Mon-Fri09:00-17:00

Sat-Sunday off

Privacy policy

Privacy Policy

I. General provisions

  1. This Privacy Policy of the online store vsb-store.pl (hereinafter: the Online Store) is informational in nature and does not impose any obligations on Buyers. It sets out the rules for the processing of personal data by the Controller in the Online Store, including the legal bases, purposes and scope of processing, the rights of data subjects, and information on the use of cookies and analytics and marketing tools.

  2. The controller of personal data collected through the Online Store is VSB.STORE Spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, ul. Bydgoska 6, 30-056 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, under KRS number: 0000983007, REGON: 522616547, NIP (tax ID): 6772481439, tel.: +48 728 832 449, e-mail: vsb.store.pl@gmail.com (hereinafter: the "Controller"), which is also the Seller.

  3. Personal data in the Online Store are processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter "GDPR".

  4. Using the Online Store, including making purchases, is voluntary. Providing personal data in connection with purchases is voluntary, subject to the following exceptions:

    • concluding agreements with the Controller – failure to provide the data necessary to conclude and perform a Sales Agreement or an agreement for the provision of an Electronic Service makes it impossible to conclude such an agreement. In this case, providing the data is a contractual requirement. The scope of data required to conclude an agreement is indicated each time on the Online Store website and in the Terms and Conditions of Sale and Provision of Electronic Services;
    • statutory obligations of the Controller – providing the data is a statutory requirement arising from legal provisions obliging the Controller to process personal data (e.g. for keeping tax or accounting records). Failure to provide the data will prevent the Controller from fulfilling these obligations.

  5. The Controller takes particular care to protect the interests of data subjects and ensures that the data it collects are:

    • processed lawfully;
    • collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes;
    • accurate and adequate in relation to the purposes for which they are processed;
    • kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of processing;
    • processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

  6. Taking into account the nature, scope, context and purposes of processing and the risk to the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures to ensure that processing is carried out in accordance with the GDPR and to be able to demonstrate this. These measures are reviewed and updated where necessary. The Controller applies technical measures to prevent unauthorised persons from obtaining and modifying personal data transmitted electronically.

  7. All words, expressions and acronyms in this Privacy Policy beginning with a capital letter (e.g. Seller, Buyer, Online Store) should be understood in accordance with their definitions in the Terms and Conditions of Sale and Provision of Electronic Services available on the Online Store website.

II. Legal bases for processing

  1. The Controller is entitled to process personal data where – and to the extent that – at least one of the following conditions is met:

    • the data subject has given consent to the processing of his or her personal data for one or more specific purposes (Art. 6(1)(a) GDPR);
    • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR);
    • processing is necessary for compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR);
    • processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Art. 6(1)(f) GDPR).

  2. Processing of personal data by the Controller always requires at least one of the bases indicated in section II.1. The specific legal bases for individual purposes are indicated in section III.

III. Purpose, legal basis, period and scope of processing

The purpose, legal basis, period, scope and recipients of personal data depend each time on the actions taken by a given Buyer in the Online Store. The Controller may process personal data for the following purposes:

1. Performance of a Sales Agreement or an agreement for the provision of an Electronic Service, including maintaining the Buyer's Account, or taking steps at the request of the data subject prior to entering into these agreements

  • Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
  • Period: for the time necessary to perform, terminate or otherwise end the agreement, and in the case of an Account – until it is deleted.
  • Scope: first name and surname; e-mail address; telephone number; delivery address (street, building number, apartment number, postal code, town, country); address of residence / place of business / registered office (if different from the delivery address); purchase history; order status. In the case of Buyers who are not consumers, the Controller may additionally process the company name and tax identification number (NIP).

2. Participation in the loyalty programme and referral programme

  • Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
  • Period: for the duration of participation in the programme.
  • Scope: Buyer's Account data, order history and value, discounts and bonuses granted.

3. Handling returns and complaints

  • Legal basis: Art. 6(1)(c) GDPR (legal obligation arising from consumer rights and statutory warranty provisions).
  • Period: for the time necessary to handle the return or complaint, and then until the limitation period for claims expires.
  • Scope: first name and surname; e-mail address; telephone number; address; order data and other data provided in the return form or complaint.

4. Responding to enquiries sent via contact forms, by telephone, by e-mail or via messaging apps

  • Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest in responding to the enquiry).
  • Period: for the time necessary to respond and handle the enquiry.
  • Scope: first name; e-mail address; telephone number; content of the message.

5. Handling applications for wholesale cooperation

  • Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract).
  • Period: for the time necessary to consider the application and, if cooperation is established, for its duration.
  • Scope: first name; e-mail address; telephone number; company data provided while agreeing the terms of cooperation.

6. Marketing of the Controller's own services and products, including profiling as described in section V

  • Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest). Commercial information is sent by electronic means (e-mail, SMS) and marketing calls are made only with consent (section III.7).
  • Period: for as long as the legitimate interest exists, but no longer than until the limitation period for claims expires or an effective objection is raised.
  • Scope: first name and surname; e-mail address; telephone number; purchase history; information about activity in the Online Store.

7. Sending the Newsletter and commercial information

  • Legal basis: Art. 6(1)(a) GDPR (consent given when subscribing to the Newsletter).
  • Period: until consent is withdrawn. Consent may be withdrawn at any time via the Seller's website, by e-mail to vsb.store.pl@gmail.com, by telephone at +48 728 832 449, or in writing to the Controller's address. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
  • Scope: e-mail address and other data provided when subscribing to the Newsletter.

8. Keeping tax or accounting records, including issuing VAT invoices

  • Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 86 § 1 of the Polish Act of 29 August 1997 – Tax Ordinance (Ordynacja podatkowa) or Art. 74(2) of the Polish Act of 29 September 1994 on Accounting (ustawa o rachunkowości).
  • Period: for the period required by law: until the limitation period for the tax liability expires, unless tax laws provide otherwise, or 5 years from the beginning of the year following the financial year to which the data relate.
  • Scope: first name and surname; address of residence / place of business / registered office; company name and tax identification number (NIP) of the Buyer.

9. Publishing product reviews in the Online Store

  • Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest in presenting Buyers' reviews).
  • Period: for as long as the review is published or until an effective objection is raised.
  • Scope: first name or signature provided with the review; content of the review.

10. Establishing, pursuing or defending claims

  • Legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest).
  • Period: until the limitation period for claims expires. This period is set by law, in particular the Polish Civil Code (the basic limitation period for claims related to business activity is three years, and for sales agreements – two years).
  • Scope: first name and surname; telephone number; e-mail address; delivery address; address of residence / place of business / registered office; order data. In the case of Buyers who are not consumers – additionally the company name and tax identification number (NIP).

11. Analysing traffic in the Online Store and displaying advertisements (analytics and marketing cookies)

  • Legal basis: Art. 6(1)(a) GDPR (consent given in the cookie banner).
  • Period: until consent is withdrawn or the cookies expire.
  • Scope: online identifiers, device and browser information, approximate location, information about activity in the Online Store.

IV. Recipients of data

  1. To ensure the proper functioning of the Online Store, including the performance of Sales Agreements, the Controller uses the services of external entities. The Controller uses only processors that provide sufficient guarantees of implementing appropriate technical and organisational measures so that processing meets the requirements of the GDPR and protects the rights of data subjects.

  2. The Controller transfers data only when this is necessary to achieve a given purpose of processing and only to the extent necessary to achieve it.

  3. Buyers' personal data may be transferred to the following recipients or categories of recipients:

    • carriers, forwarders and courier brokers – to the extent necessary to deliver the Product to the Buyer;
    • providers of electronic and card payment services – to the extent necessary to process the payment;
    • providers of technical, IT and organisational solutions, in particular software for running the Online Store, e-mail and hosting, and software for business management and technical support;
    • providers of accounting, legal and advisory services, in particular an accounting office, law firm or debt collection company;
    • providers of marketing and analytics services, including the providers of the tools listed in section VII.

V. Profiling

  1. The GDPR obliges the Controller to provide information about automated decision-making, including profiling referred to in Art. 22(1) and (4) GDPR, as well as about the logic involved and the envisaged consequences for the data subject.

  2. The Controller may use profiling for the purpose of marketing its own services and products. Decisions made on this basis do not concern the conclusion or refusal to conclude a Sales Agreement or the ability to use Electronic Services. Profiling may result, for example, in granting a discount, sending a discount code, sending a reminder about an unfinished purchase, sending a proposal for a Product that may match the person's interests, or offering better terms than the standard offer. The data subject decides freely whether to take advantage of such an offer.

  3. Profiling consists of the automatic analysis or prediction of a person's behaviour in the Online Store, e.g. based on adding a Product to the basket, viewing a Product page or purchase history.

  4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

VI. Rights of the data subject

  1. Right of access, rectification, restriction, erasure or portability – the data subject has the right to request from the Controller access to his or her personal data, their rectification, erasure ("right to be forgotten") or restriction of processing, as well as the right to data portability. The detailed conditions for exercising these rights are set out in Art. 15–21 GDPR.

  2. Right to withdraw consent – a person whose data are processed on the basis of consent has the right to withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal.

  3. Right to lodge a complaint with a supervisory authority – the data subject has the right to lodge a complaint with a supervisory authority in the manner set out in the GDPR and the Polish Act of 10 May 2018 on the Protection of Personal Data. The supervisory authority in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

  4. Right to object – the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of his or her personal data based on Art. 6(1)(f) GDPR, including profiling. In such a case, the Controller may no longer process those data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

  5. Right to object to marketing – where personal data are processed for the purpose of marketing the Controller's own services and products, the data subject has the right to object at any time to such processing, including profiling.

  6. To exercise the above rights, please contact the Controller in writing or by e-mail at the address indicated in section I.2.

VII. Cookies and third-party tools

  1. Cookies are small text files stored on the device of a person visiting the Online Store (e.g. a computer, laptop or smartphone).

  2. The Controller uses the following types of cookies:

    • necessary – enable the proper functioning of the Online Store, including logging in, remembering Products in the basket and placing an Order. They are used on the basis of the Controller's legitimate interest (Art. 6(1)(f) GDPR) and do not require consent;
    • analytics – used to compile statistics on the use of the Online Store and to improve its operation;
    • marketing – used to display advertisements tailored to visitors' interests, including on other websites (remarketing), and to measure the effectiveness of advertising.

  3. Analytics and marketing cookies are used only with consent. On the first visit to the Online Store, a banner is displayed in which you can choose "Necessary only" or "Accept all". Consent may be withdrawn at any time by deleting cookies in the browser settings – the banner will then be displayed again. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

  4. Restricting or disabling cookies in the browser settings may affect some functions of the Online Store.

  5. The following third-party tools are used in the Online Store:

    • Google Tag Manager – a tool for managing scripts on the website. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
    • Google Analytics 4 – analysis of traffic and of how the Online Store is used. The data collected include, among others, the traffic source, pages visited, device and browser information, approximate location determined on the basis of the IP address, as well as demographic data and interests. The data are statistical in nature and are not used by the Controller to identify specific individuals. Provider: Google Ireland Limited. Active only with consent. You can additionally block the transfer of data to Google Analytics by installing a browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en
    • Google Ads – displaying advertisements in the Google search engine and advertising network and measuring their effectiveness. Provider: Google Ireland Limited. Active only with consent.
    • Meta Pixel – measuring the effectiveness of advertisements and displaying advertisements on Facebook and Instagram. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Active only with consent.
    • TikTok Pixel – measuring the effectiveness of advertisements and displaying advertisements on TikTok. Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Active only with consent.
    • Hotjar – analysis of how the website is used (including click maps and session recordings) in order to improve the Online Store. Provider: Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta. Active only with consent.
    • Microsoft Clarity – analysis of how the website is used (including click maps and session recordings) in order to improve the Online Store. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Active only with consent.
    • Google reCAPTCHA – protecting website forms against spam and abuse. Provider: Google Ireland Limited. Legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR).

  6. The Online Store contains links to the Controller's profiles on Instagram, Facebook and TikTok and allows contact via Messenger and WhatsApp. When you contact us through these services, personal data are also processed by their operators (Meta Platforms Ireland Limited, TikTok Technology Limited) in accordance with their own privacy policies.

VIII. Transfers of data outside the European Economic Area

Some service providers used by the Controller (in particular Google, Meta, Microsoft, TikTok and PayPal) may transfer personal data to countries outside the European Economic Area, including the United States. In such cases, the transfer is based on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. A copy of the safeguards can be obtained by contacting the Controller.

IX. Final provisions

  1. This Privacy Policy applies only to the vsb-store.pl Online Store. The Online Store may contain links to other websites. The Controller recommends reading the privacy policies applicable on those websites.

  2. If you have any questions about the Online Store or this Privacy Policy, please contact the Controller: vsb.store.pl@gmail.com, tel. +48 728 832 449 (Mon–Fri 9:00–17:00).

Last modified: 15.10.2026

In order to provide the highest level of service, our site uses cookies. You can change your browser settings at any time.More detailed information can be found in the tab privacy