Privacy policy

We take care of your personal data and process it in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”). Below we explain what data we collect in the sklep.qindito.pl shop, for what purpose, and what rights you have.

1. Data controller

The data controller is Qindito Sp. z o.o., ul. Tytusa Chałubińskiego 8, 00-613 Warszawa, KRS 0000564755, NIP 7010493172, REGON 361866412. In all matters concerning personal data you can contact us by e-mail: sklep@qindito.pl or by post at the registered office address.

2. What data we process

• contact details: full name, e-mail address, phone number;
• delivery address;
• invoice details: company name, tax identification number and address — if you ask for a company invoice;
• the content of order notes and correspondence with us;
• order data: ordered Parts, amounts, payment and shipping status;
• IP address and technical connection data — to protect the Shop against abuse.

Providing data is voluntary but necessary to place and fulfil an order and to issue a sales document.

3. Purposes and legal bases

• conclusion and performance of the sales contract, including contact about the order, delivery, handling of returns and complaints — Article 6(1)(b) GDPR;
• issuing invoices, keeping accounts and handling complaints to the extent required by law — Article 6(1)(c) GDPR;
• answering enquiries about Parts, ensuring the security of the Shop and preventing abuse, and establishing, pursuing or defending against claims — Article 6(1)(f) GDPR (the controller’s legitimate interest).

We do not take decisions about you based solely on automated processing, including profiling.

4. Recipients of data

We share your data only with entities that help us fulfil the order:

• carriers and courier companies — to the extent necessary to deliver the shipment;
• the bank that holds our account — with regard to transfer data;
• an accounting office — with regard to accounting documents;
• IT service providers acting on our behalf: Shop hosting (Vercel Inc.), database and application back end (Supabase Inc.), photo storage (Cloudflare Inc.), e-mail delivery (Resend).

5. Transfers of data outside the EEA

Some IT service providers are based in the United States. Data is transferred on the basis of a European Commission decision finding an adequate level of protection (EU–US Data Privacy Framework) or of standard contractual clauses approved by the Commission. You can obtain a copy of the safeguards by contacting us.

6. How long we keep data

• data related to the contract — for the duration of its performance and then until the limitation periods for claims expire;
• accounting documents — for 5 years from the end of the calendar year in which the tax payment deadline passed;
• correspondence about enquiries — for the time needed to answer and to handle any resulting order;
• data processed on the basis of legitimate interest — until an effective objection is made.

7. Your rights

You have the right to:

• access your data and receive a copy of it;
• rectify your data;
• erase your data — to the extent that we are not required by law to keep it;
• restrict processing;
• data portability for data processed on the basis of the contract;
• object to processing based on legitimate interest;
• lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

To exercise your rights, write to us — we will reply within one month.

8. Cookies and browser storage

The Shop does not use advertising cookies or analytics tools that track users. We save the contents of your cart in your browser’s storage (localStorage) — it stays only on your device and you can delete it at any time by clearing your browser data. Hosting servers may log technical connection data (e.g. IP address) to ensure the security and continuity of the Shop. If you choose a language with the language switcher, we remember it in a cookie in your browser.

9. Security

The connection to the Shop is encrypted (HTTPS). The link to the order status page is unique and contains a security code — do not share it with third parties.

10. Changes to the policy

We may update the policy, e.g. if the law or our service providers change. The current version is always available on this page together with its effective date.