Privacy Policy

This Privacy Policy describes how we process the personal data of persons using the FixWoodSystem online shop, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

1. Data controller

The controller of your personal data is:

Seller: IT Security Michał Pietruczyk (FixWoodSystem)

Address: al. Jana Pawła II 27, 00-867 Warszawa, Polska

NIP (Polish tax identification number): 1251605304

REGON: 382899071

Register: CEIDG - the Central Register and Information on Economic Activity (Centralna Ewidencja i Informacja o Działalności Gospodarczej)

E-mail: [email protected]

Telephone: +48 22 266 21 23

In all matters concerning personal data you may contact us at the e-mail address given above or by ordinary post.

We have not appointed a data protection officer - we are not required to do so, as we neither process personal data on a large scale nor carry out regular and systematic monitoring of individuals.

2. Purposes, legal bases and retention periods

Purpose	Legal basis	Retention period
Conclusion and performance of the contract of sale - processing the order, delivery, communication regarding the order	Art. 6(1)(b) GDPR (necessary for the performance of a contract)	Until the contract has been performed, and thereafter until the limitation periods for claims expire
Handling electronic payments - initiating, authorising and settling the transaction through the payment provider, and processing refunds	Art. 6(1)(b) GDPR (necessary for the performance of a contract)	Until the transaction has been settled, and thereafter for the period required by tax and accounting legislation
Maintaining the customer account	Art. 6(1)(b) GDPR	Until you delete the account or request its deletion
Issuing and retaining accounting records, tax settlements	Art. 6(1)(c) GDPR (legal obligation - the Polish Accounting Act, “ustawa o rachunkowości”, and the Polish Tax Ordinance, “Ordynacja podatkowa”)	Under Polish law, 5 years counted from the end of the calendar year in which the tax payment deadline fell
Handling complaints and withdrawals from the contract	Art. 6(1)(c) and (f) GDPR	Until the matter is closed, and thereafter until the limitation periods for claims expire
Establishing, exercising and defending legal claims	Art. 6(1)(f) GDPR (legitimate interest of the controller)	Until the limitation periods for claims expire
Handling enquiries submitted via the contact form or by e-mail	Art. 6(1)(f) GDPR (responding to your enquiry)	Until the correspondence is concluded, and no longer than 12 months from the last contact
Ensuring the security of the shop, preventing abuse, server logs	Art. 6(1)(f) GDPR	Up to 12 months
Analytics and statistics on the use of the shop	Art. 6(1)(a) GDPR (your consent given in the consent window)	Until consent is withdrawn, and no longer than the period stated in the cookie settings
Analysis of behaviour in the shop (heatmaps and session recordings - Microsoft Clarity)	Art. 6(1)(a) GDPR (your consent to the “marketing” category)	Until consent is withdrawn; Microsoft keeps recordings for up to 30 days and aggregated reports for up to 13 months
Measuring advertising effectiveness and remarketing (Google Ads)	Art. 6(1)(a) GDPR (your consent to the “marketing” category)	Until consent is withdrawn; Google Ads cookies for up to 90 days
Register of consents given and withdrawn (accountability evidence)	Art. 6(1)(c) in conjunction with Art. 7(1) GDPR	Up to 3 years from the withdrawal or expiry of consent

3. Provision of data is voluntary

Providing your data is voluntary but necessary for the conclusion and performance of the contract. Without your address and contact details we are unable to fulfil your order or issue a sales document. A VAT identification number is required only where you wish to receive an invoice made out to a business.

4. Recipients of the data

We may disclose your data to the following categories of recipients, solely to the extent necessary to achieve the purposes set out above:

Hosting provider - Hetzner Online GmbH (Germany), on whose servers the shop operates.
Content delivery and protection network provider - Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. All traffic to the shop passes through the Cloudflare network, which processes technical connection data (IP address, request headers) to deliver pages quickly and protect the shop against attacks - the legal basis is our legitimate interest in the security and operation of the shop (Art. 6(1)(f) GDPR).
E-mail service provider - the entity handling the delivery of transactional messages sent from the shop.
Electronic payment providers - mElements S.A., with its registered office in Warsaw, ul. Prosta 18, 00-850 Warsaw, Poland, KRS 0000590484, NIP 522-304-78-92, a Polish authorised payment institution providing the service under the Paynow brand, and PayPro S.A., with its registered office in Poznań, ul. Pastelowa 8, 60-198 Poznań, Poland, KRS 0000347935, NIP 7792369887, providing payment services under the Przelewy24 brand. We pass on to the provider of the payment method you choose the data required to initiate and settle the transaction: order number, amount, currency, e-mail address and first and last name. We do not receive your payment card details - you enter these directly with the payment provider. In respect of the transaction it carries out, the payment provider is an independent controller and applies its own privacy policy, available at paynow.pl or przelewy24.pl respectively.
Carriers and postal operators - to the extent of the data required to deliver the consignment (first and last name, address, telephone number, e-mail address). We currently use the services of DPD Polska sp. z o.o. and DHL Parcel Polska sp. z o.o.
The provider handling order picking and despatch - the address data required to prepare and despatch the parcel. This is an entity operating a warehouse and order fulfilment facility in Piaseczno, Poland, on our instructions.
Accounting office - to the extent of the accounting records. This is an external accounting office handling the Seller’s settlements.
Provider of the analytics tool - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in respect of the Google Analytics 4 service. The script is loaded solely after you have given your consent to the “statistics” category; until consent is given it is not loaded into your browser at all. Your IP address is truncated (IP anonymisation) before it is analysed. Should we introduce further analytics tools in future, this will be shown to you in the consent window before the relevant scripts are loaded.
Provider of the behaviour analysis tool - Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, in respect of the Microsoft Clarity service. The script is loaded solely after you have given your consent to the “marketing” category; until consent is given it is not loaded into your browser at all.
Provider of the advertising system - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in respect of the Google Ads service. The script is loaded solely after you have given your consent to the “marketing” category; until consent is given it is not loaded into your browser at all.
Public authorities - where an obligation to disclose the data follows from the law.

With entities processing data on our behalf we conclude data processing agreements in accordance with Art. 28 GDPR.

5. Transfers of data outside the European Economic Area

The shop’s server is located within the European Union. Traffic to the shop passes through the Cloudflare network (Cloudflare, Inc., USA), which processes technical connection data - IP address and request headers - also outside the EEA. The transfer is based on the European Commission’s adequacy decision for organisations certified under the EU-US Data Privacy Framework; Cloudflare, Inc. holds this certification. Apart from this, without your consent your data does not leave the European Economic Area; the other recipients listed in section 4 that are necessary to process your order are established within the EEA.

If you give your consent to the “statistics” category in the consent window, data is transferred to Google Ireland Limited; this may also involve processing by Google LLC in the United States. Any such transfer takes place solely on the basis of the mechanisms provided for in Chapter V GDPR - an adequacy decision of the European Commission or standard contractual clauses.

If you give your consent to the “marketing” category, Microsoft Clarity is activated. Data is then transferred to Microsoft Ireland Operations Limited; this may also involve processing by Microsoft Corporation in the United States. Microsoft is certified under the EU-US Data Privacy Framework; the transfer takes place on the same basis as described above.

If you give your consent to the “marketing” category, Google Ads is also activated. Data is then transferred to Google Ireland Limited; this may also involve processing by Google LLC in the United States, on the same basis as described above for Google Analytics 4.

You may withdraw your consent at any time using the Cookie settings link in the shop’s footer. No further transfer takes place from the moment of withdrawal.

Should we introduce further tools from providers established outside the EEA, we will inform you of this in the consent window before any such tool is activated.

6. Your rights

In connection with the processing of your data you have the following rights:

the right of access to your data and to obtain a copy of it (Art. 15 GDPR),
the right to rectification of inaccurate data and to have incomplete data completed (Art. 16 GDPR),
the right to erasure - the “right to be forgotten” (Art. 17 GDPR), save for data which we are required to retain under tax and accounting legislation,
the right to restriction of processing (Art. 18 GDPR),
the right to data portability in respect of data processed on the basis of a contract or of consent (Art. 20 GDPR),
the right to object to processing based on a legitimate interest (Art. 21 GDPR) - set out separately in section 7 below,
the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR),
the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. You may also, independently of this, lodge a complaint with the supervisory authority of the Member State of your habitual residence or place of work.

To exercise any of these rights, please write to us at the e-mail address given in section 1. We respond without undue delay and no later than within one month.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is carried out on the basis of a legitimate interest (Art. 6(1)(f) GDPR).

In our shop this concerns the handling of complaints, the establishment and defence of legal claims, responding to your enquiries, and ensuring the security of the shop, including the server log files.

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

You may raise your objection informally - a message to the e-mail address given in section 1 is sufficient. Raising an objection is free of charge.

8. Automated decision-making and profiling

Your data is not used for automated decision-making, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

9. Cookies and similar technologies

Cookies are small text files which the shop stores in your browser while you use the site and reads on subsequent page views. They allow the shop to recognise your session and to remember the contents of your basket and your choice in the consent window. The shop uses its own cookies; third-party scripts are loaded solely after you have given your consent.

We divide cookies into two groups:

Necessary - required for the shop to work: maintaining the session, the contents of the basket, logging in, remembering your choice in the consent window, and form security. These do not require consent, as the shop cannot operate without them.
Analytics and marketing - activated solely after you have given your consent. Until consent is given, the scripts of the providers concerned are not loaded into your browser at all.

You may change your decision at any time using the Cookie settings link in the shop’s footer. You may also manage cookies in your browser settings - restricting necessary cookies may, however, make it impossible to place an order.

Microsoft Clarity

With your consent in the “marketing” category we use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity records how the website is used - mouse movements, clicks, scrolling - and turns this into heatmaps and session recordings. We use them solely to find and remove obstacles in the shop. The content of the cart, checkout and customer account pages is masked in the recordings, and form entries are not stored.

Clarity sets the cookies listed in the cookie declaration (including _clck, _clsk, MUID). You can withdraw your consent at any time in the cookie settings - we then delete _clck and _clsk; cookies set by Microsoft on its own domains (e.g. MUID) can be deleted in your browser settings.

Google Ads

With your consent in the “marketing” category we use Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It lets us see whether a visit or an order followed a click on our ad (conversion measurement) and show the shop’s ads to people who have visited our website before (remarketing). We do not pass your name, e-mail address or telephone number to Google Ads.

Google Ads sets the cookies listed in the cookie declaration (_gcl_au, and when you arrive via an ad also _gcl_aw and _gcl_dc); Google may also use cookies on its own domains. You can withdraw your consent at any time in the cookie settings - from then on the Google Ads script is not loaded and we delete _gcl_au, _gcl_aw and _gcl_dc; cookies set by Google on its own domains can be deleted in your browser settings. Information on how Google processes data can be found in Google’s privacy policy: policies.google.com/privacy.

10. Server log files

Each time our shop is accessed, the web server automatically records data transmitted by your browser and stores it in what are known as log files. The following are recorded:

the IP address of the requesting device,
the date and time of the request,
the address requested, including the method and any parameters passed,
the HTTP status code of the response,
the volume of data transferred,
the previously visited page (referrer),
the identifier of the browser and operating system (user agent).

Purpose: ensuring uninterrupted operation, diagnosing faults, and detecting and preventing abuse and attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning shop). Retention period: up to 12 months.

We do not combine this data with other data sources and do not use it to identify you personally, save where this is necessary to investigate an attack or abuse.

11. Data security

The connection to the shop is encrypted using the TLS protocol. We apply technical and organisational measures appropriate to the risk, including restricting access to the administration panel to authorised persons, protecting the login form against attacks, keeping the shop software up to date, and daily backups stored outside the publicly accessible server directory.

12. Changes to this Privacy Policy

We may update this Policy, in particular in connection with changes in legislation, the introduction of new tools or a change in the scope of our services. The current version is always available at this address. We will inform holders of a shop account of any material changes.