Privacy policy

1. Who we are (data controller)

1. The controller of your personal data is WYPOC Sp. z o.o., ul. Wola 1/2, 38-480 Rymanów, Poland, registered in the Polish National Court Register (KRS) under no. 0001253578, VAT/tax ID (NIP): 6842689666, REGON 545229568 ("we", "us").

2. For any privacy questions, contact us at kontakt@wypoc.com, by phone at +48 535 745 515, or by post at ul. Wola 1/2, 38-480 Rymanów, Poland.

3. This policy applies to customers of the wypoc.com store, people who contact us, newsletter subscribers and visitors to our website, wherever they live.

4. We process personal data in line with the EU General Data Protection Regulation (GDPR). The GDPR also applies in Norway, Iceland and Liechtenstein through the EEA Agreement.

2. Why we use your data and on what legal basis

To conclude and perform the contract (order, delivery, installation): name, delivery address, e-mail, phone number and, for business customers, company name and VAT number – Art. 6(1)(b) GDPR.
To process payments: order details, amount, e-mail – Art. 6(1)(b) GDPR.
Invoicing and accounting (including the Polish e-invoicing system KSeF): invoice details – Art. 6(1)(c) GDPR (legal obligation).
Export and customs documentation for deliveries outside the EU (e.g. to Norway): name, address, order contents and value – Art. 6(1)(b) and (c) GDPR.
Complaints, warranty claims and withdrawals: customer details, description of the issue, photos – Art. 6(1)(b), (c) and (f) GDPR.
Contact (phone, e-mail, booking a call through our online calendar): name, e-mail, phone number, message content – Art. 6(1)(b) or (f) GDPR.
Newsletter and marketing: e-mail address and, optionally, first name – Art. 6(1)(a) GDPR (consent).
Analytics and advertising (cookies): data on how you use the website – Art. 6(1)(a) GDPR (consent).
Establishing, exercising or defending legal claims: data necessary for the case – Art. 6(1)(f) GDPR (our legitimate interest).

3. Do you have to give us your data?

Providing your data is voluntary, but we need it to accept and fulfil your order, deliver the goods and handle any complaints.

4. Who receives your data

We share data only to the extent necessary with:

payment service providers that process payments made at checkout – some of them act as independent controllers for the payment process;
transport companies, couriers, freight forwarders, customs agents and installation crews working on our behalf;
Shopify International Limited and other Shopify group companies – our store platform and hosting provider;
Cal.com, Inc. – our call-booking calendar provider, if you use it;
Google Ireland Limited (Google Analytics, Google Ads) and Meta Platforms Ireland Limited (Meta Pixel) – only if you consent to cookies;
our accounting firm and invoicing software provider;
public authorities, including tax and customs authorities, where the law requires it.

5. Transfers outside the EEA

Some of our service providers (e.g. Shopify, Google, Meta, Cal.com, and carriers or IT providers based outside Europe) may process data outside the European Economic Area, including in Canada and the USA. We only allow such transfers where there is a European Commission adequacy decision or another appropriate safeguard, such as the Standard Contractual Clauses. You can ask us for a copy of the safeguards used.

6. How long we keep your data

We keep contract data for as long as needed to perform the contract and then until the limitation period for any claims expires and for as long as tax and accounting law requires (as a rule, 5 years from the end of the tax year). Data processed on the basis of consent is kept until you withdraw your consent. Data needed to defend against claims is kept until those claims become time-barred.

7. Your rights

You have the right to: access your data, have it corrected, have it erased (within the limits of our legal obligations), restrict processing, data portability, object to processing based on our legitimate interest, and withdraw your consent at any time (this does not affect processing carried out before withdrawal). Send your requests to the contact details in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority – in particular in the country where you live or work, or where the alleged infringement took place. Our lead supervisory authority is the Polish President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. In Norway, you can contact Datatilsynet (www.datatilsynet.no); in other countries, your national data protection authority.

8. Cookies

1. Our store uses: strictly necessary cookies (shopping cart, session) – no consent needed; analytics cookies (Google Analytics) – only with your consent; marketing cookies (Meta Pixel, Google Ads) – only with your consent.

2. You can give, change or withdraw your consent at any time in the cookie banner (cookie preferences link in the website footer) and in your browser settings.

9. Profiling

We do not make decisions based solely on automated processing that produce legal effects for you. Profiling for advertising purposes takes place only if you consent to marketing cookies.