Privacy Policy
wloski-hurt.com platform — personal data processing in line with the GDPR
Last updated: 26.02.2026
§ 1. Personal data administrator
The administrator of your personal data is:
GHInvestAgency Gracjan Hinz
Bielika 2, 86-005 Murowaniec
Tax ID (NIP): 5543012530
REGON: 525019510
Email: kontakt@wloski-hurt.com
Phone: +48 784 405 901
The Administrator has not appointed a Data Protection Officer (DPO). For any matters related to personal data protection, please contact us at: kontakt@wloski-hurt.com.
Personal data is processed in accordance with:
- aRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR),
- bThe Act of 10 May 2018 on the protection of personal data (consolidated text: Journal of Laws 2019, item 1781),
- cThe Act of 18 July 2002 on the provision of services by electronic means (consolidated text: Journal of Laws 2020, item 344),
- dThe Act of 16 July 2004 — Telecommunications Law (with regard to cookies).
§ 2. Purposes and legal bases for data processing
The Administrator processes personal data for the following purposes and on the following legal bases:
2.1. Registration and User Account management
2.2. Order fulfillment and sales contracts
2.3. Tax and accounting obligations
2.4. Communication and customer service
2.5. Notifications (push, email, in-platform)
Withdrawing consent and turning off notifications:
- aEmail notifications: click the unsubscribe link in the email or change your settings in the Account panel.
- bPush notifications: turn them off in your Account settings or directly in your browser settings.
- cIn-platform notifications: manage them in your Account settings on the Platform.
- dWithdrawing consent for marketing notifications does not stop transactional notifications (order statuses) required to perform the contract.
- eWithdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.
2.6. Marketing and advertising
2.7. Security and fraud prevention
2.8. Analytics and service improvement
§ 3. Categories of processed data
3.1. Personal data (identification and contact details)
- ›First and last name
- ›Email address
- ›Phone number (with country prefix and country code)
- ›Residential address / mailing address
3.2. Company / business data
- ›Company name (short and full)
- ›Boutique / wholesale business name
- ›VAT ID / VAT / other tax identifier (country, type)
- ›REGON (if applicable)
- ›Registered office address
- ›Order and transaction history
3.3. Technical data
- ›IP address
- ›Browser type and version
- ›Operating system
- ›Device identifiers
- ›Data from cookies and local storage files
- ›Push subscriptions (endpoint, keys)
3.4. Transaction data
- ›Order numbers
- ›Order values (net, gross, VAT)
- ›Payment method
- ›Bank transfer confirmation files
- ›Payment dates and amounts (deposits, final payments)
- ›Delivery addresses
§ 4. Recipients of personal data
Your personal data may be shared with the following categories of recipients:
IT and hosting service providers
Providers of servers and cloud infrastructure (Platform hosting) as well as email service providers (sending transactional and marketing notifications).
Courier and logistics companies
Carriers delivering orders within Poland and the EU. Data is shared only to the extent necessary to complete delivery (first and last name, delivery address, phone).
Payment service providers
Banking institutions handling transfers.
Analytics and marketing tool providers
Meta Platforms (Facebook Pixel, Conversions API) — only with the User’s consent. Google LLC (reCAPTCHA) — for security verification purposes.
Public authorities
Tax Office, Social Insurance Institution (ZUS), and other public authorities — based on applicable laws.
Legal and accounting advisors
To the extent necessary to meet legal and tax obligations.
Data processing agreements are in place with each entity processing personal data on behalf of the Administrator, in accordance with Art. 28 GDPR, ensuring an appropriate level of data protection.
§ 5. Transfers of data to third countries
Due to the use of Meta Platforms services (Facebook Pixel, Conversions API) and Google LLC (reCAPTCHA), personal data may be transferred to the United States of America.
Legal bases for data transfers:
- aEU-US Data Privacy Framework (DPF) — based on the European Commission decision of 10 July 2023, provided that the given provider is certified under the DPF program.
- bStandard Contractual Clauses (SCC) — approved by Implementing Decision 2021/914. Used as an additional or alternative safeguard.
- cAdditional security measures — encryption in transit and at rest, and pseudonymisation, applied by providers in line with their security policies.
Safeguard clause:
If the adequacy decision for the EU-US DPF is invalidated or challenged, the Administrator will promptly apply alternative transfer mechanisms (Art. 46 GDPR), in particular SCC supplemented with additional technical measures. If an adequate level of protection cannot be ensured, the Administrator will stop transferring data to the relevant third country.
Scope of transfers:
Meta
Meta Platforms — only with consent (Marketing/Tracking category). Browser identifiers, activity data, anonymised IP.
Google LLC (reCAPTCHA) — based on legitimate interest (system security). Only the data necessary to verify forms.
Providers’ privacy policies:
§ 6. Rights of data subjects
Right of access (Art. 15 GDPR)
The right to obtain information on whether the Administrator processes your data and to receive a copy of that data.
Right to rectification (Art. 16 GDPR)
The right to request that inaccurate data be corrected without undue delay or that incomplete data be completed. You can edit your details yourself in the Account settings on the Platform.
Right to erasure (Art. 17 GDPR — right to be forgotten)
The right to request deletion of data when it is no longer necessary, consent has been withdrawn, or a valid objection has been raised. You can delete your Account from the Platform settings (email confirmation required). This does not apply to data that must be retained due to a legal obligation.
Right to restriction of processing (Art. 18 GDPR)
The right to request restriction of processing in specific cases.
Right to data portability (Art. 20 GDPR)
The right to receive data in a structured, commonly used, machine-readable format.
Right to object (Art. 21 GDPR)
The right to object to processing based on the Administrator’s legitimate interest, including profiling.
Right to withdraw consent
You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw cookie consent, use the cookie banner on the Platform.
Right to lodge a complaint with the Polish DPA (UODO)
The right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, tel. 606-950-000.
Withdrawing consent for notifications:
- aAccount settings on the Platform (Notifications section).
- bThe unsubscribe link in the email.
- cBrowser settings (for push notifications).
- dThe cookie banner on the Platform (for marketing and analytics cookies).
- eWithdrawing consent does not stop transactional notifications required to perform the contract.
How to exercise your rights:
- aBy email: kontakt@wloski-hurt.com
- bIn writing, to the Administrator’s registered office address
- cVia the Platform (account deletion, data editing, cookie consent management)
The Administrator will respond to requests without undue delay, no later than 30 days from the date the request is received. In exceptional cases, this period may be extended by a further two months; the Administrator will inform you before the original deadline expires.
§ 7. Data retention period
Personal data is stored for the following periods:
§ 8. Cookies and similar technologies
8.1. What are cookies?
Cookies are small text files stored on the User’s device when using the Platform. They help ensure the website works properly, remember preferences, and — with consent — support analytics and marketing purposes.
8.2. Types of cookies used on the Platform
Required for proper operation: login, sessions, cart, language and currency preferences, cookie consents
Przykłady: Session tokens, language preferences, cookie-consent-v2, cart (localStorage)
Collecting anonymous data on how the Platform is used (statistics, most visited pages, navigation paths)
Przykłady: Analytics session identifiers, visit duration data
Conversion tracking and ad personalisation (Facebook Pixel, Conversions API)
Przykłady: _fbp, _fbc, fr (Meta Platforms)
8.3. Local Storage
The Platform uses Local Storage to store:
- ashopping cart data,
- bcookie preferences (cookie-consent-v2),
- cauthentication tokens,
- dnotification preferences,
- elanguage and currency preferences,
- fService Worker session data,
- gencrypted login data (when “remember me” is enabled).
Local Storage processes data only on the User’s device and is not automatically sent to the server (unlike cookies).
Data behaviour on logout:
- aSession data (cart, tokens) is deleted on logout.
- bPreferences (language, currency, cookie consent) remain after logout for convenience when logging in again.
- cLogin data (“remember me”) remains until it is manually unchecked or Local Storage is cleared.
Managing Local Storage:
- aData does not have an automatic expiry date (the application deletes it explicitly, e.g. on logout).
- bThe User can delete the data in browser settings: Privacy → Clear browsing data → Cookies and other site data.
- cClearing Local Storage may require you to log in again, provide consent again, and may remove items from your cart.
8.4. Managing cookies
On your first visit, a banner is displayed that lets you: accept all cookies, save individual preferences (enable/disable analytics and/or marketing), or reject all optional cookies.
You can change your cookie preferences at any time by clicking the Cookie settings link in the Platform footer or in your browser settings. Blocking essential cookies may prevent you from using certain Platform features.
8.5. Third-party services
§ 9. Automated decision-making and profiling
The Administrator does not use automated decision-making, including profiling within the meaning of Art. 22 GDPR, that would produce legal effects concerning the User or similarly significantly affect them.
The Platform’s volume discount system is based on fixed, transparent pricing rules (visible on each product) and does not constitute profiling within the meaning of the GDPR.
Account verification (tax ID/VAT) is a manual process carried out by the Platform administrator.
§ 10. Data security
The Administrator applies appropriate technical and organisational measures to ensure the security of the processed personal data.
Data transmission encryption:
- aSSL/TLS connection (HTTPS protocol) for all communication with the Platform.
- bEncryption of sensitive data in transit and at rest.
Access control:
- aOnly authorised persons have access to the data.
- bPermissions and roles system (administrator, user).
- cPasswords are stored in encrypted form.
Regular backups:
- aAutomatic database backups.
Security monitoring:
- aMonitoring of unauthorised access attempts.
- bLogging of security events (login logs, status changes).
- creCAPTCHA v3 to protect registration and login forms.
Protection against attacks:
- aRate limiting on API endpoints.
- bInput data validation.
- cProtection against CSRF, XSS, SQL injection attacks.
§ 11. Personal data breaches
In the event of a personal data breach that may result in a risk to the rights or freedoms of natural persons, the Administrator will:
- aReport the breach to the President of the Personal Data Protection Office (UODO) without undue delay, no later than 72 hours after becoming aware of it (Art. 33 GDPR).
- bInform the data subjects if the breach may result in a high risk to their rights or freedoms (Art. 34 GDPR).
The Administrator keeps a register of personal data breaches.
§ 12. Children’s data
The Platform is not intended for persons under 18 years of age.
The Administrator does not knowingly collect personal data from minors.
The Platform is intended exclusively for businesses (B2B).
§ 13. Changes to the Privacy Policy
The Administrator reserves the right to make changes to this Privacy Policy.
Users will be informed of any changes:
- aVia a notification on the Platform.
- bBy email to the address provided during registration.
Changes take effect on the date indicated in the notification, but not earlier than 14 days from the publication of the updated Privacy Policy.
Using the Platform after the changes take effect means you accept the updated Privacy Policy.
§ 14. Contact regarding data protection
If you have questions about data processing, would like to exercise your rights, or have any privacy-related concerns, please contact us:
GHInvestAgency Gracjan Hinz
Company details
Supervisory authority:
President of the Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warsaw
https://uodo.gov.plHelpline: 606-950-000