Privacy Policy
Working document. The text corresponds to what the Store actually does with data, but requires company data completion and legal verification before launch.
1. Data controller
The controller of your personal data within the meaning of Article 4 point 7 GDPR is:
[TO BE COMPLETED: full name and legal form], [TO BE COMPLETED: street and number], [TO BE COMPLETED: postal code and city], VAT ID [TO BE COMPLETED], REGON [TO BE COMPLETED].
Contact regarding personal data: biuro@art-agro.pl, phone +48 573 777 731.
[TO BE COMPLETED: information whether a Data Protection Officer has been appointed — if yes, provide contact details; if not, remove this paragraph].
2. Where we get your data from
Data comes directly from you — you provide it during Account registration, placing an order, sending an inquiry, or subscribing to price or availability notifications. Company data may also be verified in public registers (CEIDG, KRS, VAT taxpayers list).
3. What data we process
- Registration data: first and last name, email address, phone number, company name, VAT ID, REGON, address.
- Order data: ordered items, delivery addresses, invoice data, order and payment history.
- Correspondence: content of inquiries, complaints, and attachments.
- Technical data: IP address, session identifier, language and currency choice — necessary for login and cart operation.
4. Purposes, legal bases, and retention periods
| Purpose | Legal basis | Duration |
|---|---|---|
| Account creation and management | Art. 6(1)(b) GDPR — contract performance | until Account deletion |
| Order fulfillment and delivery | Art. 6(1)(b) GDPR — contract performance | until completion of fulfillment |
| Invoicing, accounting, tax settlements | Art. 6(1)(c) GDPR — legal obligation | 5 years from the end of the tax year |
| Complaint handling | Art. 6(1)(b) and (c) GDPR | until case closure, then limitation period |
| Price and availability notifications, newsletter | Art. 6(1)(a) GDPR — consent | until consent withdrawal |
| Establishing, pursuing, and defending claims | Art. 6(1)(f) GDPR — legitimate interest | until claims limitation (usually 3 years in business turnover) |
| Store security, abuse detection, and error diagnostics | Art. 6(1)(f) GDPR — legitimate interest | up to 12 months |
5. To whom we disclose data
Your data may be disclosed only to entities processing it on our behalf or based on legal provisions:
- courier companies and parcel locker operators — to the extent necessary for delivery of the shipment,
- hosting provider on whose servers the Store operates,
- email service provider,
- application error monitoring service provider,
- accounting office and tax advisors,
- law firms and debt collection agencies — in case of claims enforcement,
- state authorities, when required by law.
[TO BE COMPLETED: complete or confirm the list — names of couriers, accounting office, and hosting provider].
We do not sell personal data nor share it for marketing purposes with third parties.
6. Data transfer outside the EEA
Data is generally processed within the European Economic Area. If any service provider processes data outside the EEA, it is based on standard contractual clauses approved by the European Commission or another mechanism provided in Chapter V of GDPR.
7. Your rights
You have the right to:
- access data and obtain copies (Art. 15 GDPR),
- rectify inaccurate or incomplete data (Art. 16 GDPR),
- erase data (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on legitimate interest (Art. 21 GDPR),
- withdraw consent at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR).
You can submit requests to biuro@art-agro.pl. We respond within one month of receiving the request.
The right to erasure does not include data we must keep under tax and accounting laws — data from issued invoices will remain with us for the required period.
8. Complaint to supervisory authority
If you believe we process your data unlawfully, you may file a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
9. Is providing data mandatory
Providing data is voluntary but necessary to create an Account, place an order, and issue an invoice — without it, we cannot conclude or perform a contract. Providing data for price and availability notifications is entirely voluntary.
10. Profiling and automated decisions
We do not make decisions based solely on automated processing, including profiling, that would have legal effects or similarly significant impact on you.
Wholesale prices depend solely on account status and ordered quantity — not on your behavior in the Store.
11. Cookies
The Store uses only cookies necessary for its operation:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | maintaining login and cart contents | until browser is closed |
| Security token (CSRF) | protecting forms against abuse | session duration |
| Language and currency choice | remembering presentation settings | session duration |
Necessary cookies do not require consent (Article 173(3) of the Telecommunications Law). We do not use marketing, tracking, or analytics cookies.
You can manage cookies in your browser settings, but blocking them will prevent logging in and using the cart.
[TO BE COMPLETED: if analytics, advertising, or social pixel is added in the future — a consent banner must be implemented and this section updated].
12. Security
Connection to the Store is encrypted with HTTPS protocol. Passwords are stored only as cryptographic hashes. Data access is limited to authorized employees of the Controller.
13. Privacy Policy changes
We may update this Policy due to changes in law or Store operation. Users with Accounts will be informed of significant changes at the email address assigned to the Account.
The Policy is also available in English. The English version is for information only — in case of discrepancies, the Polish version is binding.
Document valid as of [TO BE COMPLETED: date].