Privacy and Cookie Policy

Effective from [EFFECTIVE DATE].

1. Controller

The controller of your personal data is Janusz Ciosek, sole trader doing business as P.P.H.U. Janusz Ciosek WIELKA REKLAMA, ul. ks. Jerzego Popiełuszki 13, 98-300 Wieluń, Poland, tax ID (NIP) 832-000-27-20, REGON 730018779, owner of the Displuno online store (displuno.com) ("we", the "Controller").
For data protection matters, email info@displuno.com or write to the postal address above. We have not appointed a data protection officer [TO BE CONFIRMED].

2. What data we process

contact and address data: name, delivery and billing address, email, phone,
company data: name, tax ID or EU VAT number, address, contact persons,
order data: products purchased, payments (without full card details), deliveries, returns and complaints,
Account data: login, order history, settings,
the content of correspondence and quote requests,
print files and designs, which may contain personal data (e.g. images of people, names),
device and usage data: IP address, browser, pages visited, cookie data.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Concluding and performing the contract of sale, including payment, delivery and order communication	Art. 6(1)(b)
Running the Account and handling forms	Art. 6(1)(b)
Issuing invoices, accounting and tax settlements (including KSeF)	Art. 6(1)(c)
Handling withdrawals and complaints	Art. 6(1)(c)
Answering enquiries and quotes before a contract is concluded	Art. 6(1)(b); for company contact persons Art. 6(1)(f)
Communication with representatives of companies, public bodies and agencies	Art. 6(1)(f) (our legitimate interest: managing business relationships)
Verifying business partners (e.g. CEIDG, KRS, VIES, Polish VAT white list)	Art. 6(1)(c) and (f)
Establishing, exercising and defending legal claims	Art. 6(1)(f)
Store security and fraud prevention	Art. 6(1)(f)
Newsletter and commercial information by email	Art. 6(1)(a) (consent), in conjunction with Article 398 of the Polish Electronic Communications Law
Store analytics and statistics	Art. 6(1)(a) (consent in the cookie banner)
Advertising and remarketing on third-party services	Art. 6(1)(a) (consent in the cookie banner)

Providing data is voluntary, but without the data needed for an order we cannot conclude and perform the contract, and without the data required by law we cannot issue an invoice.

4. How long we keep data

order data — until claims under the contract become time-barred (as a rule 6 years, and 3 years for claims related to business activity, counted to the end of the calendar year),
accounting and tax records — 5 years from the end of the calendar year in which the tax payment deadline expired,
complaints and withdrawals — until the liability period and limitation of claims expire,
Account — until it is deleted,
newsletter — until consent is withdrawn, and then for the period in which we must be able to prove consent,
enquiries and correspondence — until the matter is resolved, then up to [12] months unless related to a contract,
print files — up to [12] months after the order is dispatched,
cookie data — for the period stated in the cookie banner, no longer than [13] months.

Hosting and software. The Store runs on the Seller's own software on a server rented from a hosting provider in Poland [CyberFolks S.A. — TO BE CONFIRMED], which processes data on our behalf as a processor.
Payment providers: Stripe Payments Europe, Ltd. (Ireland) — card payments; PayPro S.A. (Przelewy24, Poland) — instant transfers and BLIK [TO BE CONFIRMED once payments go live]. You provide card details directly to the provider.
Carriers and shipping intermediaries: [CARRIERS — e.g. DPD, InPost, DHL, pallet carriers, Furgonetka.pl — TO BE COMPLETED] — to the extent needed for delivery.
Suppliers and production subcontractors [SUPPLIER NAME, IF IT SHIPS DIRECTLY TO CUSTOMERS — TO BE COMPLETED] — to the extent needed to fulfil and ship the order.
IT and email service providers [e.g. CyberFolks S.A. — mailboxes in the displuno.com domain — TO BE CONFIRMED] and companies providing technical support [TO BE COMPLETED].
Accounting office [NAME — TO BE COMPLETED] and legal advisers.
Analytics and advertising tools — only with your consent: [e.g. Google Analytics 4, Google Ads, Meta Pixel — TO BE COMPLETED OR REMOVED].
Public authorities, where required by law, including the Head of the National Revenue Administration via KSeF.

6. Transfers outside the European Economic Area

Some recipients (e.g. Stripe, Inc. in the USA) may process data outside the EEA. Transfers are based on a European Commission adequacy decision (the USA for organisations certified under the EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the Commission. You can obtain a copy of the safeguards by contacting us.

7. Your rights

You have the right to:

access your data and receive a copy,
rectification,
erasure,
restriction of processing,
data portability,
object to processing based on our legitimate interest, including for marketing,
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in your country of residence.

To exercise your rights, email info@displuno.com.

8. Profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. If you consent to advertising cookies, our advertising partners may tailor ads to you based on your activity.

9. Company contact persons and public procurement data

Data of employees and associates of companies, public bodies and agencies (name, position, business email and phone) is usually received from their employer or principal. We process it to manage the business relationship (Art. 6(1)(f) GDPR).
Data contained in offers and contracts in public procurement may be disclosed by the contracting authority under public procurement and freedom of information laws.
Personal data of agency clients provided to us by an agency for shipping is processed on the agency's behalf as a processor (§ 14 of the Terms).

10. Print files

Print files may contain personal data, e.g. images or names. By providing a file, you confirm that you have a legal basis to use it. We use files only to fulfil the order and handle complaints and then delete them (section 4).

11. Cookies and similar technologies

The Store uses cookies and similar technologies (e.g. browser local storage, pixels).
Types of cookies:
- strictly necessary — cart, checkout, login, security, remembering your cookie banner choice; no consent required,
- preferences — e.g. language and currency,
- analytics — Store usage statistics [the Store currently uses no analytics tools — TO BE CONFIRMED],
- marketing — advertising and remarketing [Google Ads, Meta Pixel — TO BE CONFIRMED].
Cookies other than strictly necessary ones are set only with your consent given in the cookie banner (Article 399 of the Polish Electronic Communications Law; Article 5(3) of Directive 2002/58/EC). You can change your choice at any time via the "Cookie settings" link in the Store footer [TO BE IMPLEMENTED] or in your browser settings.
A detailed list of cookies, their providers and retention periods is available in the cookie banner [the Store currently uses only essential cookies and browser storage: cart, language, delivery country, sign-in session].

12. Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), restricted access to data and two-factor authentication for the Store admin [TO BE CONFIRMED].

13. Changes to this policy

We may update this policy when the law or the tools we use change. The current version is always available in the Store, with its effective date at the top.