Policy privacy

This Privacy Policy explains how we process personal data in connection with the online store www.vini.pl (hereinafter: the "Store"), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Polish Personal Data Protection Act.

§ 1. Data Controller

The controller of personal data is:

Store location / personal pickup: WGO Boks 345, Głogowska 248, 60-104 Poznań, Poland.

The Data Controller has not appointed a Data Protection Officer. In all matters concerning personal data, please contact us at kontakt@vini.pl.

§ 2. Scope and Purposes of Processing

We process data to the extent necessary for the operation of the Store and customer service, in particular:

1. Orders and Sales — first and last name, email address, phone number, delivery / billing address, Tax ID (NIP, for corporate purchases), order details, payment and status history, parcel / collection point details.
2. User Account — registration data, password (hashed), preferences (language, currency), order history, loyalty points, addresses saved in the account.
3. Payments — data necessary to process online payments (Paynow) or payments on delivery; payment card data is processed directly by the payment operator and is not stored on the Store's servers.
4. Delivery — data transferred to the carrier / parcel locker operator (including InPost) or required for in-person pickup.
5. Newsletter and Marketing — email address (and optionally name / phone number with SMS consent), subscription and unsubscription history, welcome discount codes.
6. Forms and Contact — data from contact forms, chat / virtual assistant, return and warranty complaint requests, product availability alerts.
7. Reviews — data related to product / purchase reviews (including third-party review platforms, if applicable).
8. Technical and Security — IP address, server logs, session identifiers, device / browser data to the extent necessary for Store operation and fraud prevention.
9. Analytics and Advertising — data from analytical and advertising tools (e.g., Google Analytics / Google Ads, Meta) — exclusively upon obtaining appropriate cookie consents (Consent Mode).

§ 3. Legal Grounds

The legal grounds for processing include, in particular:

1. Article 6(1)(b) GDPR — performance of a contract (orders, user account, delivery, returns) or taking steps prior to entering into a contract;
2. Article 6(1)(c) GDPR — legal obligations (accounting, tax, consumer complaint obligations);
3. Article 6(1)(f) GDPR — legitimate interests pursued by the Data Controller (Store security, establishment and defense of legal claims, basic traffic analytics to the extent permitted by law, handling inquiries);
4. Article 6(1)(a) GDPR — consent (newsletter, marketing SMS, optional analytics / advertising cookies, select notifications).

Consent may be withdrawn at any time (e.g., by unsubscribing from the newsletter or adjusting cookie settings), without affecting the lawfulness of processing based on consent before its withdrawal.

§ 4. Data Recipients

Data may be disclosed to processors acting on behalf of the Data Controller or independent controllers to the extent necessary for the intended purpose, in particular to:

1. the payment processor Paynow (Krajowy Integrator Płatności S.A.);
2. carriers and pickup point operators (including InPost, couriers / Apaczka);
3. hosting, email service (SMTP), and IT infrastructure providers;
4. the accounting office / invoicing software providers;
5. marketing and analytics tool providers (e.g., Google, Meta) — subject to consent;
6. review collection partners (e.g., TrustMate), if such integration is active;
7. public authorities entitled by applicable statutory provisions.

Data processing agreements (Article 28 GDPR) are concluded with entities processing data on our behalf, whenever required.

§ 5. Cookies and Similar Technologies

5.1. The Store uses cookies and similar technologies stored on the User's device.

5.2. Types of cookies:

1. Strictly Necessary — session maintenance, cart functionality, security, language / currency settings, fundamental Store operations. These are always active.
2. Preferences — remembering choices made on the Store (e.g., upon consent).
3. Analytical — measuring traffic and service quality (e.g., Google Analytics) — upon consent (analytics_storage).
4. Advertising — storing advertising identifiers, ad personalization, and remarketing data (e.g., Google Ads, Meta) — upon consent (ad_storage, ad_user_data, ad_personalization).

5.3. Cookie consents are managed via the banner / cookie settings panel in the Store (Google Consent Mode v2). Without consent, corresponding signals remain set to denied.

5.4. Users can also restrict cookies via browser settings. Disabling necessary cookies may impair or prevent the use of certain functionalities (e.g., the cart).

5.5. Detailed cookie preferences: Cookie Settings page (or via the link in the Store footer).

§ 6. Profiling and Automated Decision-Making

6.1. Data may be used for simple marketing or statistical profiling (e.g., newsletter audience segmentation, product recommendations, sales analytics) — within the scope resulting from consent or legitimate interest.

6.2. The Data Controller does not make decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect them (Article 22 GDPR), except where permitted by applicable law or necessary for concluding / executing a contract — in which case the User will receive appropriate notice.

§ 7. Retention Period

We store data:

1. for the duration of the contract / account maintenance and through the applicable limitation period for claims;
2. accounting and tax records — for the period required by law (generally 5 tax years);
3. newsletter data — until consent is withdrawn / unsubscribed, and thereafter for a brief period necessary to demonstrate regulatory compliance;
4. logs and security data — for the period justified by security considerations;
5. optional cookie data — in accordance with cookie lifespans / provider settings, no longer than authorized by the granted consent.

§ 8. Rights of Data Subjects

You have the right to:

1. access your data,
2. rectification,
3. erasure ("right to be forgotten") — in cases provided under the GDPR,
4. restriction of processing,
5. data portability,
6. object to processing based on Article 6(1)(f) GDPR (including direct marketing),
7. withdraw consent at any time,
8. lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

Requests regarding GDPR rights may be submitted to kontakt@vini.pl. We respond without undue delay, generally within one month.

§ 9. Minors

The Store is not targeted at children under 16 years of age. We do not actively verify age upon each visit. Minors should not create an account or subscribe to the newsletter without the knowledge of their parents / guardians. Upon becoming aware that a child's data is being processed without the requisite consent, such data will be deleted.

§ 10. Security Measures

We implement technical and organizational measures appropriate to the risk, including connection encryption (HTTPS/TLS), restricted data access, backups, and secure password hashing. Only authorized personnel have access to personal data.

§ 11. Transfers Outside the EEA

If we use tools provided by vendors outside the European Economic Area (e.g., Google, Meta), data transfers occur on the basis of mechanisms provided for by the GDPR (including adequacy decisions, standard contractual clauses) and — for advertising / analytics cookies — upon explicit consent.

§ 12. Policy Changes

This Policy may be updated. The current version is always published in the Store with its effective update date. Significant changes may additionally be communicated (e.g., via email to registered users or by notices displayed in the Store).

§ 13. Contact

For privacy inquiries:

Related documents: Terms and Conditions, Cookie Settings.