Privacy Policy

Privacy Policy of surowcepiwowarskie.pl Online Store

1. General Provisions
1.1. This Privacy Policy sets out the rules for processing personal data of users of the surowcepiwowarskie.pl website (hereinafter referred to as the "Website").
1.2. The administrator of personal data is Winnica & Wino Sp. z o.o., based in Kraków, ul. Wapowskiego 8, registered in the National Court Register under number 0000743071, holding NIP 6793172494 (hereinafter referred to as the "Administrator").
1.3. Contact with the Administrator regarding personal data processing matters is possible via email at sklep@surowcepiwowarskie.pl or by mail at the company's registered address.
1.4. The Administrator processes personal data in accordance with applicable laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), the Polish Personal Data Protection Act, and the Act on the Provision of Electronic Services.

2. Scope of Processed Personal Data
2.1. The Administrator processes personal data to the extent necessary to provide the services offered on the Website, including:

• order fulfillment,

• handling complaints and returns,

• responding to inquiries and communicating with users,

• managing user accounts on the Website,

• conducting marketing activities, if the user has given consent.
  2.2. Providing personal data by the user is voluntary but necessary for order fulfillment and access to certain Website services.

3. Purpose and Legal Basis for Data Processing
Personal data of users may be processed for the following purposes:

• Conclusion and performance of a sales contract (legal basis: Article 6(1)(b) GDPR),

• Handling complaints and returns (legal basis: Article 6(1)(c) GDPR),

• Managing user accounts on the Website (legal basis: Article 6(1)(b) GDPR),

• Direct marketing and newsletters (legal basis: Article 6(1)(a) GDPR – user consent),

• Maintaining accounting and tax records (legal basis: Article 6(1)(c) GDPR),

• Establishing, pursuing, or defending claims (legal basis: Article 6(1)(f) GDPR).

4. Recipients of Personal Data
4.1. The Administrator may share users' personal data with third parties to the extent necessary for service provision, particularly with:

• courier and postal companies delivering orders,

• entities processing electronic payments (e.g., tPay),

• entities providing accounting and legal services to the Administrator,

• entities maintaining IT systems and Website hosting.
  4.2. Personal data will not be transferred to third countries (outside the European Economic Area) or international organizations.

5. Data Retention Period
5.1. Personal data will be stored for the following periods:

• as long as necessary for the performance of the sales contract,

• as required by law for accounting and tax documentation storage (5 years from the end of the tax year),

• until the user withdraws consent for marketing purposes, if given.

6. User Rights
6.1. Users have the right to:

• access their data and receive a copy,

• rectify (correct) their data,

• erase data (“right to be forgotten”) if there is no legal basis for further processing,

• restrict data processing,

• transfer data to another administrator,

• object to data processing,

• withdraw consent for personal data processing (e.g., for marketing purposes),

• lodge a complaint with the President of the Office for Personal Data Protection (PUODO) if they believe data processing violates GDPR regulations.
  6.2. To exercise these rights, users may contact the Administrator via email at sklep@surowcepiwowarskie.pl.

7. Cookies and Tracking Technologies
7.1. The Website uses cookies to ensure proper functionality, analyze traffic, and conduct marketing activities.
7.2. Users can manage cookies through their browser settings.
7.3. Detailed information about cookies is available in the Cookies Policy on the Website.

8. Data Security Measures
8.1. The Administrator applies appropriate technical and organizational measures to ensure the security of processed personal data, including:

• securing servers and databases,

• encrypting data transmission (SSL),

• controlling access to data,

• incident response procedures.

9. Final Provisions
9.1. The Administrator reserves the right to amend this Privacy Policy, particularly in the event of changes in legal regulations or the introduction of new services on the Website.
9.2. Users will be informed of any changes by publishing the updated Privacy Policy on the Website.
9.3. Matters not regulated by this Privacy Policy shall be governed by GDPR and applicable Polish law.