Privacy Policy

Published On: 30/10/2026

1. DATA CONTROLLER
1.1. The controller of personal data processed in connection with the use of the Online Shop www.ozdowski.eu is OZDOWSKI Sp. z o.o. with its registered office in Kłodzko, ul. Zajęcza 4H, 57-300 Kłodzko, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001211956, Tax ID (NIP): 8831885100, REGON: 543608741, e-mail address: e-sklep@ozdowski.eu, tel.: +48 535 515 104 (hereinafter: the “Controller”).
1.2. In matters relating to the processing of personal data, the Controller can be contacted by e-mail at e-sklep@ozdowski.eu or in writing at the address of the Controller's registered office.
1.3. This Privacy Policy fulfils the information obligation set out in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: “GDPR”). Capitalised terms (e.g. Customer, Service Recipient, Sales Agreement, Account) shall be understood in accordance with their definitions contained in the Terms and Conditions of the Online Shop.

2. PURPOSES, LEGAL BASES AND PERIOD OF DATA PROCESSING
2.1. The Controller processes personal data for the following purposes, on the following legal bases and for the following periods:
2.1.1. conclusion and performance of the Sales Agreement, including delivery of the Product and payment handling - Article 6(1)(b) GDPR (necessity for the performance of a contract or to take steps prior to entering into it) - for the duration of the performance of the contract;
2.1.2. provision of Electronic Services, in particular maintaining the Account - Article 6(1)(b) GDPR - until the Account is deleted;
2.1.3. handling complaints and withdrawals from the contract - Article 6(1)(c) GDPR in conjunction with the provisions of the Consumer Rights Act and the Civil Code - for the period of the Seller's liability and the limitation period for claims;
2.1.4. issuing invoices, keeping accounting records and fulfilling tax obligations, including verification of the EU VAT number in the VIES system - Article 6(1)(c) GDPR in conjunction with tax regulations and the Accounting Act - for the period required by these regulations (as a rule 5 years, counted from the end of the calendar year in which the tax payment deadline expired);
2.1.5. establishing, pursuing or defending claims - Article 6(1)(f) GDPR (legitimate interest of the Controller) - until the expiry of the limitation period for claims;
2.1.6. handling enquiries sent to the Controller electronically or by telephone, including advice on the selection of Products - Article 6(1)(b) GDPR (if the enquiry concerns the conclusion of a contract) or Article 6(1)(f) GDPR - for the time necessary to respond and then until the expiry of the limitation period for any claims;
2.1.7. sending the Newsletter and other commercial information by electronic means - Article 6(1)(a) GDPR (consent) in conjunction with Article 398 of the Polish Act of 12 July 2024 - Electronic Communications Law - until consent is withdrawn;
2.1.8. direct marketing of the Controller's own Products to Customers, excluding information sent by electronic means without consent - Article 6(1)(f) GDPR - until an objection is raised;
2.1.9. keeping statistics and analyses of the use of the Online Shop and marketing activities using cookies - Article 6(1)(a) GDPR (consent given in the cookie banner) - until consent is withdrawn or the cookie expires;
2.1.10. ensuring the security of the Online Shop and administering it - Article 6(1)(f) GDPR - for the period indicated in section 8.5.
2.2. The legitimate interests of the Controller referred to in section 2.1 are: establishing, pursuing and defending claims, responding to enquiries, direct marketing of its own Products and ensuring the security of the Online Shop.

3. SCOPE OF DATA AND VOLUNTARY NATURE OF PROVIDING THEM
3.1. The Controller may process the following data: first and last name; e-mail address; telephone number; delivery address and address of residence, place of business or registered office (if different from the delivery address); in the case of Customers who are not consumers - company name, tax identification number (NIP) and EU VAT number; data concerning Orders, payments, complaints and returns; content of correspondence; IP address and other technical data of the device.
3.2. The Controller does not process full payment card data - they are processed exclusively by the payment operator.
3.3. Providing personal data is voluntary, but necessary to conclude and perform the Sales Agreement or the agreement for the provision of an Electronic Service; failure to provide data makes it impossible to conclude the agreement. Providing the data necessary to issue an invoice is a statutory requirement. Consent to receive the Newsletter and to cookies other than strictly necessary ones is voluntary and is not a condition for concluding the agreement.

4. RECIPIENTS OF DATA
4.1. Personal data may be transferred, to the extent necessary for the purposes indicated in section 2, to the following categories of recipients:
4.1.1. carriers and courier companies, including international carriers and customs agencies - in the case of delivery of the Product;
4.1.2. electronic and card payment operators - if such a payment method is chosen;
4.1.3. the external accounting firm keeping the Controller's accounts;
4.1.4. IT service providers, in particular: hosting and the Online Shop platform, e-mail and office tools, accounting, sales and warehouse systems, and the Newsletter sending service;
4.1.5. providers of analytical and marketing tools - only after voluntary consent has been given in the cookie banner, which is operated by a consent management tool that blocks these tools from running until consent is given;
4.1.6. entities providing legal assistance and debt collection - to the extent necessary to pursue claims;
4.1.7. public authorities - only where the obligation to transfer data results from legal provisions.
4.2. Entities processing data on behalf of the Controller act on the basis of data processing agreements (Article 28 GDPR) and only in accordance with the Controller's instructions.

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
5.1. In the case of delivery of the Product to a country outside the European Economic Area (e.g. the United Kingdom, Switzerland, Ukraine, the United States, Canada), the data necessary to deliver the shipment and for customs clearance are transferred to the carrier and the competent authorities in that country. The basis for the transfer is a decision of the European Commission establishing an adequate level of protection (including the United Kingdom, Switzerland, Canada) or - in other cases - the necessity of the transfer for the performance of the contract (Article 49(1)(b) GDPR).
5.2. Some IT service providers, including Google, may process data in the United States. The transfer takes place on the basis of the European Commission's adequacy decision under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). A copy of the safeguards can be obtained by contacting the Controller.

6. RIGHTS OF DATA SUBJECTS
6.1. Every data subject has the right to: (1) access their data (Article 15 GDPR); (2) rectification of data (Article 16 GDPR); (3) erasure of data (Article 17 GDPR); (4) restriction of processing (Article 18 GDPR); (5) data portability (Article 20 GDPR) - with respect to data processed on the basis of a contract or consent; (6) object to the processing of data (Article 21 GDPR) - with respect to data processed on the basis of the Controller's legitimate interest.
6.2. An objection to the processing of data for direct marketing purposes is effective unconditionally - once it has been raised, the data will no longer be processed for this purpose.
6.3. Consent to the processing of data may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. Consent to the Newsletter may also be withdrawn via the unsubscribe link in each message, and consent to cookies - in the cookie settings, which are always available as a cookie icon in the bottom right corner of the Online Shop screen.
6.4. To exercise the above rights, please contact the Controller in the manner indicated in section 1.2. The Controller responds without undue delay, no later than within one month of receiving the request; in justified cases this period may be extended by a further two months, of which the Controller will inform the data subject.
6.5. The data subject has the right to lodge a complaint with a supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) or the supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.

7. AUTOMATED DECISION-MAKING
7.1. The Controller does not make decisions based solely on automated processing of data, including profiling, which would produce legal effects concerning the data subject or similarly significantly affect them.

8. COOKIES AND TECHNICAL DATA
8.1. Cookies are small text files stored on the device of a person visiting the Online Shop.
8.2. The Online Shop uses strictly necessary cookies without which it could not function properly - in particular to maintain the session of a logged-in Service Recipient, remember the contents of the basket, ensure security and remember the choices made in the cookie banner. The use of these files does not require consent (Article 399(3) of the Polish Electronic Communications Law).
8.3. Analytical and marketing cookies are used only after consent has been given in the cookie banner displayed on the first visit to the Online Shop. Until consent is given, the scripts of these tools are not run and no data are sent to them. The Online Shop uses the following tools: Google Analytics 4, Google Ads, Meta Pixel, TikTok Pixel.
8.4. Consent to cookies can be changed or withdrawn at any time in the cookie settings, which are always available as a cookie icon in the bottom right corner of the Online Shop screen. Cookies can also be deleted or blocked in the web browser settings; blocking strictly necessary cookies may prevent the use of some functions of the Online Shop, including placing an Order.
8.5. The Online Shop server automatically records technical data (logs), including the IP address, the date and time of the visit and the browser type. These data are processed in order to ensure the security and administration of the Online Shop for a period of 14 days and are not disclosed to other entities, except for the hosting provider and authorities entitled under the law.

9. DATA SECURITY
9.1. The Controller applies technical and organisational measures ensuring protection of personal data appropriate to the risk (Article 32 GDPR), in particular: an encrypted SSL/TLS connection, access to the Account only after entering a login and password, limiting access to data to authorised persons and regular backups.

10. FINAL PROVISIONS
10.1. The Online Shop may contain links to other websites. This Privacy Policy applies only to the Online Shop www.ozdowski.eu; after moving to other websites, please read the privacy rules applicable there.
10.2. The Privacy Policy is available in the following language versions: Polish, English and German.
10.3. The Controller may amend this Privacy Policy, in particular in the event of changes in the law or in the way data are processed. The current version is always available on the Online Shop website.
10.4. The Privacy Policy applies from 26.10.2026.