Privacy Policy

In this policy we explain what personal data we collect in the online shop [TO BE COMPLETED: shop name and website address] (the “Shop”), for what purposes, who we share it with and what rights you have. We also describe cookies. Capitalised terms have the meaning given to them in the Terms and Conditions.

1. Data controller

The data controller of your personal data is Katarzyna Butler, running a business under the business name KATARZYNA BUTLER, ul. Kawalerzystów 28/3, 53-004 Wrocław, NIP 9291686069, REGON 388276767 (“we” or the “Controller”).

For matters relating to personal data, write to [TO BE COMPLETED: shop e-mail address], call +48 601 788 135 or send a letter to the address above. We have not appointed a data protection officer.

2. Where we get data from

• From you: when you place an order, create an Account, write to us, use the “Notify me” service or extend a rental.
• Automatically: from cookies and similar technologies (section 9) and from server logs (IP address, date and time, browser type).
• From the Payment Operator and the Carriers: information on the status of payments, refunds and parcels.

3. Purposes and legal bases of processing

• Conclusion and performance of the Rental Agreement: accepting the order and payment, dispatch and return of the Equipment, settlement of the Deposit, extension of the rental, order messages and reminders about dispatch and return dates. Legal basis: Article 6(1)(b) GDPR (contract).
• Account: maintaining the Account and order history. Legal basis: Article 6(1)(b) GDPR.
• Legal obligations: issuing and storing accounting documents, handling complaints, handling withdrawals from the Agreement. Legal basis: Article 6(1)(c) GDPR.
• Return report and claims: documenting the condition of returned Equipment (photographs), settling damage and delays, pursuing claims and defending against them. Legal basis: Article 6(1)(f) GDPR (our legitimate interest).
• Contact: replying to e-mails, telephone calls and contact form messages. Legal basis: Article 6(1)(f) GDPR and, where the enquiry concerns an order, also Article 6(1)(b) GDPR.
• “Notify me”: a single e-mail when the selected dates become available. Legal basis: Article 6(1)(a) GDPR (consent).
• Visit statistics (Google Analytics 4): only after consent to analytics cookies. Legal basis: Article 6(1)(a) GDPR and Article 399 of the Electronic Communications Law Act (Prawo komunikacji elektronicznej).
• Marketing: recording the source of the visit with the order (e.g. campaign, search engine) and future advertising campaigns, only after consent to marketing cookies. Legal basis: Article 6(1)(a) GDPR.
• Shop security: server logs, protection against abuse and attacks. Legal basis: Article 6(1)(f) GDPR.
• [TO DECIDE: newsletter]: if launched, only with consent (Article 6(1)(a) GDPR).

Providing data is voluntary, but without the data needed for an order (first name and surname, e-mail address, telephone number, address or pick-up point) we cannot conclude and perform the Agreement. The telephone number and e-mail address are also needed by the Carrier for parcel notifications.

4. Who we share data with

• The hosting provider on whose servers the Shop runs: [TO BE COMPLETED: company name].
• The provider of e-mail services and of message sending from the Shop: [TO BE COMPLETED: company name].
• The Payment Operator: PayPro S.A. with its registered office in Poznań (Przelewy24), to the extent necessary for payments and refunds.
• The Carriers: InPost sp. z o.o. with its registered office in Kraków and DPD Polska sp. z o.o. with its registered office in Warsaw, to the extent necessary to deliver and return the Equipment.
• The accounting office that keeps the Controller’s accounts: [TO BE COMPLETED: name of the office].
• The IT company that maintains and develops the Shop: [TO BE COMPLETED: e.g. MobilitySoft, if it will have access to data as part of technical support].
• Google Ireland Limited (Google Analytics 4), only after consent to analytics cookies.
• Public authorities, where required by law.

We conclude data processing agreements with the providers that process data on our behalf. The Payment Operator and the Carriers process some of the data as separate controllers, on the terms described in their own privacy policies. [FOR LEGAL REVIEW: role of each recipient]

5. Transfers of data outside the European Economic Area

Data collected by Google Analytics may be transferred to Google LLC in the United States. Google LLC participates in the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection (decision of 10 July 2023). Standard contractual clauses provide an additional safeguard. Our other providers process data within the European Economic Area. [TO BE VERIFIED once the hosting and e-mail providers have been chosen]

6. How long we keep data

• Data from the Rental Agreement: until the limitation period for claims expires (as a rule 6 years; claims for damage to the Equipment become time-barred one year after its return).
• Accounting documents: 5 years from the end of the calendar year in which the tax payment deadline fell.
• Photographs from the return report: until the Deposit is settled and, in the event of a dispute, until the dispute ends, but no longer than one year after the return of the Equipment, unless proceedings are pending.
• Account: until it is deleted.
• “Notify me”: until the notification is sent or consent is withdrawn, but no longer than [TO DECIDE: 6 months].
• Correspondence: up to one year after the matter is closed [TO DECIDE].
• Data in Google Analytics: [TO DECIDE: 2 or 14 months, a setting in the Google Analytics panel].
• Choice made in the cookie banner: 180 days, after which we will ask again.
• Server logs: [TO BE COMPLETED: according to the hosting provider’s settings].

7. Your rights

• The right of access to your data and to obtain a copy of it (Article 15 GDPR).
• The right to rectification of your data (Article 16 GDPR).
• The right to erasure of your data (Article 17 GDPR).
• The right to restriction of processing (Article 18 GDPR).
• The right to portability of data processed on the basis of a contract or consent (Article 20 GDPR).
• The right to object to processing based on legitimate interest (Article 21 GDPR).
• The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. You can change your cookie consents at any time via the Cookie settings link in the website footer.
• The right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl).

To exercise your rights, write to us (section 1). We will reply without undue delay and in any event within one month.

8. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The availability calendar and the extension surcharge are calculated automatically according to the rules set out in the Terms and Conditions, which are the same for everyone.

9. Cookies

Cookies are small text files stored in your browser. We use strictly necessary cookies without consent, because the Shop cannot work without them. We store analytics and marketing cookies only after you give your consent in the banner (Article 399 of the Electronic Communications Law Act). Until you make your choice, all analytics and advertising consents are switched off (Google Consent Mode v2: “denied” state), and the Google Analytics script is not loaded at all.

Strictly necessary (always active)

• wyp_zgody: remembers your choice in the cookie banner; 180 days.
• woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*: basket and placing an order; until the browser is closed or up to 2 days.
• wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie, wp-settings-*: logging in to the Account and its settings; until you log out or up to 14 days (wp-settings-*: up to one year).
• wp-wpml_current_language, _icl_visitor_lang_js, wpml_browser_redirect_test: choice of language version; until the browser is closed or up to 1 day.
• InPost and DPD pick-up point maps at checkout: loaded from the Carriers’ servers when you choose an InPost parcel locker or a DPD Pickup point; they may store files needed for the map to work. [TO BE VERIFIED: list of files stored by the maps]

Analytics (after consent)

• Google Analytics 4 (_ga, _ga_*): distinguishing users and sessions in visit statistics (pages visited, device and browser type, approximate location); up to 2 years. Provider: Google Ireland Limited. Google Analytics 4 does not store the full IP address.

Marketing (after consent)

• WooCommerce order attribution (sbjs_migrations, sbjs_current_add, sbjs_first_add, sbjs_current, sbjs_first, sbjs_udata, sbjs_session, sbjs_promo): records the source of the visit (e.g. search engine, campaign, referring website) and attaches it to the order; for the session (30 minutes) or up to 6 months.
• Google Ads and other advertising tools: we do not use them at present. If we enable them, we will update this list and the banner will ask for your consent.

How to change your consent

You can change your choice at any time via the Cookie settings link in the footer of every page. If you withdraw analytics consent, we delete the Google Analytics cookies from your browser. You can also delete or block cookies in your browser settings; blocking strictly necessary cookies may make it impossible to place an order.

10. Security

The Shop runs over an encrypted connection (HTTPS). Payments are handled by the Payment Operator, so we do not see your card details. Only authorised persons have access to data in the Shop’s admin panel.

11. Changes to this Privacy Policy

We update this policy when the law, our providers or the tools used in the Shop change. The current version is always available on this page. Date of last change: [TO BE COMPLETED: publication date].