Privacy and Cookies Policy

§1. General provisions

1. This Privacy Policy sets out the rules for processing personal data and using cookies on the website available at https://wpcpoland.com/.
2. The website is operated by WPC Sp. z o.o. with its registered office in Warsaw, Poland, at ul. Władysława Hermana 3A, 02-496 Warsaw.
3. The Controller exercises due care to protect users’ privacy and ensure the security of processed personal data.
4. Personal data are processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the “GDPR”.
5. Using the website means that the user has read this Privacy Policy.

§2. Personal data controller

The controller of personal data of website users and online store customers is:

In all matters related to the protection of personal data, you may contact the Controller by e-mail at: info@wpcpoland.com.

§3. Scope of processed data

The Controller may process personal data provided by the user or customer in connection with using the website, placing orders, contacting the Seller, handling payments, delivery, returns and complaints.

Depending on how the website is used, the following data may be processed in particular:

• first name and surname,
• company name,
• delivery address or correspondence address,
• e-mail address,
• telephone number,
• tax identification number, if required for issuing an invoice,
• data concerning the order, payment, delivery, return or complaint,
• IP address, browser data, device data and data related to the use of the website,
• the content of correspondence addressed to the Controller.

The Controller does not require the provision of special categories of personal data, such as health data, political opinions, religious or philosophical beliefs.

§4. Purposes and legal bases of data processing

Personal data are processed for the following purposes:

1. Order handling and performance of the sales agreement — to accept the order, complete the sale, deliver the goods, handle payment and contact the customer regarding the order. The legal basis for processing is Article 6(1)(b) GDPR, meaning that processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
2. Online payment handling — to enable payment for the order through the Przelewy24 payment operator. The legal basis for processing is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR, meaning the Controller’s legitimate interest in ensuring payment handling.
3. Issuing invoices and keeping accounting records — to comply with obligations arising from tax and accounting regulations. The legal basis for processing is Article 6(1)(c) GDPR, meaning a legal obligation imposed on the Controller.
4. Handling returns, withdrawal from the agreement and complaints — to process the request, contact the customer, collect or replace goods, refund payments and maintain case documentation. The legal basis for processing is Article 6(1)(b) GDPR, Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.
5. Contact with the user — to respond to enquiries sent via the contact form, e-mail or telephone. The legal basis for processing is Article 6(1)(f) GDPR, meaning the Controller’s legitimate interest in conducting correspondence and handling enquiries.
6. Establishing, pursuing or defending claims — to protect the Controller’s interests in the event of possible claims. The legal basis for processing is Article 6(1)(f) GDPR.
7. Ensuring security and proper operation of the website — to protect the website, prevent misuse, detect technical errors and ensure stable operation of the website. The legal basis for processing is Article 6(1)(f) GDPR.
8. Web analytics and online marketing, including Google Analytics 4 and Google Ads — to analyse website traffic, measure the effectiveness of advertising campaigns, analyse conversions and conduct remarketing activities. The legal basis for data processing is the user’s consent, i.e. Article 6(1)(a) GDPR, where such consent is required under applicable law.

§5. Voluntary provision of data

1. Providing personal data is voluntary, but in certain cases it is necessary to provide specific services.
2. Failure to provide data required to process an order may prevent the conclusion or performance of a sales agreement.
3. Failure to provide contact details may prevent the Controller from responding to an enquiry.
4. Failure to provide data required to handle a complaint, return or withdrawal from the agreement may make it difficult or impossible to process the request.

§6. Recipients of personal data

Personal data may be transferred to entities that support the Controller in operating the website and online store, in particular:

• hosting and technical service providers,
• providers of the online store system and IT tools,
• the Przelewy24 online payment operator,
• courier companies and carriers delivering orders,
• entities providing accounting, tax or legal services,
• entities handling e-mail correspondence, contact forms or other communication tools,
• entities providing analytical or marketing services, including providers of Google Analytics 4 and Google Ads tools,
• public authorities, where the obligation to disclose data results from applicable law.

Entities processing data on behalf of the Controller do so under appropriate agreements and only in accordance with the Controller’s instructions.

§7. Data retention period

Personal data are stored for the period necessary to fulfil the purposes for which they were collected, and then for the period required by law or necessary to secure possible claims.

1. Data related to order processing are stored for the time necessary to perform the agreement and for the limitation period of possible claims.
2. Data contained in accounting and tax documents are stored for the period required by tax and accounting regulations.
3. Data related to complaints, returns and withdrawals from the agreement are stored for the period necessary to process the request and for the limitation period of possible claims.
4. Data processed on the basis of consent are stored until the consent is withdrawn, unless further storage is required by law or necessary to secure claims.
5. Data processed for contact purposes are stored for the period necessary to handle correspondence and then for the period allowing the course of communication to be demonstrated.
6. Technical, analytical and cookie data are stored in accordance with the settings of a given tool or until cookies are deleted by the user.

§8. Cookies, Google Analytics 4 and Google Ads

1. The website uses cookies, i.e. small text files saved on the user’s device when using the website.
2. Cookies may be used to ensure the proper operation of the website, handle the shopping cart, remember user settings, collect statistics, analyse traffic and conduct marketing activities.
3. The website may use the following types of cookies:

• necessary cookies — enable the proper operation of the website, cart, order process and basic store functions,
• functional cookies — allow user settings to be remembered and improve the convenience of using the website,
• analytical cookies — help analyse how the website is used and improve its operation,
• marketing cookies — are used to measure advertising effectiveness and conduct remarketing activities.

4. The website uses Google Analytics 4, which enables analysis of how the website is used, in particular the number of visits, traffic sources, visited subpages, device type, browser and approximate location data.
5. Data collected by Google Analytics 4 are statistical and analytical in nature and are used by the Controller to improve the website, analyse the effectiveness of content and optimise the website.
6. The website also uses Google Ads tools, which may be used to measure the effectiveness of advertising campaigns, analyse conversions and conduct remarketing activities.
7. Google Ads may use cookies or similar technologies to attribute user actions on the website to advertising campaigns from which the user came to the website, as well as to display ads tailored to the user’s previous activity.
8. The use of analytical and marketing cookies takes place on the basis of the user’s consent, where such consent is required under applicable law.
9. The user may manage cookie consents using the consent mechanism available on the website, if such a mechanism has been implemented.
10. The user may also change cookie settings in their web browser, including blocking the saving of cookies or deleting already saved cookies.
11. Restricting the use of cookies may affect some website functions, in particular the operation of the cart, the purchase process or remembering user settings.

§9. Online payments

1. Online payments made through the Przelewy24 system are available in the online store.
2. In order to process a payment, data necessary to handle the transaction may be transferred to the payment operator.
3. The payment operator processes data in accordance with its own rules, terms and privacy policy.
4. The Controller does not store access data to the user’s bank account or full payment card details.

§10. Contact forms, returns and complaints

1. If the user contacts the Controller via a contact form, e-mail or telephone, the Controller processes the data provided by the user in order to respond and conduct correspondence.
2. In the case of a return, withdrawal from the agreement or complaint, the Controller processes data necessary to handle the request, in particular identification data, contact details, order data, description of the case and attached documents.
3. Data provided in return or complaint forms are used only to handle the given request, fulfil legal obligations and secure possible claims.

§11. Rights of the data subject

The data subject has rights under the GDPR, including:

• the right of access to personal data,
• the right to rectification of data,
• the right to erasure of data,
• the right to restriction of processing,
• the right to data portability,
• the right to object to data processing,
• the right to withdraw consent at any time, where data are processed on the basis of consent,
• the right to lodge a complaint with the President of the Personal Data Protection Office in Poland.

To exercise your rights, you may contact the Controller by e-mail at: info@wpcpoland.com.

§12. Transfer of data outside the European Economic Area

1. As a rule, the Controller does not transfer personal data outside the European Economic Area, unless the use of specific technical, analytical or marketing tools involves such transfer.
2. In connection with the use of Google Analytics 4 and Google Ads tools, data may be processed by the provider of these services, including entities belonging to the Google group, in accordance with the rules for providing these services.
3. If data are transferred outside the European Economic Area, this is done with the safeguards required by law, such as standard contractual clauses, a European Commission adequacy decision or other mechanisms provided for by the GDPR.

§13. Data security

1. The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.
2. Access to personal data is granted only to persons and entities for whom it is necessary to fulfil specific processing purposes.
3. The Controller regularly analyses the security measures applied and adapts them to the risks associated with the processing of personal data.

§14. Automated decision-making and profiling

1. Users’ personal data are not used to make decisions concerning them based solely on automated processing that would produce legal effects or similarly significantly affect them.
2. When analytical or marketing tools such as Google Analytics 4 and Google Ads are used, profiling may occur in the sense of matching content or advertisements to the user’s activity on the website, provided that the user has given appropriate consent or another valid legal basis exists.

§15. Changes to the Privacy Policy

1. The Controller reserves the right to amend this Privacy Policy in the event of changes in law, technological changes, changes to website functionality or changes in the way personal data are processed.
2. The current version of the Privacy Policy is always available on the website.
3. This Privacy Policy applies from: [enter date].