Privacy policy
Information on the processing of personal data under Article 13 of the GDPR.
This English version is provided for convenience. In case of any discrepancies, the Polish version prevails.
1. Data controller
The controller of your personal data is Winnica Michalska, [ADRES], NIP (Tax ID): [NIP], REGON: [REGON] (the “Controller”, “we” or “us”).
For any matters relating to personal data, you can contact us by e-mail at [email protected] or in writing at the address above.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
2. What data we process
- contact details: first and last name, e-mail address, phone number;
- data needed to fulfil an order: delivery address, selected products, quantity, pick-up date;
- invoice details, including company name and tax ID — if you request an invoice;
- payment information (amount, status, transaction ID) — we never receive your full card details;
- the content of your correspondence with us;
- basic technical data recorded automatically in server logs (IP address, date and time of visit, browser type).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering questions sent by e-mail | Art. 6(1)(f) GDPR — our legitimate interest in communicating with people who contact us; if the question concerns an order — Art. 6(1)(b) GDPR |
| Concluding and performing the sales contract (accepting the order, payment, pick-up or delivery) | Art. 6(1)(b) GDPR — necessary to conclude and perform a contract |
| Handling complaints | Art. 6(1)(c) GDPR — obligations under the Polish Consumer Rights Act and Civil Code |
| Issuing invoices and keeping accounting records | Art. 6(1)(c) GDPR — obligations under tax and accounting law |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) GDPR — our legitimate interest in protecting our rights |
| Ensuring the security and proper operation of the website (server logs) | Art. 6(1)(f) GDPR — our legitimate interest in keeping our services secure |
4. Recipients of data
We share your data only to the extent necessary for the purposes described above, with:
- our website and e-mail hosting provider — as a processor acting on our behalf;
- Stripe Payments Europe, Limited (Ireland) — the payment operator, which processes payment data as an independent controller under its own privacy policy;
- courier companies — to the extent needed to deliver your parcel;
- our accounting office — to the extent needed for accounting records;
- public authorities — only where required by law.
5. Transfers outside the EEA
As a rule, we process data within the European Economic Area (EEA). Some service providers (e.g. Stripe) may transfer data to third countries, including the USA. Such transfers are based on a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the European Commission.
6. How long we keep data
- correspondence — until the matter is resolved, and then until any claims become time-barred;
- order data — for the duration of the contract, and then until any claims become time-barred;
- accounting documents (e.g. invoices) — for 5 years from the end of the calendar year in which the tax payment deadline expired;
- server logs — for the period set by the hosting provider as necessary to keep the website secure.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15 GDPR);
- rectify your data (Art. 16 GDPR);
- erase your data (Art. 17 GDPR);
- restrict processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing based on legitimate interest (Art. 21 GDPR).
To exercise these rights, write to us at [email protected].
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you believe we process your data unlawfully.
8. Do you have to provide data?
Providing data is voluntary but necessary to conclude and perform the contract — without it we cannot accept or fulfil your order. If you request an invoice, providing the data is required by tax law.
9. Automated decision-making
We do not make automated decisions, including profiling.
10. Cookies
The use of cookies and browser storage is described in our Cookie policy.
11. Changes to this policy
This privacy policy may be updated, for example when the law or the way the website works changes. The current version, with the date of the last update, is always available on this page.