Ladies and Gentlemen,

Protecting your personal data and respecting your right to informational self-determination regarding the collection, processing, and use of your personal data is our highest priority. The following information is intended to familiarize you with the data we collect and process in connection with your use of our websites. Your personal data is safe with us. We believe that reviewing our privacy policy will help you feel safe and enjoy using our websites.

PRIVACY POLICY

  1. This Privacy Policy sets out the principles of processing personal data obtained through the following websites:
    a) website decare.pl ("DeCare Service");
    b) website houseofasia.pl ("HoA Service");
    c) website qualityfood.pl ("QF Service");
    d) website casadelsur.pl ("CDS service");
    (hereinafter referred to together as "Internet Services”) or in connection with the use of the Websites.
  1. The owner of the Websites and the Controller of personal data is De Care Group spółka z ograniczoną odpowiedzialnością i wspólnicy Spółka Komandytowo-Akcyjna with its registered office in Pieńków, at the address: Pieńków 147A, 05-152 Czosnów, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, 14th Commercial Division of the National Court Register under the KRS number 0001175365, Tax Identification Number (NIP): 1180032372, National Business Registry Number (REGON): 01079391000000, hereinafter referred to as "DE CARE" or "administrator".
  2. The Administrator processes personal data received via the Websites in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("Regulation").GDPR

§ 1 Methods of obtaining personal data, purposes and legal basis for their processing

  1. DE CARE collects and processes personal data of natural persons who have provided De Care with their personal data as part of or in connection with the use of the Websites ("Users"), including in connection with creating an account, placing orders, or executing product sales contracts. The privacy policy specifies and explains in detail the legal basis, purposes, and scope of processing personal data obtained from Users.
  2. Users’ personal data are collected or may be collected in the event of:
    a) registering an account on the DeCare Website in order to perform the contract, the subject of which is the provision of a service provided electronically in the scope of creating and maintaining an individual account and enabling the User to use this account.
    Legal basis: the processing of personal data is necessary for the performance of the contract for the provision of the service of maintaining a User Account on the DeCare Website (Article 6, paragraph 1, letter b of the GDPR)
    b) placing an order on the DeCare Website in order to conclude and execute a sales contract for the ordered goods.
    Legal basis: the processing of personal data is necessary for the performance of the sales contract for the ordered goods (Article 6, paragraph 1, letter b of the GDPR)
    c) subscription to the newsletter (Newsletter), in order to perform the contract, the subject of which is the provision of a service provided electronically, as well as to provide the User with advertising and commercial content.
    Legal basis: the processing of personal data is necessary for the performance of the contract for the provision of the Newsletter service (Article 6, paragraph 1, letter b of the GDPR)
    d) communicating with the User in connection with receiving a message from the User via the contact form available on the HoA Website.
    Legal basis: the processing of personal data is necessary to pursue the legitimate interest of the Controller, which is the possibility of contacting and resolving the matter to which the correspondence relates, establishing business relations, and answering the question asked (Article 6, paragraph 1, letter f of the GDPR).
    e) communicating with the User via postal correspondence, e-mail or telephone, including in the case of complaints submitted by Users and conducting correspondence related to the complaint, in order to resolve the matter to which the correspondence or telephone contact relates.
    Legal basis: the processing of personal data is necessary to pursue the legitimate interest of the Controller, which is the possibility of contacting and resolving the matter to which the correspondence relates, establishing business relations, and answering the question asked (Article 6, paragraph 1, letter f of the GDPR).

§ 2 Scope of personal data processed

    1. When registering an account on the DeCare Website, the User provides the following personal data:
      a) name and surname;
      b) mobile phone number;
      c) email address.
    2. In the case of Users who are natural persons conducting business or professional activity on their own behalf, the above scope of data provided when registering an account is additionally extended to include:
      a) address details:
      (i) postal code and city;
      (ii) street with house/apartment/premises number.
      b) the entrepreneur's company;
      c) tax identification number.
    3. When placing an order on the DeCare Website, the User provides the following personal data:
      a) name and surname;
      b) mobile phone number;
      c) email address.
    4. In the case of Users who are natural persons conducting business or professional activity on their own behalf, the above scope of data provided when placing an order is additionally extended to include:
      a) address details:
      (i) postal code and city;
      (ii) street name and house/apartment/premises number;
      (iii) country/province/region.
      b) the entrepreneur's company;
      c) tax identification number.
    5. In the event of contact via the contact form available on the HoA Website, the User shall provide at least the following personal data: name, surname, e-mail address and other personal data to the extent he/she deems appropriate.
    6. If you use the Newsletter service, the User provides an e-mail address.
    7. In the event of communication with the User via post, e-mail or telephone, the User provides the Administrator with personal data to the extent he or she deems appropriate.

§ 3 Who is the data shared or entrusted to?

  1. Users’ personal data are transferred or may be transferred (depending on the circumstances) to service providers used by DE CARE when running the Websites or when handling concluded sales contracts or contracts for the provision of services by electronic means, i.e.:
    a) suppliers providing IT and technical services to the Controller in the field of development and maintenance of accounting IT systems and Websites;
    b) hosting service providers;
    c) entities providing marketing services to the Administrator (including services related to the operation of Websites);
    d) external providers of cookies, plug-ins and other analytical and social media tools;
    e) law firms providing services to the Administrator;
    f) postal operators and courier companies, in the case of Users placing orders via the Websites.
  2. Users' personal data are transferred to the above-mentioned service providers only to the extent necessary to provide the services provided by these providers.
  3. User data may be made available to entities authorized to receive them under applicable law, including the relevant judicial authorities, the President of the Office for Personal Data Protection, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.

§ 4 How long is data stored?

  1. The period of data processing by the Administrator depends on the basis and purpose of processing.
  2. Users' personal data are stored:
    a) if the basis for data processing is the necessity of processing for the performance of a contract, then the User's personal data is processed by DE CARE for as long as necessary to perform the contract, and after that time for a period corresponding to the limitation period for claims or compliance with the Controller's legal obligation (e.g., arising from tax or accounting regulations), as well as for the time needed to comply with legal provisions. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to running a business – three years;
    b) if the basis for the processing of personal data is the User's consent, then the User's personal data are processed by DE CARE until the consent is withdrawn, unless further processing of personal data is necessary for the purposes of the legitimate interests pursued by the Controller or is necessary to fulfill a legal obligation to which the Controller is subject;
    c) if the basis for the processing of personal data is the necessity of their processing for the purposes arising from the legitimate interests pursued by the Controller, then the User's personal data are processed by DE CARE for as long as the Controller's legitimate interest exists constituting the basis for such processing, but no longer than until the User's justified and effective objection is submitted and considered;
    d) if the basis for the processing of personal data is the necessity of their processing to fulfil a legal obligation (including tax or accounting obligations) incumbent on the Controller, then the User's personal data are processed by DE CARE for the period resulting from these legal obligations.

§ 5 Transfer of data outside the European Economic Area

  1. In connection with operating the Websites, the Administrator uses tools and services provided by entities with headquarters or branches both within and outside the European Economic Area. However, the Administrator does not share Users' personal data with these entities, and the use of these tools does not involve sharing data that would identify individuals.

§ 6 Rights of data subjects

  1. The right to withdraw consent to the processing of personal data:
    Legal basis: Article 7(3) GDPR:
    a) The User has the right to withdraw any consent to the processing of personal data given to DE CARE.
    b) Withdrawal of consent takes effect from the moment of withdrawal of consent.
    c) Withdrawal of consent does not affect the processing carried out by DE CARE in accordance with the law before its withdrawal.
    d) Withdrawal of consent does not entail any negative consequences for the User, but may prevent further use of services or functionalities which, according to the law, DE CARE may only provide with consent.
  2. The right to object to data processing:
    Legal basis: Article 21 GDPR
    a) The User has the right to object at any time – for reasons related to his/her particular situation – to the processing of his/her personal data, the basis for which is Article 6 paragraph 1 letter f) of the GDPR (legitimate interest of the Controller).
    b) If the User's objection proves to be justified and the Controller has no other legal basis for the processing of personal data, the personal data subject to the objection will be deleted.
  3. The right to erasure of data ("the right to be forgotten")
    Legal basis: Article 17 GDPR
    a) The User has the right to request the deletion of all or some of his or her personal data.
    b) The User has the right to request the deletion of personal data if:
    (i) the personal data are no longer necessary in relation to the purposes for which they were collected or processed;
    (ii) he/she has withdrawn the consent on which the processing of personal data is based and there is no other legal basis for the processing – to the extent that the personal data were processed based on his/her consent;
    (iii) you have objected to the processing of your personal data for direct marketing purposes – to the extent that the processing is related to such direct marketing;
    (iv) you have objected to the processing and there are no overriding legitimate grounds for the processing;
    (v) personal data were processed unlawfully;
    (vi) personal data must be deleted in order to comply with a legal obligation under European Union law or Polish law;
    (vii) the personal data have been collected in connection with the provision of information society services.
    c) In the event of receiving a justified request (based on at least one of the grounds indicated above) to delete personal data from the User, the Administrator is obliged to delete the personal data covered by the request without undue delay.
    d) Despite the request to delete personal data, DE CARE may retain certain personal data to the extent that processing is necessary for the establishment, exercise or defence of legal claims, as well as for compliance with a legal obligation requiring processing under Union law or the law of the Member State to which DE CARE is subject.
  4. The right to limit data processing
    Legal basis: Article 18 GDPR
    a) The User has the right to request the restriction of the processing of his or her personal data.
    b) The User has the right to request the restriction of the use of personal data in the following cases:
    (i) when he questions the accuracy of his personal data – then the Controller limits their use for the time needed to verify the accuracy of the data,
    (ii) when the data processing is unlawful and instead of deleting the data, the User requests the restriction of their use;
    (iii) when the Controller no longer needs the personal data for processing purposes, but the User needs them to establish, pursue or defend legal claims;
    (iv) when he has objected to the use of his data – until it is determined whether the legitimate grounds on the part of the Controller override the grounds for the User's objection.
  5. The right to access personal data
    Legal basis: Article 15 GDPR
    a) The User has the right to obtain confirmation from the Controller whether he processes personal data, and if so, the User has the right to:
    (i) access your personal data;
    (ii) obtain information on the purposes of processing, the categories of personal data being processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed, (where possible) the planned period for which the personal data will be stored, and, if this is not possible, the criteria for determining that period;
    (iii) obtain information about the right to request the Controller to rectify, erase or limit the processing of personal data, and to object to such processing, about the right to lodge a complaint with the supervisory authority, about the source of information about personal data (if the personal data were not collected from the data subject);
    (iv) obtain information on automated decision-making, including profiling, and – at least in those cases – meaningful information on the principles governing its making, as well as on the significance and envisaged consequences of such processing for the data subject;
    (v) obtain a copy of your personal data.
  6. The right to rectify data
    Legal basis: Article 16 GDPR
    a) The User has the right to request the Controller to immediately rectify any inaccurate personal data concerning them. Taking into account the purposes of processing, the User has the right to request that incomplete personal data be supplemented, including by providing an additional declaration.
  7. The right to data portability
    Legal basis: Article 20 GDPR
    a) The User has the right to receive the personal data concerning him or her that he or she has provided to the Controller in a structured, commonly used and machine-readable format, and has the right to transmit these personal data to another controller without hindrance from the Controller, if the processing is based on consent or in connection with the conclusion of a contract and the processing is carried out by automated means.
    b) When exercising the right to data transfer referred to above, the User has the right to request that personal data be sent by the Controller directly to another controller, if technically possible.
    c) If the User makes a justified request to transfer personal data, the Administrator will comply with the User's request within 30 days from the date of receipt of the request or, within that period, will indicate to the User that it is unable to comply with the request within that period, in which case it will comply with it within the next 60 days.
  8. The right to lodge a complaint with the supervisory authority
    Legal basis: Article 77 GDPR
    a) The User has the right to lodge a complaint with the President of the Personal Data Protection Office regarding the violation of his/her rights to personal data protection or other rights granted under the GDPR.
  9. Method of exercising rights
    a) The User may exercise the rights referred to in this paragraph by using one of the following forms of contact with the Administrator:
    (i) delivery of written correspondence to the following address: Pieńków 147A, 05-152 Czosnów, or
    (ii) sending an electronic message to the following e-mail address: rodo@decare.pl.
    b) When submitting a request to exercise his/her rights, the User should indicate what the request concerns, i.e. in particular:
    (i) which User the request concerns;
    (ii) what right the User wishes to exercise;
    (iii) what processing the request relates to;
    (iv) what personal data the request concerns.
    c) A response to the notification will be provided within one month of its receipt. If an extension of this deadline is necessary, the Administrator will inform the User of the reasons for such extension.
    d) The response will be provided to the email address from which the request was sent or indicated in written correspondence. If the request is submitted in writing (by letter) and the User does not provide an email address for contact, the response will be provided in writing (by letter) to the address provided by the User.

§ 7 Cookie Policy and analytical tools

  1. When Users use websites belonging to De Care (including Websites), Users' personal data may also be collected using cookies, in accordance with the cookie policy adopted by De Care (Cookies Policy), available at: https://qualityfood.pl/polityka-cookies/.
  2. By confirming that he or she has read this Privacy Policy, the User also confirms that he or she has read the Cookies Policy.
  3. The Administrator uses the Google Analytics analytical tool on the QF Website, including the Enhanced Conversions function, for analytical purposes.

§ 8 Contact with the Administrator

    1. Contact with the Administrator is possible via the De Care correspondence address, i.e. Pieńków 147A, 05-152 Czosnów, Poland.
    2. The User may contact the Administrator's data protection team at any time at the following e-mail address: rodo@decare.pl in all matters relating to the processing of personal data, including in particular to obtain answers to questions regarding the protection of personal data.

§ 9 Changes to the Privacy Policy

  1. The privacy policy is constantly reviewed and updated as necessary.
  2. The current version of the Privacy Policy is effective from January 20, 2026.