Privacy policy

1. Data controller

This policy covers agapolh.com visitors, customers and people contacting us. Personal data is handled under the General Data Protection Regulation (EU) 2016/679 (GDPR).

The data controller is AGAPOL SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, registered office: Zakładowa 1, 70-790 Szczecin, Polska, National Court Register (KRS): 0000744722, Polish tax ID (NIP): 8522648980, REGON: 381006846. Legal form: SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ. Registered on 16 August 2018. Contact: [email protected].

Send privacy questions and requests to [email protected] or to the controller’s postal address.

2. Data we collect

You do not need a customer account. We collect only the data needed for the function you use.

• Orders: name, email, phone, billing or delivery address, collection point, products, order value and payment status; company details and tax ID if provided.
• Contact form: name, email, message and optional phone and company name.
• Technical data: IP address and server request information needed to operate and secure the website.
• Stripe processes payments. The store does not retain full payment card numbers or security codes.

3. Purposes and legal grounds

• Orders, payments and delivery: performance of a contract or pre-contract steps, GDPR Article 6(1)(b).
• Tax, accounting and statutory complaint obligations: legal obligations, Article 6(1)(c).
• Pre-contract enquiries: Article 6(1)(b). Other correspondence, security and legal claims: our legitimate interests, Article 6(1)(f).
• Any future optional features requiring consent will use Article 6(1)(a) and will start only after consent. Currently the website runs no advertising tracking or analytics requiring consent.

4. Recipients and international transfers

Where necessary, data is shared with hosting and security providers (Cloudflare, including Turnstile protecting the contact form), Stripe, InPost, email service providers, accountants, legal advisers and authorities entitled to receive it.

Providers may process data outside the European Economic Area. Transfers rely on an applicable European Commission adequacy decision or GDPR safeguards such as standard contractual clauses. Contact us for information about the applicable safeguards.

We do not sell personal data or make decisions with legal or similarly significant effects based solely on automated processing, including profiling.

5. Retention

Order data is retained while the contract is performed and subsequently for statutory accounting periods and applicable claim limitation periods. Tax records are generally kept for five years from the end of the year in which the tax payment was due, subject to legal extensions.

Correspondence is retained until the enquiry is resolved, and longer only where required by law or for claims. Technical data is retained as needed for security and incident handling. Consent-based data is retained until consent is withdrawn or its purpose ends, subject to retaining evidence of compliance.

6. Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing on grounds relating to your situation, and to direct marketing at any time. Consent can be withdrawn without affecting earlier lawful processing.

You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl). Providing data is voluntary, but required fields are needed to handle orders or enquiries. Optional fields do not affect access to other services.

7. Cookies and browser storage

Cookies store small pieces of information on your device. We also use localStorage, the browser’s local memory. Currently only storage needed for requested functions, security and remembering the cookie notice is used. We run no first-party advertising or analytics tools.

The cart uses “agapol-cart-v1” until you clear browser data or empty the cart, including after confirmed payment. The notice acknowledgement uses “agapol-cookie-notice-v1” and is valid for 180 days, after which the notice appears again. These entries stay in your browser.

Essential mechanisms of external services may be used for Cloudflare security checks, InPost collection-point selection or payments on Stripe’s website. Their privacy policies explain their processing.

Accepting this informational notice does not grant marketing or analytics consent. Reopen it using “Cookie settings” in the footer. Browser settings let you remove or block storage, which may affect the cart. If optional cookies are introduced, we will provide a choice and withdrawal controls before enabling them.

8. Security and updates

We use appropriate transmission security, access controls and organisational safeguards. Do not include sensitive personal data or card details in contact messages. Changes to the store or legal requirements may require policy updates; the latest version and update date are shown here.