The Polish version of these terms is binding; this translation is provided for convenience.
This page says what we do with your data when you buy at spawlab.pl, write to us or simply browse the range. Without legal jargon wherever it can be avoided.
Who the controller is
The data controller is [FULL COMPANY NAME], [LEGAL FORM], ul. Akacjowa 15, 63-700 Krotoszyn, VAT number [VAT NUMBER], REGON [REGON].
Contact on data matters: email sklep@spawlab.pl, telephone +48 669 162 833, post to the address above. Data protection officer: [DETAILS OF THE DATA PROTECTION OFFICER OR A STATEMENT THAT NONE HAS BEEN APPOINTED].
Why and on what basis we process data
| Purpose | Legal basis | For how long |
|---|---|---|
| Order, shipping, performance of the contract | Article 6(1)(b) GDPR, performance of a contract | until the contract ends, then until claims become time barred |
| Invoices and accounting | Article 6(1)(c) GDPR, legal obligation | 5 years from the end of the tax year |
| Complaints, returns, service package | Article 6(1)(c) and (f) GDPR | until the matter is closed and claims become time barred |
| Answering a question from the form, a call or an email | Article 6(1)(f) GDPR, contact with an interested party | up to 12 months from the last message |
| Visit statistics | Article 6(1)(a) GDPR, your consent | until consent is withdrawn, data in the tool up to 14 months |
| Advertising and measuring advertising performance | Article 6(1)(a) GDPR, your consent | until consent is withdrawn |
| Site security, server logs | Article 6(1)(f) GDPR | usually up to 12 months |
Providing data for an order is voluntary, but without it we cannot ship the goods or issue an invoice. You do not have to give consent for statistics and advertising, and the shop works just the same.
Who we pass data to
- The hosting company that maintains the shop server and the mail: [NAME AND ADDRESS OF THE HOSTING COMPANY].
- The payment operator PayU S.A. with its registered office in Poznan, when you pay online, by BLIK or in instalments. PayU is a separate controller of your payment data.
- Financing institutions, when you choose eRaty instalments or LeaseLink leasing. You apply with them, and we pass on the order data.
- Carriers: DPD Polska sp. z o.o. for courier shipments and Raben Logistics Polska sp. z o.o. for pallet transport. They receive the name or company name, the address and the telephone number.
- Google Ireland Limited, when you consent to statistics or advertising. This covers Google Analytics, Google Tag Manager and Google Ads.
- The accountancy office and advisers serving our company, and state authorities where the law requires it.
We do not sell data and we do not pass it on for the marketing purposes of other companies.
Transfers outside the European Economic Area
Google tools may transfer data to the United States. Google Ireland Limited is the recipient in the Union, and the transfer to the USA takes place on the basis of the European Commission adequacy decision under the Data Privacy Framework and on standard contractual clauses. This transfer only happens if you consent to statistics or advertising.
Your rights
- access to your data and a copy of it,
- rectification, where the data are incorrect,
- erasure, where we have no basis for further processing,
- restriction of processing,
- transfer of the data to another controller,
- objection to processing based on legitimate interest,
- withdrawal of consent at any time, without affecting what we did earlier,
- a complaint to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa.
To exercise a right, write to sklep@spawlab.pl. We reply within a month. We cannot erase data from invoices before the period set by tax law has passed, because the law does not allow it.
Cookies
A cookie is a small file that a website saves in your browser. It is what lets the basket remember your goods, and it lets us see which pages are used. We divide them into three groups.
Essential
They hold the contents of the basket, the order session, the currency choice and your decision from the consent banner. Without them the shop does not work, so they need no consent and cannot be switched off in the banner.
Statistics
Google Analytics loaded through Google Tag Manager. It counts visits and shows where you came from and which pages you view. The IP address is truncated. We enable these only after you consent.
Advertising
Google Ads. It measures which adverts lead to an order and shows our adverts to people who have viewed products in the shop. We enable these only after you consent.
How you manage consent
On your first visit you see the consent banner. You can accept everything, reject everything except the essential cookies, or choose by category. You can change your decision at any time using the Cookie settings link in the footer of every page.
You can also delete stored cookies in your browser settings. Once the site data are cleared, the banner appears again.
Until you give consent, the statistics and advertising scripts do not load, and Google tools work in a limited mode, without identifiers in your browser.
Profiling and automated decisions
We do not take decisions about you by automated means alone and we do not profile you with our own tools. The only profiling takes place in Google tools, after you consent to advertising, and it amounts to showing adverts to people who have visited the shop. It has no effect on prices, on access to goods or on the terms of purchase.
Security
The site works over an encrypted HTTPS connection. Access to the shop panel is limited to the people who need it for their work, on separate accounts. We make backups regularly. We never see payment card details, which are handled by the payment operator.
Changes to this policy
We change the policy when we add a tool, change a supplier or the law changes. The current version is always on this page. Date of last change: [DATE OF LAST UPDATE].
The rules of purchase are set out in the Shop terms and conditions.