ChemFun Privacy Policy

§1. General provisions

This Privacy Policy defines the rules for processing personal data of users of the ChemFun website and online store available at chemfun.eu.

This Privacy Policy applies in particular to persons visiting the website, browsing the product catalogue, sending contact forms, submitting B2B enquiries, placing online orders, contacting ChemFun by e-mail or phone, submitting complaints, returns or withdrawal statements.

ChemFun makes efforts to ensure that personal data is processed lawfully, fairly, transparently, only to the extent necessary for a specified purpose and for no longer than necessary.

This Privacy Policy is informational in nature. It does not replace the store Terms and Conditions, Cookie Policy, delivery and payment information or documents required for a specific transaction.

This document is a draft and should be reviewed by a lawyer before production publication.

§2. Personal data controller

The personal data controller is:

The Controller decides on the purposes and means of processing personal data of website users, customers and persons contacting ChemFun.

The Controller can be contacted by e-mail, phone or in writing using the details indicated above.

The Controller has not appointed a Data Protection Officer unless this is expressly indicated in the future in this Privacy Policy or in a separate notice on the website.

§3. Actual website status and items to be completed

As of the date of preparation of this version of the document, the ChemFun website operates in a WordPress / WooCommerce environment and uses dhosting hosting.

The hosting provider may process data to the extent necessary to maintain the website, store, databases, technical e-mail, backups, security and server infrastructure.

The electronic payment operator should be indicated after its final selection and configuration. Until then, this Privacy Policy uses the description: electronic payment operator, if online payment is activated.

Newsletter, customer account, analytics tools, marketing tools, remarketing, reCAPTCHA, advertising pixels, maps, external forms or other integrations should be described in detail after confirmation of their actual implementation.

Before publishing the final version, the following should be confirmed with the client or lawyer: payment operator, courier companies, customer account activity, newsletter activity, analytics tools, marketing tools, cookie mechanism, data retention periods and the list of entities with administrative access to the website.

§4. Scope of the ChemFun website

The ChemFun website operates as an online store and B2B technical and sales catalogue for chemical products, industrial chemicals, raw materials, reagents or other products indicated in the catalogue.

The website may enable:

1. browsing the product catalogue,
2. searching for products,
3. viewing product descriptions,
4. contact through a form, e-mail or phone,
5. sending B2B enquiries,
6. placing online orders,
7. handling payments,
8. handling deliveries,
9. handling complaints, returns and withdrawals,
10. obtaining product documentation, if available,
11. creating a customer account, if the function is activated,
12. subscribing to a newsletter, if the function is activated.

The scope of processed data depends on how the website is used. A different scope of data may be processed when only browsing the website and a different scope when placing an online order, sending a B2B enquiry, making a payment, arranging delivery, submitting a complaint or contacting ChemFun.

§5. Categories of processed data

The Controller may process different categories of personal data depending on how the website is used.

Technical data and website usage data

During ordinary website visits, the following may be processed in particular: IP address, cookie identifiers, browser data, device data, operating system data, date and time of visits, addresses of visited subpages, information about the source of entry to the website and technical session data.

Contact details

When contacting ChemFun, the following may be processed: full name, company name, e-mail address, phone number, message content, data provided voluntarily in the message, message sending date and technical data related to the form.

B2B data

In B2B enquiries, the following may be processed: contact person details, company name, tax identification number, company address, e-mail address, phone number, enquiry content, product name, CAS number, expected quantity, preferred packaging, preferred delivery method, delivery address, information about SDS/MSDS documentation and other information necessary to handle the enquiry.

Order data

In online orders, the following may be processed: full name, company name, tax identification number, e-mail address, phone number, billing address, delivery address, invoice details, product data, payment data, delivery data, order status, order notes and order history.

Complaint and return data

In complaints, returns or withdrawals, the following may be processed: contact details, order data, product data, report description, photos, attachments, bank account details for refund, correspondence and information about how the case was handled.

§6. Purposes and legal bases for processing data

Personal data is processed when there is an appropriate legal basis. Depending on the situation, this may be contract performance, steps taken before entering into a contract, legal obligation, user consent or the Controller’s legitimate interest.

The Controller may process data in particular for the following purposes:

1. ensuring proper website operation,
2. ensuring website security,
3. handling contact forms,
4. handling B2B enquiries,
5. preparing offers,
6. fulfilling online orders,
7. handling payments,
8. handling deliveries,
9. issuing invoices and keeping accounting records,
10. handling complaints, returns and withdrawals,
11. providing product documentation,
12. conducting business contact,
13. pursuing or defending claims,
14. fulfilling legal obligations,
15. conducting analytics, if implemented in accordance with required consents,
16. conducting marketing or newsletter communication, if implemented on the proper legal basis.

If processing is based on consent, the user may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

If processing is based on the Controller’s legitimate interest, the user has the right to object to such processing for reasons related to their particular situation.

§7. Contact form

The user may contact the Controller using the contact form available on the website.

The form may require data necessary to handle the message, in particular full name, e-mail address, phone number, company name and message content.

Data submitted through the form is processed to provide a response, handle the enquiry, conduct correspondence, prepare an offer if the message concerns a product or cooperation, and pursue or defend claims if necessary.

Providing data marked as mandatory is necessary to submit the form. Providing additional data is voluntary but may make it easier to handle the case.

§8. B2B enquiries

ChemFun handles B2B enquiries concerning products, availability, prices, packaging, documentation, SDS/MSDS sheets, deliveries and cooperation terms.

As part of a B2B enquiry, the Controller may process the data of the contact person and the data of the company represented by that person.

Data is processed to identify the company, contact the person sending the enquiry, prepare a response, prepare an offer, determine product availability, determine delivery terms, determine payment terms, provide documentation and archive B2B correspondence.

In the case of chemical products, the Controller may process additional information necessary to assess the possibility of handling the enquiry, such as planned product quantity, expected packaging, preferred transport method, information about required documentation or information about intended product use, if necessary to assess the possibility of sale, transport or safety.

§9. Online orders

If the Customer places an online order, the Controller processes data necessary to accept, confirm, handle and fulfil the order.

Data may be processed to accept the order, confirm the order, verify product availability, handle payment, prepare the product for shipping, transfer data to the carrier, issue an invoice, handle contact with the Customer, handle complaints, returns and withdrawals, and archive accounting and tax documentation.

Data required to place an order may include full name, company name, tax identification number, e-mail address, phone number, billing address, delivery address, invoice details, product data, selected payment method, selected delivery method and order notes.

Failure to provide data required in the order form may make it impossible to place the order, fulfil the order, issue a sales document or deliver the product.

§10. Payments

The ChemFun store may offer various payment methods, in particular online payment through an electronic payment operator, traditional bank transfer, cash on delivery or another method agreed individually.

The electronic payment operator will be indicated after final configuration. Until the operator is confirmed, this Privacy Policy uses the term: electronic payment operator.

In the case of online payments, data may be transferred to the payment operator to the extent necessary to handle the transaction.

The Controller may process information about payment status, transaction identifier, amount, payment date and related order.

As a rule, the Controller does not process full payment card details. Payment card data may be handled by the payment operator or bank in accordance with the rules of those entities.

§11. Deliveries

In order to carry out delivery, the Controller may transfer Customer or recipient data to courier companies, logistics operators, pickup point operators or other entities carrying out delivery.

Data transferred for delivery may include recipient full name, company name, delivery address, phone number, e-mail address, order number and information necessary to deliver the shipment.

Delivery data is processed to prepare the shipment, send the shipment, transfer data to the carrier, monitor delivery status, handle transport complaints and contact the recipient regarding delivery.

If delivery requires individual arrangements, the Controller may process additional information concerning the delivery address, contact person, shipment parameters or preferred collection method.

§12. Product documentation, SDS/MSDS and chemical safety

In the case of enquiries about product documentation, the Controller may process data necessary to identify the product and handle the enquiry.

Data may include contact person details, company details, product name, CAS number, packaging or variant, product quantity, type of document required, e-mail address for sending documentation and other information provided in the enquiry.

Data is processed to identify the product, confirm documentation availability, provide documents, handle technical enquiries, fulfil legal obligations concerning product documentation and archive correspondence.

In the case of chemical products, the Controller may process data necessary to assess whether sale, delivery or provision of documentation can be carried out in accordance with regulations, safety requirements and internal procedures.

§13. Invoices, accounting and tax obligations

The Controller processes data necessary to issue invoices, keep accounting records, settle taxes and fulfil obligations resulting from legal provisions.

Data may include full name or company name, address, tax identification number, order data, payment data, sales document data and data required by tax and accounting regulations.

Accounting and tax data is stored for the period required by law.

Failure to provide data required for an invoice may make it impossible to issue an invoice or fulfil the Controller’s legal obligations.

§14. Complaints, returns and withdrawals from the contract

In the case of a complaint, return or withdrawal from the contract, the Controller processes data necessary to accept, review and document the report.

Data may include full name, company name, address, e-mail address, phone number, order number, product data, problem description, photos or attachments, bank account details for refund, correspondence concerning the report and information about how the report was handled.

Data is processed to handle the complaint, return or withdrawal from the contract, contact the Customer, refund funds, fulfil legal obligations and pursue or defend claims.

In the case of chemical products, the Controller may process additional information concerning storage method, packaging condition, method of use or return transport method, if necessary for safe and proper handling of the report.

§15. Customer account and newsletter

Customer account

The store may allow the creation of a customer account if this function is activated. If the customer account is not active, account data is not processed.

A customer account may be used to view order history, save address details, place future orders faster, handle company data and handle information related to orders.

The Customer may request deletion of the account by contacting the Controller. Account deletion does not mean deletion of data that the Controller must store under legal provisions or that is needed to handle invoices, complaints, returns, orders or claims.

Newsletter and marketing communication

If ChemFun launches a newsletter or other marketing communication, the user will be able to subscribe voluntarily, and data will be processed for the purpose of sending communication until consent is withdrawn, the user unsubscribes or the newsletter is discontinued.

Newsletter or marketing communication will be conducted only to the extent necessary to handle that communication and on the proper legal basis, in particular on the basis of consent if required.

The user will be able to unsubscribe from the newsletter in the manner indicated in the message or by contacting the Controller.

§16. Cookies and similar technologies

The ChemFun website uses cookies and similar technologies.

Cookies may be used in particular to ensure proper website operation, cart handling, user session handling, remembering settings, ensuring security, handling forms, keeping statistics, analysing website usage and handling marketing tools if implemented.

Cookies may be necessary, analytical, functional, marketing or external. Detailed information about cookies should be described in a separate Cookie Policy and in the consent mechanism if implemented.

Necessary cookies may be used to the extent required for the operation of the website or provision of a service requested by the user. Analytical, marketing or other cookies not required for website operation should be used in accordance with the user’s consent settings if the law requires consent.

The user may manage cookies through browser settings or through the consent mechanism available on the website, if such a mechanism has been implemented.

Restricting cookies may affect the operation of some website functions, in particular the cart, user session, forms or preference settings.

§17. Analytics, statistics and marketing

ChemFun may use analytics tools such as Google Analytics only if they are implemented and configured in accordance with user consent settings.

ChemFun may use Google Search Console or similar technical tools to analyse website visibility in search engines, perform technical diagnostics and improve website quality.

Analytics tools may collect information about how the website is used, such as number of visits, traffic sources, visited subpages, time spent on the website, website events, device type, approximate location and technical browser data.

ChemFun may use marketing tools, remarketing tools, advertising pixels or conversion tags only if they are implemented and their operation complies with applicable laws and user consent settings.

If the user does not consent to marketing cookies or similar technologies, marketing tools requiring such consent should not be activated.

A detailed list of analytics and marketing tools should be completed after confirmation of the actual website configuration.

§18. WordPress, WooCommerce, hosting and technical infrastructure

The ChemFun website operates on WordPress and WooCommerce.

In connection with the operation of the website, data may be processed by systems, plugins, themes, security tools, hosting and other elements of the technical infrastructure.

Data may be processed in particular to operate the website, operate the store, handle the cart, handle orders, handle forms, ensure security, create backups, update the system, protect against spam and abuse and maintain website stability.

The website hosting provider is dhosting. The detailed legal data of the hosting provider should be confirmed based on the client panel, invoice, agreement or service documentation.

If a specific plugin, tool or provider transfers data outside the European Economic Area, this information should be included after confirmation of the actual website configuration.

§19. Data recipients

Personal data may be transferred to entities that support the Controller in operating the website, store and business.

Data recipients may include in particular:

1. dhosting – provider of website hosting, databases, backups, e-mail or other technical services, to the extent resulting from ChemFun service configuration;
2. e-mail service providers,
3. IT system providers,
4. technical website administrators,
5. providers of WordPress, WooCommerce and related plugins, if they have access to data,
6. electronic payment operator, if online payment is activated,
7. banks,
8. courier companies and logistics operators,
9. pickup point operators, if a given delivery method is activated,
10. accounting tool providers,
11. accounting office,
12. legal advisers,
13. entities handling complaints or service, if applicable,
14. analytics tool providers, if implemented,
15. marketing tool providers, if implemented,
16. newsletter system provider, if the newsletter is launched,
17. public authorities, if data transfer is required by law.

Data is transferred only to the extent necessary to achieve a specific purpose.

Entities processing data on behalf of the Controller should process it on the basis of appropriate agreements or other proper legal bases.

§20. Transfers of data outside the European Economic Area

Personal data may be transferred outside the European Economic Area only if this complies with applicable law.

Transfers of data outside the European Economic Area may occur in particular when using certain external tools, such as analytics, marketing, e-mail, cloud, payment or technical tools.

If ChemFun uses tools of providers that may process data outside the EEA, the transfer takes place only in accordance with mechanisms provided for by the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or other mechanisms provided for by law.

To be completed before publication: list of specific external tools that may involve transfers of data outside the EEA.

§21. Data retention period

Personal data is stored for the period necessary to achieve the purpose for which it was collected, and then for the period resulting from legal provisions, limitation periods for claims or the Controller’s justified needs.

1. Data related to order fulfilment is stored for the period necessary to fulfil the order, handle complaints, returns, settlements, tax and accounting obligations and pursue or defend claims.
2. Accounting and tax data is stored for the period required by law.
3. Data related to complaints, returns and withdrawals is stored for the period necessary to handle the case and then for the limitation period for claims or the period required by law.
4. Data from contact forms and B2B enquiries is stored for the period necessary to handle the enquiry and then for the period justified by the nature of the case, the possibility of continuing B2B contact, limitation periods for claims or legal obligations.
5. Data processed on the basis of consent is stored until consent is withdrawn, the processing purpose ends or it is determined that the data has become outdated, unless there is another basis for further processing.
6. Technical data and server logs are stored for the period necessary to ensure security, diagnose errors and administer the website, and may then be deleted or anonymised.

The cookie storage period depends on the type of cookies and should be described in the Cookie Policy or consent mechanism settings.

§22. Rights of the data subject

The data subject has the rights specified in personal data protection regulations.

The user may request:

1. access to their personal data,
2. receipt of a copy of the data,
3. rectification of data,
4. deletion of data,
5. restriction of processing,
6. data portability,
7. objection to processing,
8. withdrawal of consent if processing is based on consent.

The right to data deletion is not absolute. The Controller may refuse to delete data if further processing is necessary, in particular to comply with a legal obligation, fulfil tax or accounting obligations, handle complaints, pursue or defend claims, ensure security or perform a contract.

To exercise their rights, the user may contact the Controller by e-mail at: office@chemfun.pl.

The Controller may request additional information necessary to confirm the identity of the person submitting the request if there are justified doubts as to their identity.

§23. Complaint to the supervisory authority

The data subject has the right to lodge a complaint with the supervisory authority if they believe that the processing of their personal data violates personal data protection regulations.

The supervisory authority in Poland is the President of the Personal Data Protection Office.

Before lodging a complaint, the user may contact the Controller to clarify the matter or raise concerns regarding data processing.

§24. Final provisions

The Controller may amend this Privacy Policy in the event of changes in law, changes to website functions, changes in the scope of processed data, implementation of new tools, changes of service providers, changes to payment methods, changes to delivery methods, changes to the sales model or the need to clarify information.

The current version of the Privacy Policy is published on the ChemFun website.

If a change to the Privacy Policy requires obtaining additional user consent, the Controller will request such consent in an appropriate manner.

This Privacy Policy applies from the date indicated at the beginning of the document.