Skip to main content

Privacy Policy

This is an English working translation of the Polish Privacy Policy of the ONDRA.STORE online shop. In the event of any discrepancy, the Polish version prevails.

PRIVACY POLICY OF THE ONDRA.STORE SHOP

This Privacy Policy (the „Policy”) contains information about the processing of your personal data in connection with the use of the ONDRA.STORE online shop operating at www.ondra.store (the „Shop”).

Capitalised terms not defined otherwise in the Policy have the meaning given to them in the Terms and Conditions available at: www.ondra.store/pages/terms-and-conditions.

Personal data controller

The controller of your personal data is ONDRA Sp. z o.o., with its registered office in Wrocław (50-502), ul. Hubska 52/14, entered in the register of entrepreneurs of the National Court Register under KRS number 0001216311, NIP: 899-304-63-93, e-mail: hello@ondra.store (the „Controller”).

Contacting the Controller

In all matters related to the processing of personal data you may contact the Controller:

  1. by e-mail – at hello@ondra.store;
  2. by post – at ul. Hubska 52/14, 50-502 Wrocław.

The Data Protection Officer appointed by the Controller is [NAME TO BE COMPLETED]. You may contact the Officer by e-mail at: [E-MAIL TO BE COMPLETED].

Personal data protection measures

The Controller applies modern organisational and technical safeguards to ensure the best possible protection of your personal data and guarantees that it processes them in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the „GDPR”), the Act of 10 May 2018 on the protection of personal data, and other data protection legislation.

Information about the personal data processed

Using the Shop requires the processing of your personal data. Below you will find detailed information about the purposes and legal bases of the processing, the processing period, and whether providing the data is obligatory or voluntary.

Conclusion and performance of the Agreement for the Supply of the Account Service

Data processed: first name and surname; e-mail address.

Legal basis: Article 6(1)(b) GDPR (processing is necessary for the performance of the Agreement for the Supply of the Account Service concluded with the data subject, or in order to take steps prior to concluding it).

Providing the above data is a condition of concluding and performing the Agreement for the Supply of the Account Service (providing it is voluntary, but the consequence of not providing it will be the inability to conclude and perform that agreement, including creating the Account).

The Controller will process the above data until the claims arising from the Agreement for the Supply of the Account Service become time-barred.

Conclusion and performance of the Sales Agreement

Data processed: first name and surname; e-mail address; telephone number; residential or business address (street, house number, flat number, town, postcode, country); delivery address (if different); optionally, company name and NIP (if the Buyer is an Entrepreneur or an Entrepreneur with Consumer Rights).

Legal basis: Article 6(1)(b) GDPR (processing is necessary for the performance of the Sales Agreement concluded with the data subject, or in order to take steps prior to concluding it).

Providing the above data is a condition of concluding and performing the Sales Agreement (providing it is voluntary, but the consequence of not providing it will be the inability to conclude and perform the Sales Agreement).

The Controller will process the above data until the claims arising from the Sales Agreement become time-barred.

Conclusion and performance of the Agreement for the Supply of the Newsletter

Data processed: e-mail address.

Legal basis: Article 6(1)(b) GDPR (processing is necessary for the performance of the Agreement for the Supply of the Newsletter concluded with the data subject, or in order to take steps prior to concluding it) and Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case informing about new arrivals and promotions available in the Shop).

Providing the above data is voluntary but necessary in order to receive the Newsletter (the consequence of not providing it will be the inability to receive the Newsletter).

The Controller will process the above data until an objection is effectively raised or the purpose of processing is achieved, or until the claims arising from the Agreement for the Supply of the Newsletter become time-barred (whichever occurs first).

Handling complaints

Data processed: first name and surname; e-mail address.

Legal basis: Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case the obligations to reply to a complaint – Article 7a of the Consumer Rights Act – and to give effect to the Customer’s rights under the provisions on the Controller’s liability for non-conformity of physical Goods with the Sales Agreement or of a Digital Performance Item with the agreement concerning it).

Providing the above data is a condition of receiving a reply to a complaint or of exercising the Customer’s rights referred to above (providing it is voluntary, but the consequence of not providing it will be the inability to receive a reply to the complaint and to exercise those rights).

The Controller will process the above data for the duration of the complaint procedure and, where the Customer’s rights referred to above are exercised, until they become time-barred.

Sending e-mail notifications

Data processed: e-mail address.

Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case informing Customers about actions taken in connection with the performance of Agreements concluded with Customers).

Providing the above data is voluntary but necessary in order to receive information about actions related to the performance of Agreements concluded with Customers (the consequence of not providing it will be the inability to receive that information).

The Controller will process the above data until an objection is effectively raised or the purpose of processing is achieved (whichever occurs first).

Handling enquiries submitted by Customers

Data processed: first name; e-mail address; other data contained in the message to the Controller.

Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case replying to the enquiry received).

Providing the above data is voluntary but necessary in order to receive a reply to the enquiry (the consequence of not providing it will be the inability to receive a reply).

The Controller will process the above data until an objection is effectively raised or the purpose of processing is achieved (whichever occurs first).

Compliance with tax obligations (including issuing VAT invoices and keeping accounting records)

Data processed: first name and surname or company name; residential or registered office address; NIP.

Legal basis: Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations under tax law).

Providing the above data is voluntary but necessary for the Controller to comply with its tax obligations (the consequence of not providing it will be the Controller’s inability to comply with those obligations).

The Controller will process the above data for 5 years from the end of the year in which the deadline for paying the tax for the previous year expired.

Compliance with data protection obligations

Data processed: first name and surname; the contact details you provide (e-mail address; correspondence address; telephone number).

Legal basis: Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations under data protection legislation).

Providing the above data is voluntary but necessary for the Controller to properly perform its obligations under data protection legislation, including giving effect to the rights granted to you by the GDPR (the consequence of not providing it will be the inability to properly give effect to those rights).

The Controller will process the above data until the limitation periods for claims for infringement of data protection legislation expire.

Establishing, pursuing or defending against claims

Data processed: first name and surname or company name; e-mail address; residential or registered office address; PESEL number; NIP.

Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case establishing, pursuing or defending against claims that may arise in connection with the performance of Agreements concluded with the Controller).

Providing the above data is voluntary but necessary for that purpose (the consequence of not providing it will be the Controller’s inability to take those actions).

The Controller will process the above data until the limitation periods for claims that may arise in connection with the performance of Agreements concluded with the Controller expire.

Analysis of your activity in the Shop

Data processed: date and time of the visit; device IP number; device operating system; approximate location; web browser type; time spent in the Shop; Goods viewed; subpages visited and other actions taken within the Shop.

Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case obtaining information about your activity in the Shop).

Providing the above data is voluntary but necessary for the Controller to obtain information about your activity in the Shop (the consequence of not providing it will be the Controller’s inability to obtain that information).

The Controller will process the above data until an objection is effectively raised or the purpose of processing is achieved.

Administration of the Shop

Data processed: IP address; server date and time; web browser information; operating system information.

The above data is recorded automatically in server logs whenever the Shop is used (administering the Shop without server logs and automatic recording would not be possible).

Legal basis: Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case ensuring the proper operation of the Shop).

Providing the above data is voluntary but necessary to ensure the proper operation of the Shop (the consequence of not providing it will be the inability to ensure the Shop operates properly).

The Controller will process the above data until an objection is effectively raised or the purpose of processing is achieved.

Profiling

In order to create your profile for marketing purposes and to direct to you direct marketing tailored to your preferences, the Controller will process your personal data in an automated manner, including profiling it – however, this will not produce any legal effects concerning you or similarly significantly affect your situation.

The scope of the profiled personal data corresponds to the scope indicated above for the analysis of your activity in the Shop and the data you save on the Account.

The legal basis for processing personal data for the above purpose is Article 6(1)(f) GDPR, under which the Controller may process personal data in pursuit of its legitimate interest, in this case conducting marketing activities tailored to the preferences of the recipients. Providing the above data is voluntary but necessary for that purpose (the consequence of not providing it will be the Controller’s inability to conduct marketing activities tailored to the recipients’ preferences).

The Controller will process personal data for profiling purposes until an objection is effectively raised or the purpose of processing is achieved.

Recipients of personal data

The recipients of personal data will be the following external entities cooperating with the Controller:

  1. the hosting company;
  2. the logistics operator and courier companies;
  3. online payment system providers;
  4. the provider of the newsletter service and marketing automation tools;
  5. companies providing tools for analysing activity in the Shop and directing direct marketing to its users (including Google Analytics);
  6. the company providing accounting services.

In addition, personal data may also be disclosed to public or private entities where such an obligation arises from generally applicable law, a final court judgment or a final administrative decision.

Transfers of personal data to third countries

In connection with the Controller’s use of services provided by Google LLC, your personal data may be transferred to the following third countries: the United Kingdom, Canada, the USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for transferring data to those third countries is:

  1. for the United Kingdom, Canada, Israel and Japan – European Commission decisions finding an adequate level of personal data protection in each of those third countries;
  2. for the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia and Australia – contractual clauses ensuring an adequate level of protection, consistent with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

You may obtain from the Controller a copy of the data transferred to a third country.

Data providers outside the EU hold Standard Contractual Clauses (SCCs) or other adequate safeguards. The Controller has taken additional security measures in line with the requirements of the Schrems II decision, such as: [encryption, access restriction, etc. – TO BE COMPLETED].

Your rights

In connection with the processing of personal data, you have the following rights:

  1. the right to be informed which of your personal data is processed by the Controller and to receive a copy of that data (the right of access). The first copy of the data is free of charge; the Controller may charge a fee for subsequent copies;
  2. if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification;
  3. in certain situations you may ask the Controller to erase your personal data, for example where:
    1. the data is no longer needed by the Controller for the purposes it informed you about;
    2. you have effectively withdrawn your consent to processing – unless the Controller has the right to process the data on another legal basis;
    3. the processing is unlawful;
    4. the need to erase the data results from a legal obligation to which the Controller is subject;
  4. where the personal data is processed by the Controller on the basis of consent or for the performance of an Agreement concluded with it, you have the right to port your data to another controller;
  5. where the personal data is processed by the Controller on the basis of your consent, you have the right to withdraw that consent at any time (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);
  6. if you consider that the processed personal data is incorrect, that its processing is unlawful, or that the Controller no longer needs certain data, you may request that for a specific, necessary period (for example to verify the accuracy of the data or to pursue claims) the Controller performs no operations on the data other than storing it (the right to restriction of processing);
  7. you have the right to object to the processing of personal data where the basis of the processing is the Controller’s legitimate interest. If the objection is effectively raised, the Controller will stop processing the personal data for that purpose;
  8. you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you consider that the processing of your personal data infringes the GDPR;
  9. you have the right to request that decisions producing legal effects concerning you be taken by a human being and not be based solely on automated processing of personal data, subject to the exceptions set out in the GDPR.

Cookies

  1. The Controller informs that the Shop uses cookies installed on your end device. These are small text files that can be read by the Controller’s system as well as by systems belonging to other entities whose services the Controller uses (for example Facebook and Google).
  2. The Controller uses cookies for the following purposes:
    1. ensuring the proper operation of the Shop – cookies enable the Shop to run smoothly, its functions to be used and convenient movement between subpages;
    2. improving the comfort of browsing the Shop – cookies make it possible to detect errors on certain subpages and to improve them continuously;
    3. producing statistics – cookies are used to analyse how users use the Shop, which makes it possible to keep improving the Shop and adapting it to users’ preferences;
    4. conducting marketing activities – cookies allow the Controller to direct to users advertising tailored to their preferences.
  3. The Controller may place both persistent and temporary (session) cookies on your device. Session cookies are usually deleted when the browser is closed, while closing the browser does not delete persistent cookies.
  4. Information about the cookies used by the Controller is displayed in the panel at the bottom of the Shop website. Depending on your decision, you may enable or disable cookies of individual categories (except essential cookies) and change these settings at any time.
  5. The data collected through cookies does not enable the Controller to identify you.
  6. The Controller uses the following cookies or tools that rely on them:

Essential cookies

Provider: the Controller.

Functions and scope of data collected: these cookies are necessary for the proper functioning of the Shop website, so you cannot disable them. Thanks to these files (which collect, among other things, your device’s IP number), it is possible, among other things, to inform you about the cookies operating on the Shop website.

Duration: most essential cookies are session cookies; some, however, remain on your end device for 24 months or until deleted.

Google Analytics

Provider: Google.

Functions and scope of data collected: this tool collects statistical data on how Customers use the Shop, including the number of visits, their duration, the search engine used and location. The collected data helps improve the Shop and make it more user-friendly.

Duration: up to 2 years or until deleted (whichever occurs first).

Facebook Pixel

Provider: Facebook.

Functions and scope of data collected: this tool makes it possible to establish that you have visited the Shop, to direct to you advertisements displayed on the Facebook and Instagram social networks, and to measure their effectiveness.

Duration: up to 3 months or until deleted (whichever occurs first).

  1. Through most commonly used browsers you can check whether cookies have been installed on your end device, delete installed cookies, and block the Shop from installing them in the future. Disabling or restricting cookies may, however, cause considerable difficulties in using the Shop, for example the need to log in on every subpage, longer page loading times, or restrictions on the use of certain functionalities.

Final provisions

In matters not regulated by the Policy, generally applicable data protection legislation applies.

The Policy applies from 28 August 2026.