Privacy Policy

This Privacy Policy sets out the rules for processing personal data of users of the Trichovita online store (hereinafter: "Store") and the use of cookies and other similar technologies. We care about the security of personal data and process it in accordance with applicable law - in particular with the GDPR (EU Regulation 2016/679), the Act on the Provision of Electronic Services, the Electronic Communications Law, and the Telecommunications Law, as well as other relevant regulations. This Policy is addressed to all Store customers, both consumers (B2C) and businesses (B2B), using the Store's services within Poland.

The data controller (hereinafter: "Controller" or "we") is TRICHOVITA Spółka z ograniczoną odpowiedzialnością with its registered office in Poznań (address: Os. Stefana Batorego 79/U4, 60-687 Poznań). The company is registered in the National Court Register (KRS) under number 0000223026 (NIP: 7792234940, REGON: 634598564). The Controller operates the online Store at www.trichovita.pl.

For matters relating to the protection of personal data, you may contact the Controller in writing at the above address or via the contact form available on the Store's website (the "Contact" section).

We process users' personal data for specific purposes, to the minimum extent necessary to achieve those purposes. Below we describe what data we collect, in what circumstances, for what purpose we process it, and on what legal basis:

• Placing orders (purchasing goods) - when placing an order, we ask you to provide the data necessary to perform the sales contract: first and last name, delivery address (street, postal code, city), email address, and contact phone number. For business customers, we may additionally collect the company name and NIP (tax identification number) for invoicing purposes. This data is processed for the purpose of fulfilling the order, i.e. concluding and performing the distance sales contract (accepting the order, payment, delivery of goods, handling any complaints). The legal basis is the necessity to perform the contract (Article 6(1)(b) GDPR) - without this data, we would not be able to complete the sale. Furthermore, certain data (e.g. invoicing data) is processed in order to fulfil our legal obligations as a seller, such as tax and accounting obligations (issuing and storing invoices and receipts) - the legal basis is Article 6(1)(c) GDPR. We may also process this data on the basis of our legitimate interest (Article 6(1)(f) GDPR) to the extent necessary for the establishment, exercise, or defense of legal claims (e.g. storing order information until the expiry of the limitation period for claims under the contract).
• Customer Account - when creating a voluntary Customer Account in our Store, the user confirms their identity using the chosen sign-in method. An email address is optional when signing in with Facebook. Using the Account requires a first name, last name and phone number; they are used to handle orders, returns and complaints. The user may also save delivery addresses. The Account has no password. Signing in takes place via a one-time link or a six-digit code sent to the user's email address (the link and the code are valid for 15 minutes and work once), via a six-digit SMS code sent to a phone number previously confirmed in the Account, or via a Google or Facebook account where the method is available in the sign-in form. The SMS code is sent on our behalf by an external SMS gateway provider based in Poland (as with phone verification for cash-on-delivery orders). When signing in with Google or Facebook, the user is redirected to the chosen provider. We use the stable identifier assigned by that provider and a confirmed email address, if supplied, to verify identity and link the Account. For Facebook we request the email and public_profile permissions. The provider may also supply a first name, last name and profile-picture URL. This information may be included in the technical identity record held by the authentication service provider on our behalf; we do not use it to automatically fill in the customer profile or match orders. The authentication service acts under a data processing agreement and handles the authorisation-code exchange. We end its session after handling sign-in; further access to the Store uses our own revocable Customer Account session. Ending a session does not itself erase the technical identity record. Account data records the provider identifier and its link to the confirmed email address, if one has been added; we protect the address with encryption and use its hash to look up associations. We do not receive Google or Facebook passwords. We do not request access to friends, posts or permission to publish on the user's behalf. We do not use provider tokens to retrieve additional data after sign-in. Facebook allows Account creation and subsequent sign-in without supplying an email address. The user may optionally add and confirm an email later in the Account settings. Orders are attached solely by an email address whose ownership has been confirmed; neither the phone number nor the social profile's name or picture is used to merge accounts. We also process technical data of active sign-in sessions (including the sign-in date, browser information and IP address) so that the user can view and revoke their devices' sessions in the account security settings. This data is processed for the purpose of creating and maintaining the Customer Account and enabling the use of its functionalities (viewing the history of orders, shipments, invoices and returns, saved addresses, security and privacy settings). Once the email address is confirmed, orders placed using that address are attached to the account, including previous purchases made without an account. The legal basis for processing is the necessity to perform a contract for the provision of electronic services - creating and maintaining an account (Article 6(1)(b) GDPR). Upon account activation the user accepts the Terms and Conditions and declares that they are at least 16 years old; we record the version of the Terms and Conditions under which those statements were submitted. We store profile data, saved addresses and sessions until the account is deleted by the user (independently, in the account panel) or by the Controller. Deleting an account does not result in the deletion of data relating to completed orders, which we may continue to store, e.g. for tax or legal purposes (in accordance with the principles described in this Policy); full erasure of personal data is carried out under the GDPR procedure described in this Policy, available on the My data page.
• Newsletter (commercial information via email) - when subscribing to the newsletter, the user provides their email address (and possibly their first name, if they wish to receive personalized greetings). We use this data for the purpose of sending the newsletter, i.e. information about new products, promotions, offers, and articles related to the Store. The newsletter is sent only after obtaining the user's explicit consent to receive commercial information from us electronically (in accordance with the requirements of electronic communications law). The legal basis for processing the data (email address) is the data subject's consent (Article 6(1)(a) GDPR). The user may withdraw their consent at any time - e.g. by clicking the "unsubscribe" link in the footer of each newsletter or by contacting us in any manner. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. After the withdrawal of consent, we will no longer send the newsletter to the relevant email address.
• Contact form - when using the contact form or sending us a message (e.g. via email), the user provides data such as: first name, last name, email address, phone number (optional), and the content of the inquiry. This data is processed for the purpose of handling the inquiry - providing a response, resolving the matter at hand, and making return contact. The legal basis for processing may be our legitimate interest (Article 6(1)(f) GDPR) consisting in communicating with persons inquiring about our services and maintaining customer relationships. If the inquiry relates, for example, to an offer prior to entering into a contract, the legal basis may also be taking steps at the data subject's request prior to entering into a contract (Article 6(1)(b) GDPR). Correspondence data will be processed for the time needed to handle the inquiry and, where appropriate, for a longer period - in the event of pursuing or defending against claims (which constitutes our legitimate interest). For example, we may archive correspondence for a period of up to 3 years from the conclusion of the matter, where this is necessary for evidentiary purposes (e.g. the history of arrangements with a customer).
• Reviews and ratings - our Store allows users to leave reviews about products or the Store's activities (e.g. in the form of reviews or ratings). If the user chooses to publish a review, we process the data provided in the review form: the content of the review, the product rating, and the author's data (such as their name/username, and possibly basic account data if the review is published by a logged-in user). Processing takes place for the purpose of publishing the user's review on the Store's website and, where applicable, moderating such content. The legal basis is the user's consent expressed through voluntarily posting the review (Article 6(1)(a) GDPR) - the user decides to make their data public as part of the review. We reserve the right to moderate or remove reviews that violate the law or good practices (in accordance with the Store's terms and conditions). The user may at any time request the removal of their published review - in which case we will cease processing the data associated with it (unless further storage is required for other purposes, e.g. defense against claims). An alternative legal basis for processing data in the context of reviews may be our legitimate interest (Article 6(1)(f) GDPR), consisting in providing reliable product information and information about the quality of our service to other customers - however, we always respect the user's wishes regarding the posting or removal of their review.
• Review request: about 14 days after an order from the Store is delivered, we send one email asking for your opinion of the products you bought. The legal basis is our legitimate interest (Article 6(1)(f) GDPR): we want to know how our products and service work for you. If you are a Trichovita Club member, it also shows the points the club rules give for a review. You can opt out of these emails by writing to kontakt@trichovita.pl.
• Club Trichovita: membership is voluntary and requires acceptance of the club rules. We process Account details, purchases and returns, reviews, referrals, points, and confirmation of adulthood and acceptance of the rules to perform the membership agreement (Article 6(1)(b) GDPR). You may provide your birthday day and month, without the year, to receive birthday points, and remove this date in your Account. We send emails needed to manage membership, such as confirmation of joining, point expiry notices and membership decisions. Marketing messages require the applicable consent; joining the club does not replace that consent. To prevent abuse, we compare verified email addresses, phone numbers, order details, IP addresses and browser information. Identifiers used to enforce blocks are stored as hashes protected with a secret key. This processing serves our legitimate interest in protecting the program from abuse (Article 6(1)(f) GDPR). An authorised staff member reviews suspected multiple accounts, self-referrals and other breaches. Members may provide explanations and request reconsideration. An automatic check for an active block may prevent rejoining the club but does not prevent shopping.

Geolocation data (parcel locker / pickup-point map)

During checkout (on the cart page, in the step where you choose a parcel locker or pickup point) we show an interactive map that helps you find the nearest carrier points. If you knowingly click the “Use my location” button, your browser will ask for your consent to share geographic coordinates (latitude and longitude) with us. We use those coordinates once only: our server rounds them and asks the intermediary through which we order courier services for a list of pickup points in that area, passing on only the map area, with no data identifying the user. We do not store the coordinates in any database, we do not link them to a customer account, and we do not use them for any other purpose (analytics, marketing, or profiling). If you do not grant consent, the map still works - you can search for a parcel locker manually by city name or postal code; in that case our server passes the text you typed to an external geocoding service, which converts it into a map position, again with no data identifying the user. The map background itself is downloaded by your browser directly from an external map provider, which therefore receives your device's IP address and information about the map area being viewed. The legal basis for processing is the user’s consent (Article 6(1)(a) GDPR), expressed by deliberately clicking the location icon and confirming the browser pop-up; consent can be withdrawn at any time in browser settings (Safari / Chrome / Firefox → Site Settings → Location).

Phone number verification for cash-on-delivery orders (SMS code)

If you choose cash on delivery when placing an Order, we will send a one-time 6-digit SMS code to the phone number provided in the form - entering it confirms that the number is correct and belongs to you, and allows the Order to be placed. We do this because with cash on delivery the courier must be able to reach the recipient, and a mistyped number or a fraudulent order would result in an unclaimed parcel. The code is stored only in hashed form, for a maximum of 10 minutes; we also keep short-lived counters of sends and verification attempts (abuse prevention). SMS delivery is handled on our behalf by an external SMS gateway provider based in Poland, to whom we transfer only the phone number and the message containing the code. The legal basis for processing is the necessity to take steps prior to entering into a contract and to perform it (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse and contact-data errors (Art. 6(1)(f) GDPR).

Remembering order data on your device (faster repeat purchases)

To make repeat purchases easier, after you place an order we may store the data you entered in the order form (first name and surname, delivery address, email address, telephone number and preferred delivery method) solely locally, in your browser's memory on your device. Thanks to this, on your next visit we will offer to pre-fill the form automatically so that you do not have to enter this data again and can complete your purchase faster. For this purpose we do not transmit or store this data on our servers, we do not create an account or customer profile from it, and we do not combine it across devices; we do not store any payment data (these are handled solely by the payment operator Przelewy24). The feature works for your convenience, you can decline the pre-fill on your return visit and delete the stored data at any time (via the button in the suggestion window, by clearing your browser's memory, or through the "My data" page). The stored data expires automatically after 90 days from your last order. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in making repeat purchases easier for Customers and, with respect to storing information on your device, your acceptance of this functionality together with acceptance of the Terms and Conditions when placing an order. The data remains solely on your device, within the EEA, and is not transferred outside it.

Our Store's website uses cookies and similar technologies to ensure its proper functioning, improve its features, and conduct analytics and marketing. Cookies are small text files that the website saves on the user's device (computer, smartphone, etc.) while browsing the site.

• Technically necessary cookies - these are cookies essential for the proper functioning of the Store and the provision of basic services. We use them, among other things, to maintain the session after login, remember the contents of the shopping cart, and store preference settings (e.g. language). These cookies do not collect data for marketing or analytical purposes; they only ensure the functionality of the Store. Due to their essential nature, we do not require separate consent for their use - their use is based on Article 173 of the Telecommunications Law (ensuring the transmission of a communication in a network) and our legitimate interest in providing services requested by the user.
• Analytical cookies - these are files used to collect information about how users use our Store (e.g. which pages they visit, how long they spend on them, which features they click). We use analytical tools such as Google Analytics (provided by Google Ireland Ltd.), which use cookies to collect anonymous statistical data (e.g. anonymised IP addresses, device identifiers) for the purpose of analysing website traffic and improving our Store. The use of analytical cookies takes place only with the user's consent - we request consent for this type of cookies upon the first visit. If you do not consent, you can still use the Store, and Google Analytics only receives general statistics without cookies (see “Google consent mode”). The legal basis for processing data from analytical cookies is the user's consent (Article 6(1)(a) GDPR) in conjunction with the requirements of the Telecommunications Law and the GDPR. Information collected by Google Analytics may be transferred to Google servers outside Europe (e.g. in the USA) - however, we use these tools in accordance with the compliance mechanisms provided for by law (e.g. standard contractual clauses approved by the European Commission). Details regarding Google's privacy policy can be found on Google's website. The same consent also covers the session recording described below.
• Marketing (advertising) cookies - the Store uses Google Ads to measure advertising effectiveness and conversions after an ad click, and for remarketing and ad personalization. We switch on Google Ads cookies, remarketing (our ads on Google and other websites) and ad personalization only after your separate consent to the “Marketing” category. Without it, Google Ads only receives general statistics without cookies (see “Google consent mode”). After consent, we may store our trichovita_attribution cookie for up to 90 days; it contains a Google click identifier (gclid, gbraid or wbraid) and campaign parameters. When an order is created, we store the consent state with it. After payment confirmation, we may send Google the click identifier, order number and value, and hashed customer-provided data (for example, an email address or phone number) to measure enhanced conversions. Missing or denied consent when the order is created blocks that upload. A later withdrawal removes the attribution cookie and blocks future storage and conversions for subsequent orders. The data recipient is Google Ireland Ltd.; information may be processed outside the EEA under the transfer mechanisms described below.
• Google consent mode - Google tools (Analytics and Ads) load as soon as you open the website. Until you consent, they do not store or read cookies, and Google only receives general statistics: page views, items added to the cart and purchases, your choice in the banner, the browser type and the page address without private codes. Google also sees the IP address, as with any internet connection. This data is used only for general statistics on traffic and ads, not to show you ads or build a profile of you. Legal basis: our legitimate interest in checking how the Store and our ads perform (Article 6(1)(f) GDPR).

First-party page-view statistics (cookie-free)

Independently of the analytical cookies described above, we keep our own anonymous page-view statistics for the Store's pages, which do not use cookies or any other form of storing data on the user's device. When a page is opened, we record: the address of the visited subpage and its type (e.g. a blog article, a product page), the language, the source of the visit (the referring website's domain), the country, and the device type (phone, tablet, computer). If you consented to marketing cookies, we also add to that entry the campaign parameters from the address you arrived with (utm_source, utm_medium, utm_campaign) together with the version of the consent given. Without that consent we do not record campaign parameters. We do not store the user's IP address - we use it only momentarily, without retaining it, to compute an irreversible, daily-rotating hash used to approximate the number of unique visits; this hash does not allow us to identify a specific person or to track them across days. We do not link this data to a customer account, orders, or any other information; visits from bots and search engines, as well as the return, shipment-tracking, and order-confirmation pages, are excluded from these statistics. We do measure the three steps of the order form (details, delivery, summary), recording only the step number and nothing from the form itself. We use the statistics solely to understand which content is read and to improve the Store (including the blog). Given the anonymous and cookie-free nature of this measurement, it does not require your consent - the legal basis is our legitimate interest (Article 6(1)(f) GDPR) in keeping visit statistics and developing the Store. We process this data on our own infrastructure within the European Economic Area and do not transfer it outside the EEA.

Session recording and error monitoring

We use an external tool to detect application errors and to record sessions, that is, the course of a visit: the subpages opened, the clicks, and the page layout. We start the recording only after consent to analytical cookies and stop it immediately once that consent is withdrawn. The recording stores its own session key in the browser, so we treat it exactly like the other analytical cookies. We record about 1% of visits plus visits in which an application error occurred. In the recording we mask all text and all form fields and block images and video, so the data typed into an order (name, address, email, phone) never reaches the recording; what remains visible is the page layout and where the clicks landed. The legal basis is your consent (Article 6(1)(a) GDPR).

Separately from session recording, the same tool collects application error reports (the error message, the subpage address, the browser type). This does not use cookies, and before sending we strip from such reports data that could identify a person (email addresses, phone numbers, postal codes) as well as one-time tokens from addresses. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in keeping the Store secure and working correctly.

We also use the measurement built into the Store's hosting infrastructure: a page-view counter and performance measurement (real-user page loading times). This measurement uses no cookies or any other storage on your device, and we strip one-time link tokens (for example for a return or a data verification) from the transmitted page addresses before they leave the browser. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in maintaining the performance of the Store.

The provider of the error-monitoring and session-recording tool and the hosting provider process this data on our behalf under data processing agreements (Article 28 GDPR); the data may be processed outside the EEA under the rules described below.

Managing cookies: Upon the first visit to the Store, we display a message (cookie banner) with information about the use of cookies and a request for consent to non-essential cookies (analytical, marketing). The user has the option to accept all cookies, reject non-essential cookies, or select specific categories to which they consent. This decision can be changed at any time - e.g. by changing the cookie settings in your browser (you can delete stored files or block future cookies) or by reopening the cookie settings from the link in the Store footer. After consent is withdrawn we stop the measurement and delete from your browser the Google identifiers stored earlier (the _ga, _gid, _gat, _gcl_* and _gac_* files) together with our attribution file. Instructions for managing cookies in the most popular browsers can usually be found in the "Help" section of the relevant browser. Please note that blocking essential cookies may make it difficult to use the Store - e.g. the shopping cart and checkout process may not function properly without session cookies.

In connection with operating the Store, we may share collected personal data with selected third parties where this is necessary for the provision of services or required by applicable regulations. We ensure that each such entity guarantees an appropriate level of data protection. Data may be shared with the following categories of recipients:

• Courier companies and postal operators - in order to deliver ordered products, we share the customer's address and contact data with companies handling shipments (InPost, DPD, DHL, Orlen Paczka, according to the chosen delivery method). Only the data necessary for parcel delivery is shared (e.g. first and last name, delivery address, phone number for courier contact). The same scope of data is received by the intermediary through which we order courier services and generate shipping labels.
• Electronic payment operators - our Store uses external payment systems to enable secure online order payments. Data necessary to process the payment (e.g. the amount, order number, email, and the payer's first and last name) is transmitted to the payment operator. An example of such an entity is PayPro S.A. (ul. Pastelowa 8, 60-198 Poznań) - the operator of the Przelewy24 system. The payment operator becomes a separate controller of the data received to the extent of processing the transaction - it processes the data in accordance with its own privacy policy and legal requirements (e.g. anti-money laundering legislation, KNF requirements, etc.).
• IT and technical infrastructure providers - we work with external entities that provide services necessary for the Store to operate, in particular in the following categories: application hosting (including the page-view and performance measurement described above), managed database, authentication for sign-in with a Google or Facebook account, transactional email (order confirmations, shipping notifications, newsletter), SMS gateway (one-time codes and return-related messages), bot and spam protection (CAPTCHA), application error monitoring and session recording. Each of these entities acts under a data processing agreement (Article 28 GDPR) and processes data solely on our instructions. The SMS gateway provider is based in Poland; the other providers in this group are companies based in the USA, while the data in our database is stored in a data centre within the European Union. Some of them have infrastructure outside the EEA (including in the USA). In such cases data is transferred on the basis of the European Commission's adequacy decision (the EU-US Data Privacy Framework) where the provider participates in that programme, and otherwise on the basis of standard contractual clauses (SCC) approved by the European Commission in accordance with Article 46 GDPR. At the request of a data subject made under the right of access (Article 15 GDPR), we provide information about the specific recipients of their data and the legal basis for the transfer.
• Google Ireland Ltd. - store review programme: if you consent in the dialog shown after placing an order, we pass Google your email address, order number and estimated delivery date so that Google can email you a survey asking you to rate your purchase (the Google Customer Reviews programme). The legal basis is your voluntary consent (Art. 6(1)(a) GDPR); withholding it has no effect whatsoever on your order. You may withdraw consent at any time by contacting us or Google directly. Google acts here as a separate controller of the data it receives and processes it under its own privacy policy; data may be transferred outside the EEA on the terms described below. Any rating you submit is published without being linked to your identifying data.
• Google Ireland Ltd. - sign-in with a Google account - if you choose to sign in to the Customer Account with Google, Google authenticates you as a separate controller in accordance with its own privacy policy and provides us with the confirmed email address and the identifier of your Google account. We do not share your order data with Google; Google only learns that you are signing in to the Store. The legal basis is the necessity to perform the Account service agreement (Art. 6(1)(b) GDPR); choosing this sign-in method is voluntary, and email and SMS codes remain available. Data may be transferred outside the EEA under the terms described below.
• Meta Platforms Ireland Limited - Facebook sign-in: if you choose this method, Meta authenticates you as a separate controller under Meta's Privacy Policy and supplies the data described in the Customer Account section. Meta learns that you are using sign-in to our Store. We do not send Meta your order history or payment details as part of this sign-in. The data obtained is used for authentication and Account services under Article 6(1)(b) GDPR; we do not sell it or use it to target advertising. Choosing Facebook is voluntary and email-code sign-in remains available. Processing by Meta, including any transfers outside the EEA, is governed by its Privacy Policy.
• Accounting firm / tax advisors - we use external accounting services to maintain our financial records. Our customers' data (e.g. information on sales invoices: first name, last name/company name, address, NIP for businesses, and the transaction value) may be shared with the accounting firm servicing our company to the extent necessary for bookkeeping and fulfilling tax obligations. Such an entity processes data on the basis of a data processing agreement and in accordance with applicable regulations (e.g. the Accounting Act).
• Law firms, debt collectors - if necessary, we may share personal data with our legal advisors or debt collection companies where this is needed to pursue claims arising from a contract concluded with the customer (e.g. an unpaid order, a breach of the terms and conditions) or to defend against potential claims. The basis for such sharing is our legitimate interest in protecting our rights (Article 6(1)(f) GDPR).
• Public authorities: we disclose data only after checking the authenticity of the request, the authority's powers and the applicable legal basis. We assess whether its scope is necessary and disclose only the data needed to meet a lawful request. We seek clarification or a narrower scope for unclear or excessive requests and use available means to challenge unlawful requests. We document the assessment, decision, recipient and scope of disclosure. For requests from authorities outside the EEA, we separately assess the processing basis and the conditions for transfer under Chapter V GDPR, including Article 48. A foreign request does not itself provide a sufficient basis for disclosure. We fulfil duties to inform the individual subject to restrictions provided by law.

In every case of data sharing, we ensure that only the minimum necessary scope of data is transferred. Entities that process data on our behalf (e.g. IT service providers, courier companies) are required to secure the data and use it only for the purposes for which it was shared.

Transfer of data outside the EEA: Using hosting, database, authentication, transactional email, error-monitoring and analytics providers may involve processing outside the European Economic Area, particularly in the USA and, for infrastructure support, Singapore. This includes access by support personnel and subprocessors. Choosing a server in the EEA does not mean that all operations of the provider take place exclusively within the EEA. Transfers associated with necessary technical services are independent of consent to analytics cookies. In such cases, we ensure compliance with Chapter V of the GDPR - we apply the standard contractual clauses (SCC) approved by the European Commission (Article 46 GDPR) or use other mechanisms to legitimize data transfers. By consenting to analytical/marketing cookies, the user is informed about the possible transfer of data to third countries. If you have questions about data transfers outside the EEA, please contact us - we will provide additional information, and at the request of a data subject we will make available a copy of the safeguards applied and information about the specific recipients of their data (Article 15 GDPR).

We retain personal data only for as long as is necessary to achieve the purposes for which it was collected, or for as long as required by applicable law. Retention periods have been adjusted to the nature of the data and applicable regulations. Below we set out the main data retention principles:

• Data related to order fulfilment (sales) - we will retain data relating to orders placed for as long as is necessary to perform the contract and provide after-sales service (e.g. settlements, handling returns and complaints). After an order has been fulfilled, basic transaction data (invoices, receipts, proof of sale) is retained for the period required by tax and accounting regulations, i.e. 5 years from the end of the calendar year in which the tax payment deadline for a given transaction fell. In practice, this means that, for example, sales invoices for a given year may be stored for up to 6 years from the time of purchase (in accordance with the Tax Ordinance). Additionally, for the purposes of legal defence, we may retain order-related data until the expiry of the limitation period for claims under the contract - which in most cases is a maximum of 6 years (under the Civil Code, for periodic claims or claims related to business activity, this may be 3 years, but for consumer transactions we adopt the longer, safer period).
• User account data - we retain data provided during account registration for as long as the user has an active account in our Store. After an account is deleted (at the user's request or at the Controller's initiative, e.g. due to a prolonged period of inactivity), the data will be deleted or anonymised, with the exception of information that we must continue to retain for other reasons (e.g. order history - retained in accordance with the order-related principles above, and accounting records - for the required 5-year period). In other words, deleting an account does not always mean the immediate deletion of all data if the law requires its longer retention (however, we will limit the processing of such data exclusively to those purposes).
• Newsletter data - the email address (and possibly the first name) provided for the newsletter subscription will be processed until the subscriber withdraws their consent. After unsubscribing from the newsletter, we will stop sending messages to that address. However, we keep the email address on our internal "suppression list" for as long as it is needed to honour the unsubscription: without that record we would not know that marketing messages must no longer be sent to this address. This documents the withdrawal of consent and protects against accidentally resending the newsletter (which constitutes our legitimate interest - Article 6(1)(f) GDPR). Such a list is maintained solely for evidentiary and anti-spam purposes and contains a minimum scope of data (email address, unsubscribe date).
• Correspondence data (contact form, emails) - we retain this data for the period necessary to handle the matter from which it arose, and subsequently (where appropriate) for a period of up to 2-3 years for archival (evidentiary) purposes arising from our legitimate interest. If the correspondence relates to the performance of a contract or a complaint, longer periods may apply (e.g. 1 year for retaining responses to consumer complaints, in accordance with consumer rights legislation). In any event, we regularly review stored correspondence and delete any for which continued retention is not justified.
• Reviews/ratings - user reviews published on the website will remain publicly available until we decide to remove them (e.g. at the author's request or because the relevant product is no longer listed) or until the website/Store is discontinued. If reviews are linked to a user account, deleting the account does not necessarily mean the automatic removal of previously posted reviews - if you also wish to have your reviews removed, please contact us separately. We reserve the right to anonymize the author of a review after an account is closed (e.g. displaying the review as "Anonymous User").
• Club Trichovita data: membership and points history is retained during membership and until the end of the sixth calendar year following the year membership ends, for settlement and claims. One-time bonus records are deleted 24 months after membership ends, or earlier when a data erasure request is fulfilled. Birthday day and month are deleted when removed in the Account or when membership ends. Closed breach cases are deleted by the end of the sixth calendar year following the decision year, unless still needed for an active block. Block identifiers are retained while the block applies, and attempted circumvention records for 24 months. Indefinite blocks are reviewed every 24 months; identifiers are deleted when a block is lifted or expires. Following data erasure, only information necessary to enforce an active block is retained. Technical club events are deleted 30 days after completion or 90 days after final failure. Accounting records and orders follow the separate retention periods described above.

After the expiry of the stated periods, data is deleted or permanently anonymised so that it is no longer possible to identify a specific individual on its basis. Please note that in certain situations (e.g. ongoing proceedings, litigation), we may retain some data for longer - until the final resolution of the matter - where there is a legal basis for doing so.

Every individual whose personal data we process has the following rights under the GDPR:

• Right of access to data - you have the right to obtain confirmation from us as to whether we process your personal data, and if so, the right to access that data. Upon request, we will provide you with information including the purposes of processing, categories of data, recipients of data, and the planned retention period. You also have the right to receive a copy of your data undergoing processing.
• Right to rectification - you have the right to request that we promptly rectify any of your personal data that is inaccurate, and to have incomplete data completed (including by providing a supplementary statement). We strive to keep your data up-to-date and accurate, and we encourage you to exercise this right whenever the need arises.
• Right to erasure ("right to be forgotten") - you have the right to request the erasure of your personal data, and we are obliged to erase it where one of the grounds set out in Article 17 of the GDPR applies. You may request erasure of your data where, among other things: the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent and there is no other legal basis for processing, you have objected to processing and there are no overriding legitimate grounds for processing, the data has been processed unlawfully, or the data must be erased for compliance with a legal obligation. Please note, however, that in certain situations we cannot erase your data upon request - this applies in particular where processing is still necessary due to a legal obligation (e.g. we cannot delete transaction data before the expiry of the required period for retaining accounting records) or for the establishment, exercise, or defence of legal claims. In our response to your request, we will inform you of any reasons why we are unable to fully comply with the request (if applicable).
• Right to restriction of processing - you have the right to request that we temporarily restrict the processing of your personal data in the following cases: where you contest the accuracy of the data (for a period allowing us to verify its correctness), where processing is unlawful but you oppose erasure and instead request restriction of use, where we no longer need the data for processing purposes but you need it for the establishment, exercise, or defence of legal claims, or where you have objected to processing - pending determination as to whether our legitimate grounds override yours. Restriction of processing means that, apart from storage, we may process the data only with your consent or for the establishment, exercise, or defence of legal claims, the protection of the rights of another natural or legal person, or for reasons of important public interest.
• Right to data portability - to the extent that we process your data on the basis of your consent (Article 6(1)(a)) or on the basis of a contract (Article 6(1)(b)) - and the processing is carried out by automated means - you have the right to receive your personal data from us in a structured, commonly used, machine-readable format (e.g. CSV, JSON). You also have the right to transmit that data to another controller without hindrance from us. At your request, where technically feasible, we may transmit the data directly to another controller designated by you (this applies primarily to data that we hold in electronic form). This right applies to data that you have provided to us yourself (e.g. account data, information provided when placing an order, or in a form).
• Right to object - you have the right at any time to object to the processing of your personal data where such processing is based on our legitimate interest (Article 6(1)(f) GDPR). The objection should be justified by your particular situation which, in your view, means that we should cease the processing in question. Upon receipt of the objection, we will cease processing the data for those purposes, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or grounds for the establishment, exercise, or defence of legal claims. However, if we process data for direct marketing purposes, you have an absolute right to object - this means that in the event of an objection to the processing of data for direct marketing purposes (e.g. marketing profiling, sending newsletters on the basis of legitimate interest), we will immediately cease such processing. No justification is required for an objection related to marketing.
• Right to withdraw consent - where we process your data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You may withdraw consent as easily as you gave it - e.g. if you subscribed to the newsletter by ticking a checkbox on the website, you may unsubscribe by clicking the appropriate link in the email or by contacting us. After the withdrawal of consent, we will cease processing the data for the purpose to which the consent related.
• Right not to be subject to automated decision-making (including profiling) - we currently do not make decisions about users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them. This means that we do not apply profiling within the meaning of Article 22 of the GDPR in a manner that could negatively impact the user's rights (e.g. we do not refuse to provide services based on an automated analysis of the customer profile). Should we plan to introduce such practices in the future, you will be informed in advance, and you will have the right to obtain human intervention in the decision-making process. Marketing profiling, including remarketing and ad personalization, starts only after you consent to the “Marketing” category and does not produce effects that significantly affect your situation.
• Right to lodge a complaint with the supervisory authority - if you believe that we process your data unlawfully or in a manner that infringes your rights, you have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO). This authority performs a supervisory function in respect of compliance with personal data protection regulations in Poland. A complaint may be submitted in writing to the address of the Personal Data Protection Office: ul. Stanisława Moniuszki 1A, 00-014 Warszawa or electronically (detailed information is available on the UODO website). However, we encourage you to contact us directly before lodging a complaint - we will endeavour to clarify the situation and resolve the issue amicably. Exercising the right to lodge a complaint does not suspend or limit your other rights described above.

To exercise your rights, you may contact us in any manner - e.g. by sending a request to our mailing address or via email/contact form (if provided). We respond to rights-related requests without undue delay - generally within one month of receipt. If necessary, this period may be extended by a further two months (we will inform you of the reasons for the delay). The exercise of rights is free of charge as a rule; however, if your requests are manifestly unfounded or excessive (e.g. repeatedly submitted), we may charge a reasonable fee for their fulfilment or refuse to act (in accordance with Article 12(5) of the GDPR).

The Store's services are not intended for persons under 16 years of age. We do not knowingly collect or process the personal data of children who have not reached 16 years of age. In particular, it is not possible for persons under 16 to register an account or place orders - when creating an account, we require confirmation that the user meets this condition. This is based on the provisions of the GDPR, which provide for the special protection of children's data - the processing of data of a child under 16 is lawful only where consent is given by the child's legal guardian. Therefore, we ask persons under 16 not to provide us with their personal data. If it transpires that we are processing the data of a child under 16 without appropriate consent, we will delete it without delay. We ask parents or guardians to supervise whether their children are registering on the Store without permission.

Providing your personal data is, as a rule, voluntary, but in some cases necessary in order for you to use certain Store services or functionalities. In each case, we inform you which data is required (e.g. by marking it with an * symbol or a message in the form). Refusing to provide the required data or providing it incompletely may have the following consequences:

• If you do not provide the data necessary to place an order (such as address, contact, or payment information), we will not be able to accept and fulfil your order. Placing an order is equivalent to entering into a contract - certain data (such as first name, last name, delivery address) is a contractual requirement; its absence prevents us from performing the sales contract.
• If you do not provide the data required for account registration, you will not be able to create a user account in the Store. Registration is voluntary - you may browse the range of products and (sometimes) place orders as a guest, but having an account requires providing a minimum set of data (e.g. an email address for login). Not having an account means no access to functionalities reserved for registered users (e.g. viewing purchase history, participating in the loyalty program, etc.).
• If you do not provide data in the contact form or do not provide contact details, this may make it impossible or difficult for us to respond to your inquiry. For example, if you do not enter your email address, we will not know where to send the response. Providing data in the inquiry is voluntary, but without at least basic contact information, we will not be able to communicate with you effectively.
• Consent for the newsletter - is entirely voluntary. If you do not provide it, you will not receive our newsletter or marketing information via email. This will not, however, affect your ability to use the Store or place orders in any way - it simply means that you will not be subscribed to the mailing list. Similarly, refusing consent to analytical or marketing cookies will limit our ability to analyse and personalise our offering, but will not block access to the Store itself.

In summary: providing data is voluntary, but sometimes necessary for entering into a contract or providing a service. In such cases, the absence of data means the inability to provide the relevant service. We always strive to minimise the scope of required data - we only ask for information that is genuinely needed for a given purpose.

We assure you that we make every effort to ensure that your personal data is adequately protected. We have implemented appropriate technical and organisational measures designed to protect data against unauthorized access, loss, alteration, or destruction. Our website uses the HTTPS (SSL) protocol, meaning that communication between your device and our server is encrypted. We store data on secure servers, and access is limited to authorised individuals who have been trained in data protection and have committed to maintaining confidentiality. We regularly monitor our IT systems for vulnerabilities and apply security updates. Furthermore, in the case of third-party entities processing data on our behalf, we require them to apply at least equivalent security measures.

In the unlikely event of a personal data breach (e.g. a database intrusion), we have procedures in place to respond immediately - to identify the incident, mitigate its effects, and notify affected individuals and the relevant authorities where necessary (in accordance with Articles 33-34 of the GDPR).

You may request deletion of data received through Facebook Login using the My data form or by emailing kontakt@trichovita.pl. State the email address used for your Account and that your request concerns Facebook sign-in data. If no email is linked to the Account, tell us so that we can agree how to identify your Account. Do not send a Facebook password or access tokens. We will verify your identity before acting; Facebook sign-in is not required if you no longer have access to it. Your request covers the association with your Facebook identifier and the relevant authentication data processed on our behalf. Removing the Trichovita application in Facebook settings blocks further access under Meta's rules but does not itself erase data already held in the Store. We respond without undue delay, normally within one month. If an extension is necessary under Article 12(3) GDPR, we will explain the reason within that first month. Order data subject to tax obligations or necessary for legal claims may be retained for the required period; we will explain the basis and scope of any such restriction.

We reserve the right to make changes to this Privacy Policy in the future - primarily in order to adapt it to changes in the law (e.g. when new regulations on personal data protection, electronic services, or cookies come into force) or to changes in our data processing practices (e.g. the introduction of new Store functionalities, tools, or services). In the event of material changes that affect the scope of your rights or obligations, we will notify you of such changes in a visible manner (e.g. via a notice on the Store's website or an email, in the case of newsletter subscribers).

The current version of the Policy is always available on our website (the "Privacy Policy" link in the footer). We encourage you to review its content periodically. Date of last update: November 1, 2026. We added a description of the review request we send after an order is delivered. Update of October 11, 2026: We clarified that the SMS sign-in code is sent only to a phone number confirmed in the Account, and that using the Account requires a first name, last name and phone number. We also clarified that after unsubscribing from the newsletter the email address stays on the suppression list for as long as it is needed to honour the unsubscription. Update of October 9, 2026: We added a description of Google consent mode: without your consent, Google tools work without cookies. Update of September 26, 2026: This update clarifies Facebook Account creation without an email address and the option to add one later. Update of September 24, 2026: This update describes optional Facebook sign-in, technical authentication records, how to request their deletion and the procedure for public-authority requests. The update of September 17, 2026 tidies up the description of data recipients: we describe technical service providers by category (the type of service provided), we have added the courier services intermediary and the SMS gateway, both of which we were already using, and we have made the description of the pickup-point map more precise. The purposes and legal bases of data processing remain unchanged. The update of September 5, 2026 described signing in to the Customer Account with a Google account (Google as a separate controller, the authentication service provider as a processor), SMS-code sign-in, and the rule that orders are attached only to a confirmed email address. The update of August 18, 2026 described session recording and error monitoring, page performance measurement, the recording of campaign parameters in our own page-view statistics, and the deletion of Google identifiers after consent is withdrawn. The update of August 16, 2026 covered the description of the Customer Account (the scope of Account data, sign-in with a one-time link or code, technical session data) and the requirement to confirm being at least 16 years old when creating an Account. The Account-related changes take effect on 31 August 2026, together with Section 5a of the Terms and Conditions. The earlier changes regarding saving your data for faster checkout took effect on 15 July 2026.

If you have any questions or concerns regarding this Policy or the processing of your personal data by TRICHOVITA Sp. z o.o. in general, we are at your disposal - please contact us, and we will provide you with all the information you need.