Privacy Policy

Privacy and Cookies Policy of Hevelia Swim & Spa Sp. z o.o.

Information on Data Processing:

  1. The operator of the website and service is Hevelia Swim & Spa Sp. z o.o. with its registered office in Gdańsk, (80-452) Gdańsk, ul. Jana Kilińskiego 7, entered into the National Court Register (KRS) kept by the District Court Gdańsk – Północ in Gdańsk, VII Commercial Division of the KRS under number 0001093876, holding REGON 540748460, NIP 9571183719, and share capital of PLN 10,000.00 (hereinafter: “Hevelia Swim & Spa Sp. z o.o.”)
  2. Trusted partners:
    • Google Ireland Limited (Gordon House Barrow St Dublin 4, Ireland)
    • Google, LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA)
    • Meta Platforms Technologies Ireland Limited (Merrion Road, Dublin 4, Ireland)
    • Meta, Inc.(1601 Willow Road Menlo Park, CA 94025, USA)
    • Apple Inc. (One Apple Park Way, Cupertino, California, USA, 95014)
    • Booksy International sp. z o.o. with its registered office in Warsaw, ul. Prosta 67, 00-838 Warsaw
    • Tomasz Szadkowski WodGuru, with its registered office in Poznań, ul. Katowicka 2c/41, 61-131 Poznań,
    • Other partners whose cooperation is essential for the proper functioning of the application, including payment operators, telecommunications operators in terms of data transfer, etc.
  3. Hevelia Swim & Spa Spółka z ograniczoną odpowiedzialnością takes all measures to guarantee the security of data, including personal data of users visiting the website www.hevelia.spa and their own or other related social media accounts or websites.
  4. The information provided below guarantees the confidentiality of personal data and its proper use.

Personal Data Administrator – Data Protection Officer of Hevelia Swim & Spa Sp. z o.o. and their contact details

Hevelia Swim & Spa Sp. z o.o. has appointed a Data Protection Officer, who can be contacted in all matters concerning the processing of personal data and the exercise of rights related to data processing. If you wish to contact the Data Protection Officer of Hevelia Swim & Spa Sp. z o.o., you may use the following contact details:

Address: Data Protection Officer
Hevelia Swim & Spa Sp. z o.o., Jana Kilińskiego 7, 80-452 Gdańsk
Email address: iod@hevelia.spa

What is the legal basis for processing personal data and for what purposes is personal data processed?

Hevelia Swim & Spa Sp. z o.o. processes and stores users’ personal data in accordance with the provisions of applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

In relation to the provision of services by Hevelia Swim & Spa Sp. z o.o., client/user data (interchangeably: Your data) will be processed for the purpose of:

  • promotion and advertising of activities, products, and services offered by Hevelia Swim & Spa Sp. z o.o. through trusted partners’ applications and through the website www.hevelia.spa for individuals who have given appropriate consent and only to the extent specified by such consent – based on Article 6(1)(a) of the GDPR and no longer than until the consent is withdrawn;
  • conclusion and proper performance of concluded contracts, in particular using the services of Hevelia Swim & Spa Sp. z o.o., making bookings through trusted partners’ websites and through the website www.hevelia.spa, and handling complaints – based on Article 6(1)(a) and (b) and Article 9(2)(a) of the GDPR and no longer than until the claims related to these contracts expire;
  • monitoring activity on the website www.hevelia.spa, in the Hevelia Swim & Spa Sp. z o.o. online store, and on social media accounts maintained by Hevelia Swim & Spa Sp. z o.o., in order to adapt the displayed content to the user’s needs and improve the services provided, which is a legitimate legal interest of Hevelia Swim & Spa Sp. z o.o. – based on Article 6(1)(f) of the GDPR and no longer than until an objection is raised, while in some cases we use profiling for this purpose;
  • making automated decisions concerning the user in individual cases, including decisions based on profiling – only with explicit consent for such action, based on Article 6(1)(a) of the GDPR and no longer than until consent is withdrawn;
  • ensuring the security and proper functioning of the Hevelia Swim & Spa Sp. z o.o. online store and the website www.hevelia.spa, which is our legitimate legal interest – based on Article 6(1)(f) of the GDPR and no longer than necessary for the realization of the indicated purpose or until an objection to data processing is filed, in a situation where the Administrator is unable to demonstrate overriding grounds over the rights and freedoms of the objecting person;
  • determining target groups for advertisements and other user activities using tools for measuring the effectiveness of online marketing activities – based on Article 6(1)(f) of the GDPR and no longer than until an objection is raised;
  • realization of the legitimate interests of Hevelia Swim & Spa Sp. z o.o., including pursuing potential claims, as well as recording and archiving data to protect the legal interest of Hevelia Swim & Spa Sp. z o.o. – based on Article 6(1)(f) of the GDPR and no longer than until an objection is raised. In the case of pursuing claims or protecting the legal interest of Hevelia Swim & Spa Sp. z o.o., we use automated processing, including profiling, but this is necessary for the conclusion or refusal to conclude a contract related to the delivery of ordered products and services.
  • ensuring the possibility of using the functionalities of trusted partners’ applications and full, optimized use of website and online store resources regarding advice on treatments, cosmetic use, exercise, health, nutrition style – based on Article 6(1)(a) and (b) and Article 9(2)(a) of the GDPR and no longer than necessary for the realization of the indicated purpose or until an objection to data processing is filed.

What is the scope, reason, and period of processing your personal data?

Clients’ personal data will be stored for the time necessary to achieve each of the aforementioned purposes. If personal data processing is based on granted consent, the client has the right to withdraw this consent at any time, but this will not affect the lawfulness of processing carried out based on consent before its withdrawal.

Requirement to provide data:

Providing data for the above purposes is necessary for concluding a contract and providing services. If data is not provided, the contract will not be concluded, and the service cannot be provided.

We require you to provide the following personal data to conclude and properly perform the contract with you:

a) first name b) last name, c) address, d) email address, e) login f) password, g) delivery address (only for product orders) h) payment card number/phone number (only for service or product orders).

When using the newsletter:

a) email address b) first name/nickname (optional)

If for some reason you do not provide this personal data, we will not be able to conclude a contract with you, and you will not be able to use our services. If required by law, we may require you to provide other data necessary, e.g., for accounting or tax reasons. Apart from these cases, providing data is voluntary.

Voluntary provision of data:

Providing personal data for marketing purposes is voluntary. If you do not consent to the processing of personal data for marketing purposes, the personal data you leave while using websites, services, and other functionalities, including those saved in Cookies, will not be processed for marketing purposes. Expressing consent to automated decisions being made concerning you in individual cases, including decisions based on profiling, is voluntary.

In addition to the information necessary for the conclusion and performance of any potential contract, you also provide us with:

  • Information from correspondence: you will share some personal data if you contact us via email, as well as using contact forms available on the website or through other means of communication.
  • Information from surveys: if you participate in surveys, you share some personal data as part of your response, unless you respond anonymously.
  • Information you share in your posts: you may share personal data when you post comments via social media or participate in discussions.

Information we collect automatically

Some information is collected automatically as a result of your use of the website or social media profiles belonging to Hevelia Swim & Spa Sp. z o.o., as described in the Cookies section. This information includes, among others:

  1. the Internet Protocol (IP) address of the device from which you access the site (sometimes this can be used to obtain information about the country or city where you are using www.hevelia.spa);
  2. the address of the page visited immediately before visiting www.hevelia.spa;
  3. specific actions taken in the application, including pages visited, streaming, connecting to an AppleID or Meta or Google account, posting a comment, or performing a search;
  4. any search terms you may have entered in trusted partners’ applications;
  5. the time, frequency, and duration of your visits to the service;
  6. the type of your browser and operating system along with the release version;
  7. the type of device from which you access the service, for example – whether you access from a personal computer or a mobile device and the device identifier (ID);
  8. information collected through cookies and similar technologies, as described in the Cookies section;
  9. information about the success or rejection of email delivery to your email provider.

Cookies

  1. To facilitate the use of our service and the website www.hevelia.spa, we use “cookies”. Cookies are small text files that a website places on the user’s disk or in their browser. A cookie usually contains the name of the website it comes from, the “lifespan” of the cookie (i.e., its duration), and a text value assigned by the system generating the cookie.
  2. The service performs functions of obtaining information about users and their behavior in the following ways:
    a) the service automatically collects information contained in cookie files.
    b) through data voluntarily entered by service users in forms available on the service’s pages.
    c) through automatic collection of web server logs by the hosting operator.
  3. During a visit to the service, user data related to the user’s visit to the service may be automatically collected, including, among others, IP address, type of web browser, domain name, number of page views, type of operating system, visits, screen resolution, number of screen colors, addresses of websites from which the service was entered, time of using the service. This data is not personal data and does not allow for the identification of the person using the service.
  4. The service may contain links to other websites. Hevelia Swim & Spa Sp. z o.o. is not responsible for the privacy policies applicable on these sites. At the same time, Hevelia Swim & Spa Sp. z o.o. encourages the user of the service to familiarize themselves with the privacy policy established within these websites.
  5. The entity placing cookie files on the end device of the service user and gaining access to them is Hevelia Swim & Spa Sp. z o.o.
  6. Cookie files are used to:
    • adapt the content of the service’s websites to the user’s preferences and optimize the use of websites; in particular, these files allow recognition of the service user’s device and appropriate display of the website, tailored to their individual needs,
    • create statistics that help understand how service users use websites, which enables improving their structure and content,
    • maintain the service user’s session (after logging in), thanks to which the user does not have to re-enter their login and password on each subpage of the service.
  7. The service uses the following types of cookie files:
    • “essential” cookie files, enabling the use of services available within the service, e.g., authentication cookie files,
    • cookie files used to ensure security, e.g., used to detect abuse,
    • “performance” cookie files, used to obtain information about how users use the service’s websites,
    • “advertising” cookie files, enabling the delivery of advertising content more tailored to users’ interests,
    • “functional” cookie files, enabling the “remembering” of settings selected by the User and adapting the service to the user, e.g., in terms of the selected language.
  8. The service uses two main types of cookie files: “session” cookies and “persistent” cookies. “Session” cookies are temporary files stored on the end device until leaving the website, logging out by the user, or turning off the software (web browser). “Persistent” cookie files are stored on the user’s end device for a period specified in the cookie parameters or until they are deleted by the user.
  9. In the vast majority of cases, software used for browsing websites by default allows the storage of cookie files on the user’s end device. Service users have the option to change cookie settings at any time. These settings can be changed in the options of the web browser (software), among others, in a way that prevents the automatic handling of cookie files or forces the user to be informed each time cookie files are placed on the user’s device. Detailed information on the possibilities and methods of handling cookie files is available in the web browser settings.
  10. Restrictions on the use of cookie files may affect some functionalities available on the website www.hevelia.spa.
  11. Cookie files placed on the user’s end device may also be used by advertisers and partners cooperating with the service owner, to whom they may be transferred with your voluntary consent.

To which recipients will your personal data be transferred?

Data may be transferred to entities processing personal data on behalf of the administrator, including IT service providers, marketing agencies – provided that such entities process data based on an agreement with the administrator and exclusively in accordance with the administrator’s instructions.

User data may also be made available to entities authorized to obtain it under applicable law, e.g., law enforcement agencies, if a request is submitted by the authority on an appropriate legal basis (e.g., for the needs of ongoing criminal proceedings).

Transfer of data outside the European Economic Area

In connection with Hevelia Swim & Spa Sp. z o.o.’s use of Google LLC and Meta Inc. tools in its marketing activities, users’ personal data may be transferred outside the European Economic Area (EEA), including, in particular, to the United States. In accordance with data protection regulations, safeguards that guarantee an adequate level of personal data protection when processing data outside the EEA are ensured by the use of external data processing agreements based on standard contractual clauses approved by the EU. For questions regarding data transfer outside the European Economic Area, please contact the Data Protection Officer.

What are your rights related to the processing of personal data?
You have the following rights in connection with our processing of personal data:

  • the right to access your data, including obtaining a copy of the data,
  • the right to request rectification of data,
  • the right to request erasure of data (in specific situations),
  • the right to request restriction of data processing,
  • the right to data portability, i.e., to receive your personal data from the administrator in a structured, commonly used, machine-readable format.
  • the right to withdraw consent to the extent that it is processed on this basis. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal,
  • the right to object to data processing – if it is carried out for the purpose of realizing the legitimate interests of Hevelia Swim & Spa Sp. z o.o. – for reasons related to the specific situation of the person, i.e., a factual state that did not exist at the time of data collection, if the data was collected directly from the person concerned, or a factual state that existed at the time of data collection but was not known to Hevelia Swim & Spa Sp. z o.o. at the time of data collection not directly from the person concerned;
  • the right to object to data processing – if it is carried out for direct marketing purposes;
  • the right to lodge a complaint with a supervisory authority (the President of the Personal Data Protection Office). To exercise the above rights, please contact the Data Protection Officer.

Final Provisions

This Privacy and Cookies Policy of Hevelia Swim & Spa Sp. z o.o. is regularly reviewed and updated. Any changes to this Privacy and Cookies Policy of Hevelia Swim & Spa Sp. z o.o. are caused by changes in legal regulations or related to changes in the offer of services available at Hevelia Swim & Spa Sp. z o.o. and will be promptly communicated to you by announcement on the website www.hevelia.spa or in an email sent to you via your email account, through your online store account, or via your account in our trusted partners’ application.

The website www.hevelia.spa may contain links or other references leading to external websites or social media services (e.g., YouTube, Meta, Instagram) and Hevelia Swim & Spa Sp. z o.o. profiles on such portals, which do not belong to us. Hevelia Swim & Spa Sp. z o.o. has no influence over and is not responsible for the manner of personal data processing by the owners of these portals, however, with regard to Hevelia Swim & Spa Sp. z o.o. profiles within such services, the Privacy Policy applies accordingly. A person who uses the redirection will also be subject to the privacy and cookies policies published by the administrators of external websites. Please familiarize yourself with these policies. Hevelia Swim & Spa Sp. z o.o. is not responsible for the policies regarding personal data processing of other entities and organizations, social media service providers (e.g., YouTube, Meta, Instagram), operating systems, portals, services, including data disclosed to other entities through these social media services. Hevelia Swim & Spa Sp. z o.o. may have access to certain user data of the aforementioned portals such as age, gender, location, activity on external websites within the Hevelia Swim & Spa Sp. z o.o. profile, which will not allow user identification. This data may be used for advertising purposes, which is a legally legitimate purpose of Hevelia Swim & Spa Sp. z o.o.

Acceptance or non-acceptance of the use of the above data within the aforementioned portals can be done in the account settings in social media services, after logging into the account in a given service – in the privacy tab and settings related to displayed advertisements.

Changes to the Privacy and Cookies Policy

We reserve the right to change and update this Privacy and Cookies Policy of Hevelia Swim & Spa Sp. z o.o.

We will promptly inform application users of any changes.

If you continue to use the website www.hevelia.spa after the changes are introduced, you accept the amended terms. If the changes are significant, we may provide more prominent notice or obtain consent as required by law.

Effective date of this Privacy and Cookies Policy: June 30, 2025