Privacy Policy

This is an English translation provided for information only. The Polish version is legally binding.

Effective from: 22 September 2026

This policy describes what personal data is processed in the online shop https://sklep.opakuj.com (the Shop), for what purpose and for how long, and what rights data subjects have. Capitalised terms (e.g. Customer, Order, Account) have the meaning given to them in the Shop Terms and Conditions. A User is any person visiting the Shop, including a person who does not buy anything.

1. Data controller

  1. The controller of personal data is:

    MOVIPAK Spółka z ograniczoną odpowiedzialnością

    • registered office: ul. Puławska 166/172 lok. 46, 02-670 Warszawa
    • correspondence address: ul. Jutrzenki 9, 05-500 Józefosław
    • KRS: 0000852799
    • NIP: 5213902858
    • REGON: 386659760

  2. This is the same controller that is responsible for data processed on the company website https://opakuj.com. The company website has its own privacy policy; this policy applies to the Shop.

  3. The controller can be contacted on matters relating to personal data:

    • by e-mail: biuro@opakuj.com,
    • by phone: +48 605 525 882,
    • by post: ul. Jutrzenki 9, 05-500 Józefosław.

  4. The controller has not appointed a data protection officer.

2. What data we process

  1. Order data: first name and surname, company name, tax ID (NIP), billing address and delivery address, e-mail address, phone number (if provided), notes on the Order.
  2. Order and payment data: Goods ordered, amounts, payment date and status, and transfer details (e.g. sender name and account number), to the extent needed to settle the Order and make any refund.
  3. Account data (if the Customer creates an Account): login, e-mail address, saved addresses and Order history. The password is stored in encrypted form that cannot be read.
  4. Correspondence data: information provided in e-mails, letters and phone calls, e.g. in a complaint or an enquiry about a delivery quote.
  5. Technical data: IP address, information about the browser and device, date and time of the visit. These are recorded automatically in server logs, in cookies (point 8) and, when an Order is placed, also in the Order data, as a safeguard against abuse.

3. Purposes, legal bases and data retention periods

Purpose of processing Legal basis (GDPR) How long we keep the data
Conclusion and performance of the Contract: accepting and processing the Order, settling payment, delivery, contact about the Order Article 6(1)(b): necessary for the conclusion and performance of a contract. Where the Customer is a company and the data concerns its employee or representative: Article 6(1)(f) (legitimate interest: contact with a business partner) for the duration of the Contract, and then for the periods given in the following rows
Issuing invoices, keeping accounting records and tax documentation Article 6(1)(c): legal obligation under tax and accounting laws for the period required by those laws, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired
Handling withdrawals from the Contract and complaints Article 6(1)(c): obligations under the Consumer Rights Act (ustawa o prawach konsumenta) and the Civil Code, and also Article 6(1)(b) for the time needed to handle the matter and the period during which the Seller is liable for the Goods
Establishing, pursuing and defending claims Article 6(1)(f): legitimate interest: protecting the Seller's rights until the limitation periods for claims set out in the Civil Code expire
Maintaining the Account Article 6(1)(b) until the Account is deleted; data of Orders placed through the Account: as set out in the rows above
Responding to enquiries and messages Article 6(1)(b) where the enquiry concerns a future Contract (e.g. a delivery quote); in other matters Article 6(1)(f): legitimate interest: responding to a message for the time needed to handle the matter, and then until the limitation periods for any claims expire
Ensuring the operation and security of the Shop (server logs, protection against abuse, strictly necessary cookies) Article 6(1)(f): legitimate interest: security and proper operation of the Shop server logs: for the retention period set in the server configuration; cookies: as set out in the table in point 8

The table is wider than the screen: scroll it sideways.

Data is not used to send marketing communications without separate consent.

4. Is providing data mandatory

  1. Providing data is voluntary, but an Order cannot be placed without the data marked as required in the form.
  2. The tax ID (NIP) is needed to issue an invoice to a company.
  3. The phone number is optional; it makes it easier to contact you about the Order and delivery.

5. Who we share data with

Data may be received only by entities that need it to achieve the purposes described in point 3:

  1. OVH : the hosting provider on whose servers the Shop runs (a processor acting on behalf of the controller).
  2. cyber_Folks S.A. , based in Poznań: the e-mail provider through which the biuro@opakuj.com mailbox is operated.
  3. Entities providing technical support for the Shop (e.g. updates, repairs, security), under a data processing agreement.
  4. An external accounting firmthat keeps the Seller's accounts, to the extent of data from invoices and accounting documents.
  5. Carriers making the delivery, to the extent of data needed to deliver the shipment (name or company name, delivery address, phone). These are courier companies and pallet shipment carriers. For personal collection, data is not passed to carriers.
  6. The bank that holds the Seller's account , to the extent of data from the transfer. If the Seller makes additional payment methods available in the Shop and the Customer uses them, the data needed to process the payment will also be received by the operator of that payment method.
  7. Public authorities, e.g. the tax office, where the obligation to disclose data arises from the law.

6. Transfer of data outside the European Economic Area

  1. The Shop uses Google Fonts loaded from Google servers. When the page is displayed, the User's browser connects to Google servers and sends them its IP address. Google may process this data outside the European Economic Area, including in the United States, on the basis of a European Commission decision finding an adequate level of data protection (EU-US Data Privacy Framework).
  2. Apart from the case described in point 1, the controller does not transfer data outside the European Economic Area.

7. Rights of data subjects

  1. Every person whose data we process has the right to:
    1. access their data and receive a copy of it;
    2. rectification of incorrect data;
    3. erasure of data, except for data that the controller must keep under the law (e.g. invoice data);
    4. restriction of processing;
    5. portability of data processed for the conclusion and performance of the Contract;
    6. object to processing based on the controller's legitimate interest;
    7. withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.
  2. To exercise these rights, simply write to biuro@opakuj.com. The controller responds without undue delay, and no later than within one month; in particularly complex cases this period may be extended by a further two months, in which case the controller will inform you.
  3. Everyone has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl) if they believe that their data is being processed unlawfully.

8. Cookies

  1. Cookies are small text files stored in the User's browser when visiting a website.
  2. Under electronic communications law, storing cookies without the User's consent is permitted only where they are strictly necessary to provide the service the User is using. Consent is required for all other cookies.
  3. The Shop uses only strictly necessary cookies, without which the basket, placing Orders and logging in to the Account would not work:
Name What it is used for How long
woocommerce_cart_hash, woocommerce_items_in_cart remembering the contents of the basket until the browser is closed
wp_woocommerce_session_… linking the basket to the visitor up to 2 days
wordpress_logged_in_…, wordpress_sec_… keeping you logged in to the Account until the browser is closed, or up to 14 days with the “Remember me” option
wordpress_test_cookie checking whether the browser accepts cookies (needed for logging in) until the browser is closed

The table is wider than the screen: scroll it sideways.

  1. The Shop does not currently use analytics or advertising tools. If they are introduced, the controller will update the policy and ask for consent before such cookies are stored.
  2. The User can delete cookies or block them from being stored in the browser settings at any time. However, blocking strictly necessary cookies may make it impossible to use the basket and place an Order.

9. Data security

The controller applies technical and organisational measures appropriate to the risk, in particular: an encrypted connection to the Shop, access to the Shop admin panel only for authorised persons with individual accounts, regular software updates and backups.

10. Automated decisions

The controller does not make automated decisions about Users and does not use profiling.

11. Changes to the policy

The controller may change the policy where required by changes in the law, changes in how the Shop works or in the tools used. The current version is always available on the Shop website, with the date from which it applies.