GDPR information notice

The following information is a concise, comprehensible and transparent summary of information about the data Administrator, the purposes and methods of processing personal data and the rights of data subjects. Detailed information on the processing of personal data is available in the Privacy Policy.

Who is the data controller?

The Personal Data Administrator (hereinafter: the "Administrator") is ZPH „Piokal” Alicja Ostrowska, ul. Żurawiec 2, 32-500 Chrzanów, Poland, NIP (tax ID): 6280005472, conducting business activity and providing services via the piokal.pl Website.

How can you contact the data controller?

You can contact the Administrator as follows:

Postal address – ZPH „Piokal” Alicja Ostrowska, ul. Żurawiec 2, 32-500 Chrzanów, Poland
E-mail address – [email protected]

Has the Administrator appointed a Data Protection Officer?

The Administrator has not appointed a Data Protection Officer.

For matters concerning data processing, including personal data, please contact the Administrator directly.

Where do we obtain personal data from and what are its sources?

Personal data is obtained primarily directly from data subjects, in particular when:

registering and using a User account,
placing and fulfilling orders,
contacting the Administrator,
subscribing to the newsletter or giving other marketing consents,
using the functionalities of the Website.

Some technical data, such as the IP address, information about the device, browser or the way the Website is used, may also be collected automatically in connection with the use of the Website.

What personal data do we process?

The Website processes ordinary personal data, provided voluntarily by data subjects or obtained in connection with the use of the Website.

Depending on the functionality used, this may include in particular: first and last name, company name, tax ID (NIP), address, e-mail address, telephone number, login, order data and technical data such as the IP address.

The detailed scope of the data processed is available in the Privacy Policy.

For what purposes do we process personal data?

Personal data may be processed for the following purposes:

registering and maintaining a User account and providing the related functionalities,
accepting, handling and fulfilling orders placed electronically,
handling payments related to orders,
contacting Users and handling enquiries,
handling complaints and establishing, pursuing or defending claims,
fulfilling tax, accounting and other legal obligations,
providing the newsletter service and conducting direct marketing – where required, on the basis of consent given,
ensuring the security of the Website, preventing abuse and compiling statistics and analyses on the functioning of the Website,
handling loyalty programmes, gamification or other functionalities assigned to the User account, if available on the Website.

What are the legal bases for data processing?

Personal data is processed primarily on the basis of:

Art. 6(1)(a) GDPR – where the data subject has consented to the processing of data for a specific purpose, e.g. for marketing purposes or the newsletter;
Art. 6(1)(b) GDPR – where processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract, in particular to fulfil an order or maintain an account;
Art. 6(1)(c) GDPR – where processing is necessary for compliance with a legal obligation to which the Administrator is subject, in particular tax and accounting obligations;
Art. 6(1)(f) GDPR – where processing is necessary for the purposes of the legitimate interests pursued by the Administrator, such as ensuring the security of the Website, handling enquiries, conducting analyses and statistics, establishing or defending claims and direct marketing to the extent permitted by applicable law.

Data processing is governed in particular by the GDPR, the Polish Act of 10 May 2018 on the Protection of Personal Data and – to the extent applicable – the Polish Electronic Communications Law of 12 July 2024.

What legitimate interest does the Administrator pursue?

The Administrator's legitimate interest may include in particular:

establishing, pursuing or defending claims,
ensuring the security of the Website and preventing abuse,
compiling statistics and analyses on the functioning of the Website,
handling enquiries and correspondence with Users,
direct marketing of its own products or services to the extent permitted by applicable law.

How long do we process personal data?

The data retention period depends on the purpose and legal basis of processing.

Data related to the User account is, as a rule, processed for as long as the account is used and, after its deletion, for the period necessary to secure any claims or to fulfil legal obligations.
Data related to orders, settlements and accounting records is stored for the period required by applicable tax and accounting regulations.
Data processed on the basis of consent is processed until consent is withdrawn, unless there is another legal basis for further processing.
Data processed on the basis of the Administrator's legitimate interest is processed until that interest ceases or an effective objection is lodged, if such an objection should be taken into account under the GDPR.
Data on activity history, orders or loyalty and gamification programmes may be stored for as long as the account is used, if necessary to provide these functionalities.

Who are the recipients of data, including personal data?

Personal data may be transferred to entities supporting the Administrator in running the Website and fulfilling orders, only to the extent necessary for them to provide their services.

Such entities may include in particular:

providers of hosting, servers and IT services,
providers of e-mail and newsletter services,
online payment operators, in particular PayPro S.A. or Autopay S.A. – if the selected payment method requires the use of their services,
providers of accounting services,
courier and postal companies or other entities delivering orders,
providers of analytical, marketing or other tools used on the Website – if such tools are used.

Will personal data be transferred outside the European Economic Area?

Because the Administrator uses the services of certain technology providers, personal data may in certain cases be processed outside the European Economic Area. Where such a transfer takes place, it complies with the requirements of the GDPR, in particular on the basis of an appropriate transfer mechanism provided for in Chapter V of the GDPR. Detailed information about the providers used can be found in the Privacy Policy.

Will personal data be used for automated decision-making?

Personal data is not used to make decisions about Users based solely on automated processing which would produce legal effects concerning them or similarly significantly affect them.

What rights do you have in connection with the processing of personal data?

Data subjects have the following rights, in the cases specified in the GDPR:

Right of access – the right to obtain information about the processing of data and to receive a copy of it.
Right to rectification – the right to have inaccurate data corrected and incomplete data completed.
Right to erasure – the right to request the erasure of data in the cases specified in Art. 17 GDPR.
Right to restriction of processing – the right to request restriction of processing in the cases specified in Art. 18 GDPR.
Right to data portability – the right to receive data in a structured, commonly used and machine-readable format, if the conditions of Art. 20 GDPR are met.
Right to object – the right to object to the processing of data based on Art. 6(1)(f) GDPR, in the cases specified in Art. 21 GDPR.
Right to withdraw consent – if processing is based on consent, it can be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
Right to lodge a complaint – if the data subject considers that their data is being processed unlawfully, they may lodge a complaint with the President of the Personal Data Protection Office (PUODO, the Polish supervisory authority).

To exercise your rights, please contact the Administrator by e-mail at [email protected] or in writing at: ZPH „Piokal” Alicja Ostrowska, ul. Żurawiec 2, 32-500 Chrzanów, Poland.

GDPR