This policy applies from 7 October 2026. It sets out the principles for processing the personal data of customers and users of the zemot.com.pl online shop in all language versions, and the principles for using cookies. Capitalised terms have the meaning given in the Terms and Conditions of the online shop.
§ 1. Controller
- The controller of personal data is Zemot spółka z ograniczoną odpowiedzialnością with its registered office in Kiełpin, ul. Cienista 78, 05-092 Kiełpin, Poland, entered in the National Court Register (KRS) under number 0000498016, kept by Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy KRS, tax ID (NIP) 5221066141 ("Controller").
- In all matters concerning personal data you can contact the Controller by e-mail at zemot@zemot.pl, in writing at the registered office address or by phone at +48 503 082 662.
- The Controller has not appointed a Data Protection Officer (DPO).
- The Controller processes data in accordance with Regulation (EU) 2016/679 ("GDPR") and Polish data protection law and applies technical and organisational measures to protect the data, including an encrypted connection (SSL/TLS).
§ 2. Purposes, legal bases and retention periods
| Purpose of processing | Scope of data | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Conclusion and performance of the sales contract (order processing, delivery, payment) | First and last name, delivery address, e-mail, phone, company details and tax ID (for an invoice), order data | Art. 6(1)(b) | until the limitation period for claims under the contract expires |
| Maintaining the account | data provided during registration, order history | Art. 6(1)(b) | until the account is deleted |
| Issuing invoices and bookkeeping | data from sales documents | Art. 6(1)(c) (tax and accounting law) | 5 years from the end of the year in which the tax payment deadline expired |
| Handling complaints, withdrawals and warranty claims | identification data, order data, content of the request | Art. 6(1)(c) and (f) | until the limitation period for claims expires |
| Contact with the customer (e-mail, phone, form) | data provided in the message | Art. 6(1)(f) (legitimate interest: answering the enquiry) | until the matter is resolved and then until the limitation period for any claims expires |
| Product reviews | signature, content of the review | Art. 6(1)(a) | until the review is deleted or consent is withdrawn |
| Newsletter and marketing e-mails | e-mail address, name, information on activity in the shop | Art. 6(1)(a) (consent) | until consent is withdrawn |
| Shop analytics and statistics | data from cookies and similar technologies | Art. 6(1)(a) (consent to analytics cookies) | until consent is withdrawn, at most for the lifetime of the cookies |
| Advertising and remarketing (Google Ads, Edrone) | data from cookies, device identifiers, information on activity | Art. 6(1)(a) (consent to marketing cookies) | until consent is withdrawn, at most for the lifetime of the cookies |
| Establishing, pursuing and defending claims | data necessary for the matter in question | Art. 6(1)(f) | until the limitation period for claims expires |
The Controller handles orders placed through the Allegro and InPost Buy services on the basis of the contract (Art. 6(1)(b) GDPR). The principles of data processing by these services are governed by their own privacy policies.
§ 3. Voluntary provision of data
- Providing data is voluntary but necessary to conclude and perform the sales contract, set up an account or issue an invoice. Without this data it is not possible to place an order or set up an account.
- Providing data for the newsletter and consenting to analytics and marketing cookies is entirely voluntary. Not doing so does not affect the ability to shop.
§ 4. Recipients of data
The Controller shares data only to the extent necessary for the purpose in question. The recipients of data are:
| Recipient | Role | Purpose |
|---|---|---|
| cyber_Folks S.A. – operator of the Shoper platform | processor | shop platform and hosting, handling returns and withdrawals |
| Operator of the webd.pl service | processor | e-mail hosting |
| Operator of the Apilo system | processor | handling marketplace orders |
| Edrone sp. z o.o. | processor | sending the newsletter and marketing messages, analysing activity in the shop |
| Google Ireland Ltd. (Google Analytics, Google Tag Manager, Google Ads, Merchant Center) | processor or independent controller, depending on the service | statistics, measuring advertising effectiveness, advertising |
| PayPro S.A. (Przelewy24), Autopay S.A., Stripe Payments Europe, Ltd. (Ireland), InPost S.A. (InPost Pay) | independent controllers | payment processing |
| FedEx, InPost S.A., ORLEN Paczka sp. z o.o., DPD Polska sp. z o.o., MAGNAT NET PL sp. z o.o. (Polkurier) and foreign carriers | independent controllers or processors | delivery of parcels |
| Public authorities (e.g. tax office, courts) | independent controllers | where required by law |
§ 5. Transfer of data outside the European Economic Area
- Some recipients (Google, Stripe) may transfer data to countries outside the EEA, in particular to the USA.
- Transfers take place on the basis of an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) for companies participating in this programme and, in other cases, on the basis of standard contractual clauses approved by the European Commission.
- You can obtain a copy of the safeguards by contacting the Controller.
§ 6. Profiling
- With consent to marketing cookies or to the newsletter, the Controller uses the Edrone and Google Ads tools to analyse the user's activity in the shop (e.g. products viewed, cart contents) in order to tailor the content of messages and advertising to their interests.
- Profiling does not lead to decisions that produce legal effects concerning the user or similarly significantly affect them (Art. 22 GDPR). The Controller does not set prices individually on the basis of automated decision-making.
§ 7. Rights of data subjects
- Everyone has the right to:
- access their data and receive a copy,
- rectification of data,
- erasure of data,
- restriction of processing,
- data portability (where processing is based on a contract or consent),
- object to processing based on legitimate interest, including objecting to direct marketing,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- To exercise these rights, simply send a message to zemot@zemot.pl. You can also withdraw consent to the newsletter via the link in each message, and consents to cookies – in the cookie settings (§ 8(4)).
- The Controller replies without undue delay, at the latest within one month of receiving the request.
- Everyone has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority in the European Union Member State of their habitual residence or place of work.
§ 8. Cookies and consents
- Cookies are small files stored on the user's device. The shop also uses similar technologies, e.g. the browser's local storage (localStorage) and pixels.
- The shop uses four categories of cookies:
- necessary – ensure the shop works (cart, login, security, storing consents); used without consent,
- functional – store the user's settings and preferences; used with consent,
- analytics – used to compile statistics (incl. Google Analytics); used with consent,
- marketing – used to display advertising and measure its effectiveness (incl. Google Ads, Edrone); used with consent.
- On the first visit the shop displays a banner in which the user can accept all categories, reject all except necessary ones, or select individual categories. Until the user gives consent, Google tools work in restricted mode (Google Consent Mode) and do not store analytics or marketing cookies.
- You can change or withdraw your consent at any time in the cookie settings available in the shop. The current list of tools and cookies can be found in these settings.
- You can also delete or block cookies in your browser settings. Blocking necessary cookies may make it impossible to use some shop functions, e.g. the cart.
§ 9. Final provisions
- The Controller may amend this policy, in particular in the event of changes in the law or in the tools used. The current version is always available on the shop website.
- Versions of this policy in languages other than Polish are informative translations; in the event of discrepancies, the Polish version prevails.