1. Data controller
The controller of your personal data is Karol Płaczek, conducting business under the name Wispero Karol Płaczek, Gawrych Ruda 101, 16-402 Suwałki, Poland, VAT ID PL 845 176 33 65 (hereinafter: the “Controller”). Contact regarding personal data: sklep@wispero.pl, phone +48 504 519 004.
2. What data we collect and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Fulfilling the order and sales contract, contact about the order, agreeing the personalisation design | first name, surname, delivery address, e-mail, phone, personalisation text | Art. 6(1)(b) – performance of a contract | until the contract has been fulfilled, then for the limitation period for claims |
| Issuing invoices and bookkeeping | invoice details, including tax ID | Art. 6(1)(c) – legal obligation (tax law) | 5 years from the end of the year in which the tax obligation arose |
| Handling complaints and withdrawals | order and request data | Art. 6(1)(c) – legal obligation | until the matter is closed and for the limitation period for claims |
| Establishing, pursuing and defending claims | order and correspondence data | Art. 6(1)(f) – legitimate interest | until the limitation period for claims expires |
| Replying to a message, enquiry or quote request | data provided in the message | Art. 6(1)(f) (or (b) – before concluding a contract) | until the correspondence ends, max. 12 months |
| Running a customer account (if you create one) | login, e-mail, address details, order history | Art. 6(1)(b) | until the account is deleted |
Providing data is voluntary but necessary to place and fulfil an order.
3. Who we share data with
Your data may only be received by entities that help us run the shop, to the extent necessary:
- the payment operator – Krajowy Integrator Płatności S.A. (Tpay) – to process payments,
- carriers and parcel-locker operators – to deliver the parcel (chosen for a given shipment),
- the hosting provider – OVH sp. z o.o. – on whose servers the shop runs,
- the e-mail and office-tools provider – Google (Google Workspace),
- an accounting office or invoicing software – for tax settlements,
- public authorities – where required by law.
4. Transfers outside the EEA
When using Google services, data may be transferred to the USA. This takes place on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
5. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time (without affecting the lawfulness of earlier processing). To exercise your rights, write to sklep@wispero.pl.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
We do not make decisions about you based solely on automated processing, including profiling.
6. Cookies and statistics
The shop uses cookies that are essential for the website to work: remembering the contents of the cart, processing orders, logging in to your account and security. These cookies do not require consent.
Cookie-free statistics. We count visits to the shop with Koko Analytics, which runs on our own server, does not store cookies and does not process data that could identify you. The data is not shared with anyone.
Google Analytics (only with consent). If you click “Accept” in the banner, we use Google Analytics 4 (Google Ireland Ltd.) to see how you use the shop and to improve it. Google may also process data outside the EEA on the basis of standard contractual clauses. Without your consent, Google Analytics does not store analytics cookies. You can change your consent at any time by clicking cookie settings.
Reminders about unfinished orders. When you enter your e-mail address on the checkout page, we store it together with the contents of your cart. If the order is not completed, we may send you up to two reminders (after about 1 hour and after 1 day). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can unsubscribe from reminders with one click in the message, and abandoned-cart data is deleted after 30 days at the latest.
You can delete cookies or block them in your browser settings – however, this may prevent you from placing an order.
7. Changes to the policy
The policy may be updated, e.g. when the law or the tools used in the shop change. The current version is always available on this page.