Log in

Price Inquiry
New Cart 0 €

Your cart is empty

Privacy Policy


Published On:

PRIVACY POLICY

TABLE OF CONTENTS

General Provisions
Legal Grounds for Data Processing
Purposes, Legal Grounds and Periods of Processing in the Online Store
Data Recipients and Processors (Processing Entities)
Profiling and Automated Decision-Making
Rights of Data Subjects
Cookies and Analytics (GA4 / Google Ads)
Final Provisions

1. GENERAL PROVISIONS

1.1. This policy is for informational purposes. It explains the rules for processing personal data in the Online Store and the use of cookies and related technologies.

1.2. The controller of personal data is KUPCZYK SPÓŁKA JAWNA, with its registered office in Kraków (ul. Janowa Wola 6, 30-550 Kraków); KRS 0000023316; District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register; NIP 6790025901; REGON 003900098; e-mail: sklep@kupczyk.pl; phone: 665-315-615.

1.3. Data Protection Officer: Robert Nazarewicz, phone: 661-958-373.

1.4. We process data in accordance with the GDPR (Regulation (EU) 2016/679).

1.5. Use of the Store and provision of data are voluntary, with the following exceptions:
(1) when data are necessary to conclude/perform a contract or provide electronic services;
(2) when required by law (e.g. tax/accounting regulations).

1.6. We apply appropriate technical and organizational measures and regularly review and update them.

1.7. Capitalized terms have the meaning assigned to them in the Store Terms and Conditions.

2. LEGAL GROUNDS FOR DATA PROCESSING

We process data when at least one of the legal grounds under Article 6(1) of the GDPR applies: consent (letter a), performance of a contract or pre-contractual actions (letter b), legal obligation (letter c), or the legitimate interest of the controller (letter f).
If we process special categories of data, this is done only in cases provided for in Article 9 of the GDPR (as a rule, this does not apply to ordinary use of the Store).

3. PURPOSES, LEGAL GROUNDS AND PERIODS OF PROCESSING

Purpose of processing | Typical data scope | Legal basis | Retention period

Creation and maintenance of a customer Account
first name, last name, e-mail, password (hash), company details/VAT number (for B2B), order history
Art. 6(1)(b) GDPR
until the Account is deleted or claims related to the Account become time-barred

Placing and processing an order (including “guest” orders)
identification and address data, contact data, VAT number (B2B), order, payment and delivery details
Art. 6(1)(b) GDPR
for the duration of the contract and then for the limitation period of claims

Payment handling (transfer, card, fast payments, instalments/leasing)
payment identifiers, bank account number (in case of refunds), payment tokens, transaction data
processed by the payment operator Autopay S.A. as an independent controller/processor – in accordance with its privacy policy and payment regulations
Art. 6(1)(b) and (f) GDPR
for the period necessary for settlements; in accordance with accounting/tax regulations

Issuing and storing accounting documents
data from invoices/receipts
Art. 6(1)(c) GDPR (legal obligation)
in accordance with regulations – generally 5 years from the end of the tax year

Handling complaints, returns, statutory warranty/manufacturer’s warranty
identification and contact data, description of the claim, photographic documentation
Art. 6(1)(b) and (f) GDPR
for the duration of the procedure and the limitation period of claims

Contact (forms, e-mail, phone)
contact data and the content of the inquiry
Art. 6(1)(f) GDPR
until a response is provided + up to 12 months in the operational archive

Newsletter (Comarch e-Sklep)
e-mail, optionally first name, preferences
Art. 6(1)(a) GDPR (consent)
until consent is withdrawn

Direct marketing of own products (including remarketing via cookies)
cookie identifiers/advertising IDs, visit/event history
Art. 6(1)(f) GDPR; for cookies – consent required by law
until an objection is raised; cookie data according to lifespan and user settings

Statistics and analytics (Google Analytics 4)
anonymized/pseudonymized device/browser identifiers, events
Art. 6(1)(f) GDPR; cookies/analytics – with consent
in accordance with GA4 settings and cookie lifespan

Establishment, pursuit or defense of claims
data necessary to substantiate claims
Art. 6(1)(f) GDPR
until the expiration of the relevant limitation periods (generally 6 years; B2B claims – 3 years)

Note on transfers outside the EEA (e.g. Google):
If a provider is based outside the EEA, transfers take place:
(i) to an entity certified under the EU–US Data Privacy Framework, or
(ii) on the basis of Standard Contractual Clauses and – where required – with additional safeguards.

4. DATA RECIPIENTS AND PROCESSORS

4.1. For the proper operation of the Store, we use services of external entities. We entrust them with data processing under data processing agreements (Article 28 GDPR) or disclose data to them as independent controllers where necessary.

4.2. Categories of recipients/processors (examples):

  • E-commerce/newsletter platform provider: Comarch S.A. (Comarch e-Sklep) – Store maintenance, newsletter distribution.

  • Electronic and card payments: Autopay S.A. (formerly Blue Media S.A.), ul. Powstańców Warszawy 6, 81-718 Sopot, Poland; KRS: 0000320590, NIP: 5851351185 – to the extent necessary for handling electronic/card payments, transaction identification, settlements and fraud prevention.

  • Instalment financing/leasing: e.g. Santander Consumer Bank S.A. (online instalments – if selected), LeaseLink sp. z o.o. – to the extent necessary to verify and conclude a financing agreement.

  • Carriers/warehouses/courier brokers – delivery and logistics.

  • Accounting office, legal advisors/debt collection – fulfillment of obligations and protection of claims.

  • Hosting, e-mail, IT and security providers – maintenance and protection of infrastructure.

  • Marketing and analytics tools: Google Ireland Limited (GA4/Google Ads), Meta Platforms Ireland Ltd. (pixel/conversions) – within the scope accepted in cookie settings.

4.3. We disclose data only when necessary to achieve a specific purpose and only to the minimum extent required.

5. PROFILING AND AUTOMATED DECISION-MAKING

5.1. We may create basic marketing profiles (e.g. audience segments in Google Ads/GA4) based on consent to marketing/analytics cookies.

5.2. Profiling is used to personalize content and offers (e.g. cart reminders, ad targeting). It does not produce legal effects or similarly significantly affect you.

5.3. You may always object to direct marketing or withdraw cookie consents.

6. RIGHTS OF DATA SUBJECTS

You have the right to: access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection (including to direct marketing), and to withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

Contact regarding rights: e-mail sklep@kupczyk.pl or the DPO (section 1.3).

7. COOKIES AND ANALYTICS (GA4 / GOOGLE ADS)

7.1. The Store uses cookies and similar technologies (local storage, pixels). Some are necessary for the operation of the service and do not require consent. For analytics and marketing cookies, we ask for consent via our consent management banner (you can change settings at any time in the footer: “Cookie settings”).

7.2. Categories:

  • Necessary – login, cart, security, payments.

  • Functional – saving preferences.

  • Analytics (GA4) – visit and event statistics; data are aggregated/pseudonymized.

  • Marketing (Google Ads, Meta) – effectiveness measurement and remarketing, frequency capping, ad matching.

7.3. Consent management: via our CMP mechanism and browser settings. Deleting/blocking cookies may limit Store functionality.

7.4. Google Analytics 4 – we use the current GA version, not Universal Analytics. In GA4, you can use the opt-out add-on or disable measurement in the consent banner.

7.5. Legal basis for cookies: regulations on storing/accessing information on a user’s device and the GDPR (consent/legitimate interest).

7.6. Cookie lifespans: according to browser settings and our CMP; details are available in “Cookie settings”.

8. FINAL PROVISIONS

8.1. The Store may contain links to external websites – please review their privacy policies there.

8.2. The Policy may be updated, e.g. for legal or technological reasons. We will inform users of significant changes on the website (and for continuous services – also by e-mail, where appropriate).

8.3. The latest version of the policy is always available on the Store’s website.