B2B DATA PROCESSING NOTICE

for chlodnicze.com

1. Data Controller

The controller of personal data is:

ARKO Jacek Kałembasiak
Wyszyńskiego 5k/27
10-455 Olsztyn
Poland
VAT: 7391001561
REGON: 510261711
Email: arkoolsztyn@gmail.com

This notice applies to business customers (“B2B Clients”) placing orders in the online store https://chlodnicze.com.

2. Purpose and Legal Basis of Data Processing

Personal data of B2B Clients (or persons acting on their behalf) is processed for the following purposes:

A. Performance of a Contract (Order Handling)
Legal basis: Article 6(1)(b) GDPR

Includes:

  • order acceptance and confirmation,
  • communication regarding order details,
  • preparation and delivery of goods,
  • after-sales support,
  • warranty handling.

B. Compliance with Legal Obligations
Legal basis: Article 6(1)(c) GDPR

Includes:

  • issuing and storing VAT invoices,
  • maintaining accounting and tax documentation,
  • fulfilling legal obligations under Polish and EU law.

C. Legitimate Interests of the Controller
Legal basis: Article 6(1)(f) GDPR

These include:

  • ensuring the security of business transactions,
  • maintaining evidence of agreements and correspondence,
  • asserting or defending legal claims,
  • fraud prevention,
  • internal analytics (e.g. sales statistics),
  • communication with B2B Clients.

3. Categories of Data Processed

The following data may be processed in relation to B2B transactions:

A. Company Identification Data

  • company name,
  • registered address,
  • VAT number (NIP),
  • REGON (if applicable),
  • business registration data.

B. Representative or Contact Person Data

  • first and last name,
  • job title or role (optional),
  • email address,
  • telephone number.

C. Transaction and Order Data

  • order details,
  • delivery address,
  • billing information,
  • bank account number (if provided for refunds),
  • invoices,
  • complaint and warranty documentation.

D. Technical Data (Website Usage)

  • IP address,
  • session identifiers,
  • cookies (according to the Cookies Policy),
  • device information.

4. Data Recipients

Personal data may be shared with:

  1. Courier and transport companies – for delivery of goods.
  2. Accounting and bookkeeping services – for financial reporting.
  3. IT and hosting service providers – for operating WordPress / WooCommerce and server infrastructure.
  4. Payment and banking institutions – only when necessary.
  5. Manufacturers or service centers – for warranty and repairs.
  6. Legal advisors or debt collection agencies – if necessary for claims.
  7. Public authorities – when required by law.

The controller does not sell personal data to third parties.

5. Transfer of Data Outside the EU/EEA

Some data may be transferred outside the European Economic Area, specifically when using:

  • Google services (Analytics, Ads),
  • Meta services (Facebook / Instagram Pixel).

Such transfers rely on:

  • the EU–US Data Privacy Framework,
  • Standard Contractual Clauses (SCC),
  • or other safeguards required by GDPR.

6. Data Retention Period

Personal data is retained for:

A. Contract-related data

For the duration of the contract and until all claims expire (up to 6 years).

B. Accounting documentation

Stored for 5 years in accordance with Polish accounting regulations.

C. Communication and technical data

Stored for up to 3 years unless needed for defending legal claims.

D. Warranty and complaint data

Stored for the warranty period and for the limitation period of potential claims.

7. Rights of Data Subjects (Company Representatives)

Individuals whose data is processed (e.g. employees or owners of B2B Clients) have the following rights:

  • right of access to personal data,
  • right to rectification,
  • right to erasure,
  • right to restriction of processing,
  • right to data portability,
  • right to object to processing based on legitimate interests,
  • right to lodge a complaint with the supervisory authority:
    President of the Polish Personal Data Protection Office (UODO)
    https://uodo.gov.pl/

Requests may be submitted via:
arkoolsztyn@gmail.com

8. Voluntary or Mandatory Nature of Providing Data

  1. Providing data is voluntary, but necessary to:
    1. place an order,
    2. issue an invoice,
    3. perform delivery services.
  2. Failure to provide required data may prevent the Seller from concluding or fulfilling the contract.

9. Automated Decision-Making and Profiling

The controller does not:

  • perform automated decision-making,
  • engage in profiling that produces legal effects concerning B2B Clients.

10. Contact for Data Protection Matters

For any questions regarding the processing of personal data:

arkoolsztyn@gmail.com
+48 601 682 046

The controller responds without undue delay, in accordance with GDPR requirements.