Draft translation for legal review.

Privacy Policy of the Colbergcoffee.com store

The controller of personal data is Colberg Coffee Samuel Pilichowski, registered office at Pławęcino 18, 78-120, Poland, NIP (tax ID) 6711801128, email: sklep@colbergcoffee.pl.

Personal data of users of the colbergcoffee.com website is processed in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) and the Polish Act on the protection of personal data.

1. Scope and purposes of processing

Personal data is processed for the following purposes:

fulfilling orders placed in the online store,
handling payments (e.g. PayU, InPost Pay),
delivering orders through courier companies (e.g. InPost, DPD, Poczta Polska),
maintaining the user account,
contacting you about an order or enquiry,
keeping accounting and tax records,
sending the newsletter (after consent is given).

The legal basis for processing is:

Article 6(1)(b) GDPR (performance of a contract),
Article 6(1)(c) GDPR (legal obligations: accounting and tax),
Article 6(1)(a) GDPR (the user’s consent, e.g. newsletter),
Article 6(1)(f) GDPR (the controller’s legitimate interest, e.g. defence against claims).

2. Recipients of data

Data may be shared with:

courier companies and postal operators (InPost, DPD, Poczta Polska),
payment operators (PayPro SA, InPost Pay, Przelewy24),
IT and hosting service providers,
store software providers,
email marketing system operators,
an accounting firm (to the extent necessary for bookkeeping).

3. Data retention

We keep data:

for the duration of the contract and the related settlements,
for the period required by tax law (usually 5 years),
until consent is withdrawn, where data is processed on the basis of consent.

4. User rights

Every user has the right to:

access their data and to have it rectified, erased or its processing restricted,
withdraw consent at any time,
data portability,
object to processing,
lodge a complaint with the President of the Personal Data Protection Office (UODO), the Polish supervisory authority.

Providing personal data is voluntary but necessary to fulfil an order.