the receipt of the request, inform the Customer about reasons for the actions not being taken and about the Customer’s right to lodge a complaint with the Chairman of the Personal Data Protection Office and to use legal measures before courts.

If the Data Controller has reasonable doubts concerning the identity of the Customer / Consumer in connection with the request, the Customer may be asked to give additional information that are necessary for identification purposes.

The Data Controller will submit the information mentioned above in writing at the Data Controller’s discretion:

• by registered mail to the address given by the Customer, or
• by e-mail to the e-mail address given by the Customer, unless: a. the Customer sent its request by e-mail and did not request information from the Data Controller in any other form - then the Data Controller will send the information to the Customer’s e-mail address; b. the Customer requested information from the Data Controller and was identified otherwise - then the Data Controller will provide information verbally.

Communication and actions taken by the Data Controller in connection with the Customer’s requests are free of charge. However, if the request is clearly unreasonable or excessive, e.g. given its constant character, the Data Controller may:

1. a) charge a reasonable fee, including administrative costs of response, communication or necessary actions; or
2. b) refuse to take actions in relation to the request.

The Data Controller will inform each recipient to whom the Customer’s data were disclosed about the rectification or supplementation or erasure or limitation of processing of the Customer’s personal data at the Customer’s request. The Data Controller does not need to submit such information only if it is impossible (e.g. a company was liquidated) or is connected with disproportional efforts (the data were disclosed many years ago and it was not possible to establish a contact with the recipient despite of attempts).

At the Customer’s / Consumer’s request, the Data Controller will inform the Customer / Consumer about recipients that were informed about the rectification or erasure or limitation of processing of the Customer’s personal data and recipients that the Data Controller did not manage to notify.

SPECIAL ADDENDUM FOR CALIFORNIA RESIDENTS: CALIFORNIA CONSUMER PRIVACY ACT (CCPA)

In reference to the obligations imposed by the California Consumer Privacy Act of 2018 ("CCPA"), we hereby inform that these provisions exclusively concern residents of the State of California and apply to the extent that the Personal Data Administrator processes personal data of California residents.

A. In accordance with CCPA, California residents have the following rights regarding personal data processed by the Administrator:

• California residents have the right to request the Administrator disclose the categories and specific pieces of personal data collected, the sources from which the personal data are collected, the purposes for which the personal data are processed, and the categories of third parties with whom the data is shared, in the twelve (12) months preceding the request date.
• California residents have the right to obtain a copy of personal data processed by the Administrator in the twelve (12) months preceding the submission of the request.
• California residents have the right to request the deletion of any personal data processed by the Administrator, subject to certain exceptions provided by law.
• California residents have the right to prohibit the Administrator from selling their personal data. The Administrator commits to providing the possibility to exercise this right by placing an appropriate mechanism on their website.

B. To exercise the above rights, a California resident may contact the Administrator through one of the communication channels specified in the main part of the Privacy Policy. The Administrator commits to confirming receipt of the request within ten (10) business days and to providing a response within forty-five (45) business days from the date of confirmation.

C. The Administrator commits to not discriminating against any user for exercising their rights under the CCPA, including by refusing services, changing prices, or altering the quality of services.