Privacy policy
Protecting the personal data of our users is a matter of the highest importance to us. We make every effort to ensure that you feel safe entrusting us with your personal data when you use this website.
A "User" means any natural person, legal person, or organizational unit using the electronic services available through this website.
This privacy policy explains the rules and scope of the processing of your personal data, the rights available to you, the obligations of the controller of that data, and how we use cookies.
We apply modern technical and organizational measures designed to ensure a high level of protection for the personal data we process and to guard against access by unauthorized persons.
I. Data Controller
The controller of personal data is:
LOCALGROWTH SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ul. Szczęsna 26, 02-454 Warsaw, Poland Entered in the register of entrepreneurs kept by the District Court in Warsaw, Commercial Division, under KRS number 0000966086 Tax ID (NIP): 5223223277
(hereinafter: the "Owner")
Contact: contact@joinnoya.com
II. Purposes of Processing
We process your personal data in order to:
Operate a customer account. You can create an account in our online store, which lets you view your order history and track the status of current orders. This processing is necessary to perform the account agreement described in our Terms of Service.
Complete your purchase. Your personal data is necessary for us to receive payment, deliver the goods you ordered, issue sales documents, and settle the transaction. We process this data because it is necessary to perform the sales contract and to meet our legal obligations under tax law.
Handle complaints, returns, and withdrawals. If you submit a complaint or return an item, we process your data in order to review and resolve that request. This is necessary to perform the contract and to meet our legal obligations as a seller.
Publish product reviews. We allow customers to add reviews of the products in our store. This processing is necessary to provide that service.
Carry out marketing. We want to understand what you think of our products and services, promote our offers, and provide personalized offers and promotions. We process data from our marketing database on the basis of our legitimate interest.
Profile for marketing purposes. To carry out marketing, we perform profiling that does not affect your rights or freedoms. The basis for this processing is our legitimate interest in promoting our products and services.
Send marketing communications. If you consent to receiving marketing communications, including our newsletter, by electronic or telephone means, we will use your email address and/or phone number to send you commercial offers. The basis for this processing is your voluntary consent, which you may give, for example, by subscribing to our newsletter.
Answer your questions. If you ask us a question or raise a concern, we process your data in order to reply and to give you the best possible experience when dealing with us. The basis for this processing is our legitimate interest in providing complete information and a positive experience.
This means the data is needed in particular to: register on the website, enter into a contract, settle payments, and deliver the goods you ordered.
Personal data is also processed as part of meeting the legal obligations imposed on the controller, including the retention of tax documentation.
Personal data may also be processed for the purposes of direct marketing of our products, and for securing and pursuing claims or defending against claims brought by a User or a third party.
III. Types of Data
We process the following personal data.
Necessary to register on the website:
- first and last name
- email address
Necessary to make a purchase through the website:
- first and last name
- delivery address
- phone number
- email address
Provided optionally by the User:
- date of birth
- company name and tax identification number, where you request a business invoice
IV. Legal Basis for Processing
Where you are located in the European Economic Area or the United Kingdom, personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR").
We rely on the following legal bases:
- Performance of a contract, for orders, delivery, returns, complaints, and account services
- Legal obligation, for tax, accounting, and seller liability requirements
- Legitimate interests, for marketing our own products, profiling for marketing, fraud prevention, securing and pursuing claims, and improving our services
- Consent, for the newsletter, other electronic marketing communications, and non-essential cookies
Where processing is based on your consent, giving that consent is entirely voluntary and you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
V. Your Rights
You may at any time request information from us about the scope of the processing of your personal data.
You may at any time request that we correct or rectify your personal data. You can also do this yourself after logging into your account.
You may at any time withdraw your consent to the processing of your personal data, without giving a reason. A request to stop processing may concern one specific purpose that you indicate, for example withdrawing consent to receive commercial information, or it may concern all processing purposes. Withdrawing consent as to all purposes will result in your account being deleted from the website, together with all personal data previously processed by us. Withdrawal does not affect actions already taken.
You may at any time request, without giving a reason, that we delete your data. A deletion request does not affect actions already taken. Deletion of data means your account is deleted at the same time, together with all personal data saved and processed by us up to that point.
You may at any time object to the processing of your personal data, either in relation to all of your personal data processed by us or only within a limited scope, for example as to processing for one specifically indicated purpose. An objection does not affect actions already taken. Raising an objection will result in your account being deleted together with all personal data saved and processed by us up to that point.
You may request that we restrict the processing of your personal data, either for a defined period or without a time limit but within a defined scope, and we are obliged to comply. Such a request does not affect actions already taken.
You may request that we transfer your processed personal data to another entity. To do so, write to us indicating which entity (name and address) the data should be transferred to and exactly which data you want us to transfer. Once you confirm your request, we will transfer your personal data to the indicated entity in electronic form. Confirmation is necessary for the security of your personal data and to give us certainty that the request comes from an authorized person.
We will inform you of the action taken within one month of receiving any of the requests listed above.
You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
VI. Retention Period
As a rule, personal data is stored only for as long as is necessary to fulfil the contractual or statutory obligations for which it was collected. Data is deleted as soon as its storage is no longer necessary for evidentiary purposes under civil law or in connection with a statutory obligation to retain data.
Information concerning a contract is retained for evidentiary purposes for a period of three years, starting from the end of the year in which the commercial relationship with the User ended. Data is deleted after the statutory limitation period for pursuing contractual claims has expired.
We may also retain archival information concerning completed transactions, since retaining it relates to claims available to you, for example under warranty.
If no contract has been concluded between you and the Owner, your personal data is retained until your account on the website is deleted. Deletion of an account may occur as a result of your request, the withdrawal of your consent to processing, or an objection to that processing.
VII. Entrusting Data to Other Entities and International Transfers
We may entrust the processing of personal data to entities cooperating with us, to the extent necessary to carry out a transaction. This includes our e-commerce platform and hosting providers, payment processors, fulfillment and shipping partners, email and SMS providers, review platforms, advertising and analytics providers, and our professional advisers.
Other than for the purposes set out in this Privacy Policy, personal data will not be shared with third parties or transferred to other entities for the purpose of sending those third parties' marketing materials.
International transfers. Because we serve customers in the United States, personal data is transferred outside the European Economic Area, in particular to service providers located in the United States. Where we make such a transfer, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.
VIII. Cookies and Tracking
We use cookies, pixels, and similar technologies to operate the store, remember the contents of your cart, measure how the site performs, and deliver relevant advertising. This includes advertising and analytics technologies operated by third parties.
You can manage cookies through your browser settings and, where available, through the cookie banner on our site. Blocking essential cookies may prevent parts of the store from working correctly.
We honor Global Privacy Control (GPC) signals where the law requires us to. We do not currently respond to Do Not Track browser signals, as there is no common industry standard for interpreting them.
IX. Privacy Rights for U.S. Residents
Depending on the state in which you live, you may have the right to:
- know what personal information we collect, use, and disclose
- access a copy of that information
- request that we correct or delete it
- opt out of the sale of personal information or of sharing it for targeted advertising
- not be discriminated against for exercising these rights
We do not sell your personal information for money. However, our use of advertising cookies and pixels may qualify as a "sale" or as "sharing for cross-context behavioral advertising" under some U.S. state privacy laws.
To opt out, use the Do Not Sell or Share My Personal Information link in our website footer, or email us at contact@joinnoya.com. You may use an authorized agent where the law permits. We may need to verify your identity before acting on a request.
X. Marketing Communications
You can unsubscribe from marketing emails at any time using the link at the bottom of any message. If you have opted in to SMS, reply STOP to opt out and HELP for assistance. Message and data rates may apply.
Opting out of marketing does not stop transactional messages relating to orders you have already placed.
XI. Children
This website is not directed at children under 16, and we do not knowingly collect their personal data. Our products are intended for adults aged 18 and over. If you believe a child has provided us with personal data, contact us and we will delete it.
XII. Changes and Contact
We may update this Privacy Policy to reflect changes in our practices or for legal reasons. The updated version will be posted on this page with a new "Last updated" date.
For any question relating to your personal data, contact us at contact@joinnoya.com.
This Privacy Policy complies with the requirements of Article 13(1) and 13(2) of the GDPR.