Privacy Policy

PRIVACY AND COOKIES POLICY OF THE POCAANDPOCA.COM ONLINE STORE

1. GENERAL PROVISIONS AND DATA CONTROLLER DETAILS

This Privacy Policy defines the rules for processing and protecting personal data, as well as the use of cookies in connection with the use of the website and online store located at pocaandpoca.com (hereinafter referred to as the "Store").

The Personal Data Controller (Controller) of the Store's users is:

  • Company Name: KONCEPT SZWALNIA Sp. z o.o.

  • Registered Address: ul. Jana Kochanowskiego 30B, 33-100 Tarnów, Poland

  • NIP (Tax ID): 9930679752 | REGON: 387642365

  • KRS: 0000872418

  • Contact E-mail: shop@pocaandpoca.com

  • Telephone: +48 533 186 706

The Controller ensures the security of entrusted personal data by applying appropriate technical and organizational measures to protect data against unauthorized disclosure, loss, or damage.

2. PURPOSES, LEGAL BASES, AND DATA RETENTION PERIODS

Personal data is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). We process your data for the following purposes:

  • Order Fulfillment and Sales Contract Execution

    • Scope of Data: First name, last name, delivery address, e-mail address, phone number, company name, and Tax ID (optional).

    • Legal Basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract).

    • Retention Period: The time necessary to fulfill the order and until the expiration of claims arising from it.

  • Fulfillment of Tax and Accounting Obligations

    • Scope of Data: Data appearing on invoices or receipts and purchase history.

    • Legal Basis: Art. 6(1)(c) GDPR (legal obligation resulting from tax regulations).

    • Retention Period: 5 years from the end of the calendar year in which the tax payment deadline expired.

  • User Account Management

    • Scope of Data: E-mail address, password, purchase history, and provided address details.

    • Legal Basis: Art. 6(1)(b) GDPR (contract for the provision of account maintenance services).

    • Retention Period: Until the User deletes their account.

  • Handling Complaints and Contract Withdrawals

    • Scope of Data: First name, last name, e-mail address, phone number, bank account number, and details provided in the form.

    • Legal Basis: Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest – protection against claims).

    • Retention Period: 1 year after the statutory period for product non-conformity expires or after the complaint has been processed.

  • Contact via Form or E-mail

    • Scope of Data: First name, e-mail address, phone number, and content of the sent message.

    • Legal Basis: Art. 6(1)(f) GDPR (legitimate interest – handling inquiries and correspondence).

    • Retention Period: The time necessary to handle correspondence (maximum 2 years from the end of contact).

  • Newsletter and Direct Marketing

    • Scope of Data: E-mail address and first name (optional).

    • Legal Basis: Art. 6(1)(a) GDPR (voluntary consent).

    • Retention Period: Until consent is withdrawn or until unsubscribing from the service.

  • Website Analytics and Statistics

    • Scope of Data: IP address, browser information, time spent on the website, and recorded interactions.

    • Legal Basis: Art. 6(1)(f) GDPR (legitimate interest) and cookie consent.

    • Retention Period: Until the expiration of cookies or until an effective objection is lodged.

3. RECIPIENTS OF PERSONAL DATA

In order to ensure the proper functioning of the Store and order fulfillment, the Controller uses the services of third-party entities. Personal data may be transferred to the following categories of recipients:

  • Payment Service Providers: (e.g., PayPal, Przelewy24, Shopify Payments) – to process and handle electronic payments. Note: Payment card details are processed directly by certified payment processors and are not stored or accessed by the Controller.

  • Hosting Company and Software Providers: Providers of hosting, software, and network infrastructure – to maintain the website and database.

  • Courier and Postal Services: (e.g., DHL, DPD, InPost) – to deliver ordered products.

  • Accounting / Tax Office: (e.g., SWGK) – for tax settlements and accounting purposes.

  • Analytical Tools, Marketing Providers, and Advertising Agencies: (e.g., Google LLC, Meta Platforms, as well as external marketing agencies managing ads) – to analyze store traffic, run and optimize ad campaigns, remarketing, and manage marketing communications (e.g., newsletters).

4. DATA TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)

When using tools from providers based outside the EEA (e.g., in the USA), personal data may be transferred to third countries. Such transfers take place on the basis of:

  • Executive decisions of the European Commission establishing an adequate level of protection (e.g., the Data Privacy Framework program for US entities).

  • Standard Contractual Clauses (SCC) approved by the European Commission.

5. USER RIGHTS

In accordance with the GDPR, you have the following rights regarding your personal data:

  • Right of access to data and receiving a copy thereof (Art. 15 GDPR).

  • Right to rectification (correction) of data (Art. 16 GDPR).

  • Right to erasure ("right to be forgotten") (Art. 17 GDPR).

  • Right to restriction of processing (Art. 18 GDPR).

  • Right to data portability (Art. 20 GDPR).

  • Right to object to data processing based on legitimate interest (Art. 21 GDPR).

  • Right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

To exercise your rights, please contact us at: shop@pocaandpoca.com.

You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland), if you believe that the processing of your data violates the GDPR.

6. COOKIES POLICY AND TRACKING TECHNOLOGIES

  • The Store uses cookies and similar tracking technologies (e.g., pixels).

  • Cookies are small text files saved on the User's end device.

  • The Store uses two main types of cookies:

    • Necessary: Essential for the proper operation of the Store, remembering cart contents, and maintaining security. They do not require User consent.

    • Analytical and Marketing: Allow us to collect information on how the site is used, measure ad effectiveness, and tailor promotional content to User interests (e.g., Google Analytics, Meta Pixel). They require voluntary User consent.

  • Users can change their cookie settings at any time using the consent management banner on the site or via their web browser settings.

7. CHANGES TO THE PRIVACY POLICY

  • The Controller reserves the right to make changes to this Privacy Policy to ensure it remains up-to-date and compliant with applicable laws.

  • Changes come into force on the day they are published on the Store's website.

  • This Privacy Policy is effective as of September 1, 2026.