PRIVACY POLICY

PiwnicaRowerowa.pl

1. General Information

1.1. This Privacy Policy explains how personal data is collected, used, stored and protected when you visit or use the online store PiwnicaRowerowa.pl (the "Online Store").

1.2. We respect your privacy and are committed to protecting your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, "GDPR") and applicable Polish data protection laws.

1.3. The controller responsible for processing your personal data is:

Janot Sp. z o.o.
Trading as: Piwnica Rowerowa
ul. Przewóz 6/LU
30-716 Kraków, Poland
Tax Identification Number (NIP): 6762545014
Email: Piwnicarowerowa@gmail.com

1.4. You can contact us at the address or email above with any questions concerning this Privacy Policy or the processing of your personal data.

1.5. This Privacy Policy applies to customers, registered users and visitors using the Online Store.

2. Personal Data We Collect

2.1. Depending on how you use our Online Store, we may collect and process the following categories of personal data:

• Full name.

• Email address.

• Telephone number.

• Billing and delivery addresses.

• Company name and Tax Identification Number (NIP), where applicable.

• Order details, purchased products and transaction history.

• Payment-related information and payment confirmation status.

• Information provided when contacting customer support, submitting a complaint, making a warranty claim or returning a product.

• Customer account information, if an account is created.

• Technical information, such as IP addresses, browser and device information, and website usage data.

• Marketing preferences and consent records, where applicable.

2.2. We collect personal data directly from you when you place an order, create an account, contact us, submit a form or otherwise interact with our Online Store.

2.3. We may also receive information from payment providers, delivery companies and other service providers where necessary to process transactions, fulfil orders or provide customer support.

2.4. We do not require customers to provide special categories of personal data, such as health information, for ordinary purchases.

3. Purposes and Legal Bases for Processing Personal Data

3.1. Order Processing and Contract Fulfilment

We process personal data to:

• Accept and process orders.

• Arrange payment and delivery.

• Communicate with customers regarding their purchases.

• Provide customer support related to orders.

• Manage customer accounts and services requested by users.

The legal basis is Article 6(1)(b) GDPR – processing necessary for the performance of a contract or to take steps at the customer's request before entering into a contract.

3.2. Legal and Accounting Obligations

We process certain personal data to comply with applicable legal obligations, including accounting, tax and record-keeping requirements.

The legal basis is Article 6(1)(c) GDPR – compliance with a legal obligation.

3.3. Customer Service, Complaints and Legal Claims

We may process personal data to handle enquiries, complaints, warranty claims, returns and disputes, and to establish, exercise or defend legal claims.

Depending on the circumstances, the legal basis is Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

Where legitimate interests are relied upon, these include responding to enquiries, resolving disputes and protecting our legal rights.

3.4. Website Security and Fraud Prevention

We may process technical information and relevant transaction data to maintain website security, prevent unauthorised access, detect fraud and protect the Online Store against misuse.

The legal basis is Article 6(1)(f) GDPR – our legitimate interest in maintaining the security and reliability of our services.

3.5. Marketing Communications

Where we send marketing communications that require your consent, we process your contact details and marketing preferences on the basis of Article 6(1)(a) GDPR and applicable electronic communications legislation.

Where permitted by law, certain processing related to direct marketing may be based on our legitimate interests under Article 6(1)(f) GDPR, subject to your rights and the applicable consent requirements.

You can withdraw your consent or object to direct marketing at any time.

3.6. Website Analytics and Advertising

Where analytics or advertising technologies process personal data, we will identify the applicable legal basis and obtain any consent required by law.

Non-essential cookies and similar technologies requiring consent will only be used after the relevant consent has been obtained.

4. Sharing Personal Data

4.1. We may share personal data with trusted service providers where necessary for the operation of our Online Store, including:

• Courier companies, postal operators and parcel delivery services.

• Payment processing providers and financial institutions.

• Hosting providers, IT support companies and website maintenance providers.

• Accounting, legal and professional advisers.

• Providers of customer communication, analytics or marketing services, where applicable.

4.2. Personal data is shared only to the extent necessary for the relevant purpose and subject to applicable data protection requirements.

4.3. Where a service provider processes personal data on our behalf, appropriate contractual safeguards are used as required by Article 28 GDPR.

4.4. We may disclose personal data to public authorities where required by applicable law.

4.5. We do not sell customers' personal data.

5. International Data Transfers

5.1. Some service providers may process or access personal data outside the European Economic Area (EEA).

5.2. Where personal data is transferred outside the EEA, we ensure that the transfer is carried out using an appropriate mechanism permitted under GDPR, such as:

• An adequacy decision issued by the European Commission.

• Standard Contractual Clauses approved by the European Commission.

• Other applicable safeguards or derogations permitted by GDPR.

5.3. Information about the safeguards applicable to a specific international transfer can be requested using the contact details provided in Section 1.

6. Data Retention

6.1. We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

6.2. Retention periods depend on the type of information and the purpose of processing, including:

• Order and contract information: retained for the time necessary to fulfil the contract and, where applicable, for statutory record-keeping obligations or legal claims.

• Accounting and tax records: retained for the period required under applicable Polish legislation.

• Customer account data: retained while the account remains active and, where necessary, for a further period justified by legal obligations or claims.

• Customer enquiries and correspondence: retained for the time necessary to resolve the matter and for any applicable legal claims.

• Marketing data: processed until consent is withdrawn, an effective objection is made or the relevant purpose ceases, subject to the retention of necessary evidence of consent or objection.

• Technical and security information: retained for periods proportionate to the purposes of maintaining security and investigating incidents.

• Cookie-related data: retained in accordance with the purposes and lifetimes disclosed in our cookie information.

6.3. Once personal data is no longer required, it will be deleted or anonymised unless continued retention is justified under applicable law.

7. Cookies and Similar Technologies

7.1. Our Online Store uses cookies and may use similar technologies to support website functionality, remember user preferences and, where applicable, measure website performance or deliver advertising.

7.2. Cookies are small text files stored on your device when you visit a website.

7.3. Cookies may be divided into the following categories:

Strictly Necessary Cookies

These cookies are required for essential website functions, such as maintaining shopping basket contents, managing secure sessions and enabling checkout.

They do not require consent where they meet the applicable legal conditions for exemption.

Functional Cookies

These cookies remember certain preferences or provide additional website features. Consent is requested where required by law.

Analytics Cookies

These cookies may help us understand how visitors interact with our Online Store and improve website performance.

Where required by law, analytics technologies are activated only after consent has been obtained.

Marketing Cookies

These cookies may be used to measure advertising effectiveness, support personalised advertising or recognise interactions with advertising campaigns.

Marketing cookies requiring consent are not activated before that consent has been given.

7.4. Where consent is required, you may accept or reject the relevant categories of cookies and change or withdraw your consent using the cookie management options provided on our website.

7.5. You can also manage or delete cookies through your browser settings. Disabling strictly necessary cookies may prevent certain features of the Online Store from functioning correctly.

7.6. Information about the specific cookies and similar technologies used, their providers, purposes and storage periods should be made available through the website's cookie information or consent management interface.

8. Your Rights Under GDPR

8.1. Subject to the conditions and limitations established by GDPR, you have the following rights:

• Right of access: to obtain confirmation of whether your personal data is being processed and request access to that data.

• Right to rectification: to request correction of inaccurate or incomplete personal data.

• Right to erasure: to request deletion of your personal data where the legal conditions are met.

• Right to restriction of processing: to request that the processing of your data be restricted in certain circumstances.

• Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller.

• Right to object: to object to processing based on legitimate interests, including the right to object at any time to the processing of personal data for direct marketing.

• Right to withdraw consent: to withdraw any consent you have given, without affecting the lawfulness of processing carried out before withdrawal.

• Rights relating to automated decision-making: to benefit from the protections provided under Article 22 GDPR where applicable.

8.2. To exercise your rights, please contact us at:

Piwnicarowerowa@gmail.com

8.3. We will respond to your request without undue delay and generally within one month of receiving it. This period may be extended by up to a further two months where permitted by GDPR, taking into account the complexity and number of requests. We will inform you of any such extension and the reasons for it.

8.4. Certain rights may be restricted where continued processing is required by law or another applicable GDPR exception.

9. Right to Lodge a Complaint

9.1. If you believe that your personal data has been processed in breach of GDPR, you have the right to lodge a complaint with a competent supervisory authority.

9.2. In Poland, the supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO)

Website: https://uodo.gov.pl

9.3. You may also have the right to lodge a complaint with a data protection supervisory authority in another EU Member State, particularly in the country of your habitual residence or place of work.

10. Data Security

10.1. We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, alteration, disclosure or destruction.

10.2. These measures may include access controls, encrypted connections, restricted administrative access, system maintenance and other safeguards appropriate to the risks associated with processing personal data.

10.3. Although we take reasonable steps to protect personal data, no method of electronic transmission or storage can be guaranteed to be completely secure.

11. Providing Personal Data

11.1. Providing personal data is generally voluntary.

11.2. However, certain information, such as contact, billing and delivery details, is necessary to process orders, conclude sales contracts and fulfil applicable legal obligations.

11.3. If you do not provide the necessary information, we may be unable to process your order or provide the requested service.

11.4. Providing personal data for optional marketing activities is not a condition of making a purchase.

12. Automated Decision-Making and Profiling

12.1. Information about any automated decision-making, including profiling that produces legal effects concerning individuals or similarly significantly affects them within the meaning of Article 22 GDPR, must reflect the actual processing activities carried out by the Online Store and its service providers.

12.2. Where such processing takes place, the Online Store will provide the information required by GDPR, including meaningful information about the logic involved and the significance and envisaged consequences of the processing.

13. External Websites

13.1. Our Online Store may contain links to websites operated by third parties.

13.2. We are not responsible for the privacy practices of independent third-party websites.

13.3. We encourage you to review the privacy policies of those websites before providing personal information.

14. Changes to This Privacy Policy

14.1. We may update this Privacy Policy to reflect changes in legislation, technology, our services or the way we process personal data.

14.2. The updated version will be published on the Online Store website.

14.3. Where required by applicable law, we will provide additional notice or obtain consent before introducing changes that affect the processing of personal data.

15. Contact Information

For any questions regarding this Privacy Policy or the processing of your personal data, please contact:

Janot Sp. z o.o. – Piwnica Rowerowa
ul. Przewóz 6/LU
30-716 Kraków
Poland

Email: Piwnicarowerowa@gmail.com

Website: PiwnicaRowerowa.pl

Payment and Financing Service Providers

To process payments and provide financing options selected by customers, we may share the personal data necessary for the relevant transaction with the following providers:

• Przelewy24 – electronic payments and payment card processing.

• Allegro – purchases and instalment payment options available through the Allegro platform.

• Santander Consumer Bank – consumer credit and instalment financing.

• Credit Agricole Bank Polska – consumer credit and instalment financing.

Depending on the service, these providers may process personal data as independent data controllers in accordance with their own privacy policies.

The legal basis for processing personal data by Piwnica Rowerowa is Article 6(1)(b) GDPR where processing is necessary to arrange or fulfil a transaction requested by the customer, or another applicable legal basis.

Analytics, Advertising and Cookies

Our Online Store uses the following tools:

• Google Analytics 4 (GA4) – to measure website traffic, understand how visitors use our Online Store and analyse website performance.

• Google Ads – to measure advertising effectiveness, track conversions and evaluate advertising campaigns.

• Meta Pixel – to measure interactions with our website and evaluate advertising performance across Meta platforms, including Facebook and Instagram.

These technologies may collect information such as IP addresses, device and browser information, visited pages, interactions and conversion events.

Where legally required, these tools and their associated cookies or tracking technologies are activated only after the visitor has provided the relevant consent.

Visitors can manage or withdraw their consent through the cookie preference settings available on our website.

Processing based on consent is carried out under Article 6(1)(a) GDPR.

Information may be shared with Google and Meta in connection with the operation of these technologies. Their processing activities and any international transfers are subject to applicable data protection requirements and safeguards.

Automated Decision-Making

Piwnica Rowerowa does not use solely automated decision-making that produces legal effects concerning customers or similarly significantly affects them within the meaning of Article 22 GDPR.

The Online Store uses analytics and advertising measurement technologies provided by Google and Meta. Depending on their configuration, these services may also involve automated analysis of user interactions by the relevant providers.

Marketing Communications

We may send marketing communications where the customer has provided the consent required by applicable law.

Customers may withdraw their marketing consent at any time by contacting us.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.