1. Data Controller
The data controller is Speed-Bud Sp. z o.o., ul. M. Przesmyckiego 31–33, 51-151 Wrocław, NIP 895-229-22-50, REGON 930462597, KRS 0001191539. Contact regarding personal data protection: biuro@speed-bud.pl.
2. Purposes and legal bases for data processing
|
Purpose of processing |
Legal basis (GDPR) |
Retention period |
|
Fulfilment of an order / sales contract |
Article 6(1)(b) |
the duration of the contract + the limitation period for claims |
|
Customer Account management |
Article 6(1)(b) |
until the account is deleted |
|
Accounting/tax obligations |
Article 6(1)(c) |
the period required by law (as a rule, 5 years from the end of the tax year) |
|
Direct marketing (own products) |
Article 6(1)(f) (legitimate interest) |
Right to object |
|
Newsletter (mailing list) |
Article 6(1)(a) (consent) |
to withdraw consent / unsubscribe |
|
Website traffic analysis — Google Analytics |
Article 6(1)(a) (consent via the cookie banner) |
in accordance with the tool’s settings / until consent is withdrawn |
|
Personalised adverts — Meta Pixel, Google Ads |
Article 6(1)(a) (consent via the cookie banner) |
in accordance with the tool’s settings / until consent is withdrawn |
|
Establishment, pursuit and defence of claims |
Article 6(1)(f) |
limitation period for claims |
|
Fulfilment of orders placed via marketplaces (Allegro, ERLI, OLX, MachineryLine) — data received via BaseLinker |
Article 6(1)(b) (performance of the sales contract) |
order fulfilment period + limitation period for claims |
3. Consent to marketing
Consent to the processing of data for marketing purposes is entirely voluntary and is not a condition for placing or fulfilling an order. Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to its withdrawal.
4. Recipients of data
Data may be transferred to entities cooperating with the Controller to the extent necessary for the proper provision of services and the performance of contracts, including:
- Payment and financial service providers: Przelewy24 (PayPro S.A.), InPost Pay (InPost Finanse Sp. z o.o.) and the leasing finance provider — LeaseLink Sp. z o.o. (only if this payment method is selected);
- Courier and freight forwarding companies and logistics operators: responsible for the delivery of the ordered Goods, including in particular: InPost, DPD, DHL, Pocztex / Poczta Polska and other partner courier firms, as well as specialist pallet and general cargo carriers (for bulky Goods);
- Providers of technological and IT solutions: the sales management system provider (BaseLinker), hosting and server service providers (OVH), the provider of the order integration system with the accounting and warehouse management system (Sellintegro), and the provider of the ERP accounting and warehouse management software (Subiekt GT);
- Operators of sales platforms and marketplaces: (Allegro, ERLI, OLX, MachineryLine and other services through which orders are fulfilled) — to the extent necessary to process transactions;
- Entities providing support services: an accountancy and bookkeeping firm, and entities providing legal or debt collection services (where necessary);
- Providers of analytical, marketing and communication tools: Google Analytics, Meta Pixel, Google Ads and providers of email and SMS messaging systems.
Data is transferred only to the extent necessary to fulfil the purposes set out in point 2, on the basis of data processing agreements (Article 28 of the GDPR) or to entities acting as independent data controllers (e.g. payment and financial service providers, postal operators and couriers).
5. Transfer of data outside the European Economic Area
The website is hosted on OVH servers located within the European Union — in this respect, no data is transferred outside the EEA. Due to the use of Google Analytics, Google Ads and Meta Pixel, whose providers (Google LLC, Meta Platforms Inc.) are based in the USA, data may be transferred to countries outside the EEA. This takes place on the basis of standard contractual clauses approved by the European Commission or on the basis of the provider’s participation in the EU-US Data Privacy Framework, which ensure an adequate level of data protection.
6. Rights of the data subject
Every individual has the right to: access their data, have it rectified, have it erased, restrict its processing, data portability, object to processing based on a legitimate interest, and lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
7. Cookies
1. The Website uses cookies, the consent for which is managed by the Cookiebot tool (by SEIGI).
2. Cookies necessary for the proper functioning of the Website (e.g. session maintenance, shopping basket management, authentication) are used automatically without the need to obtain the User’s prior consent.
3. Analytical, functional and advertising cookies are installed only after obtaining the User’s prior, voluntary consent, expressed via the cookie banner displayed on their first visit to the Website.
4. The User may, at any time, amend the scope of their consents or withdraw them entirely with immediate effect. Consents are managed by:
- Clicking on the cookie icon located in the bottom left-hand corner of the screen on every subpage of the Website,
- Changing the cookie settings directly in the User’s web browser.
5. The Website uses the following categories of cookies:
- Essential — session maintenance, shopping basket functionality, authentication, security;
- Analytical — analysing traffic and user behaviour (e.g. Google Analytics);
- Advertising — tailoring advertising content and measuring campaign effectiveness (e.g. Meta Pixel, Google Ads).
A detailed list of the cookies used, together with a description of their purpose and exact retention period, is available at any time by opening the Cookiebot consent management panel.
8. Changes to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy. Users will be notified of any significant changes via an announcement on the Website’s home page.