Privacy Policy

PRIVACY POLICY OF THE PRASKA.shop ONLINE STORE (UK customers)

1. Who is the controller

The controller of the personal data of users and Customers of the PRASKA.shop online store at praska.shop (the "Store") is Eco Cats Collection Sp. z o.o., registered office: ul. Ignacego Łukasiewicza 5, 43-502 Czechowice-Dziedzice, Poland, NIP: 6521747271, KRS: 0000848261 (the "Controller", "we").
Contact on data protection matters: e-mail office@praska.shop, telephone +48 514 003 790, or by post to the registered office.
For customers in the United Kingdom we process personal data in accordance with the UK GDPR and the Data Protection Act 2018; as a controller established in Poland we are also subject to Regulation (EU) 2016/679 (the EU GDPR) and Polish data protection law.
We are established in Poland and have no establishment in the UK.
Capitalised terms (such as Customer, Order, Account) have the meanings given in the Store's Terms & Conditions.

2. Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases (references are to Article 6(1) UK GDPR, which mirrors the EU GDPR):

Concluding and performing a contract: processing your Order and the Sales Contract, creating and running your Account, handling delivery and payment, handling returns and complaints, Article 6(1)(b) (processing necessary for the performance of a contract, or to take steps at your request before entering into one).
Complying with legal obligations: in particular tax and accounting obligations (issuing and retaining invoices and accounting records) under the laws applicable to us as a Polish company, Article 6(1)(c).
Our legitimate interests: Article 6(1)(f), covering: handling enquiries and correspondence (including the contact form and pre-contract questions), establishing, pursuing and defending legal claims, internal analytics and statistics to improve the Store, and keeping the Store secure (including server logs).
Consent: Article 6(1)(a), for: the newsletter (including information about discounts, such as a newsletter sign-up discount), other marketing activities requiring consent, and the use of non-essential cookies (analytics, marketing), for UK visitors in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR). You can withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

3. What data we process

We process the data you provide in the Store's forms: name and surname, e-mail address, telephone number, delivery address, home/registered address (if different from the delivery address), and, for Customers running a business, the business name and tax number; also data about your Orders and payments and, automatically, technical data connected with your use of the Store (IP address, device and browser data, server logs, cookie data, see section 9).

4. Is providing data mandatory?

Providing personal data is voluntary, but providing the data marked as required is a condition of placing an Order, concluding a Sales Contract or creating an Account, without it, the Order, contract or Account is not possible. Providing data for marketing purposes (such as the newsletter) is always entirely voluntary.

5. Recipients of data

Personal data may be shared with the following categories of recipients, only to the extent necessary for the given purpose:

Store platform and hosting provider: the Store runs on the Shoper e-commerce platform (SaaS), and the Store's data is stored on the platform provider's servers: Shoper S.A., ul. Pawia 9, 31-154 Kraków, Poland, Polish company register (KRS): 0000395171, Polish tax ID (NIP): 9452156998.
Payment operators: your data goes only to the operator you choose for a given transaction; the operators currently available for your delivery country are shown at checkout. For orders delivered outside Poland these are:
- a. Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (payment cards, Apple Pay, Google Pay);
- b. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Carriers and postal/courier operators delivering your Order, the ones you select from the delivery methods available at checkout.
Providers of accounting and tax services to the Controller: to the extent necessary to fulfil the Controller's accounting obligations.
Providers of analytics and marketing tools: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), Google Analytics; Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland), Facebook/Instagram tools. These tools operate only with your consent (see section 9).
Public authorities: only where disclosure is required by law.

Entities processing data on our behalf act under data processing agreements (Article 28 UK GDPR / EU GDPR) and are not permitted to use the data for their own purposes.

6. International transfers of data

We are based in Poland, and your data is processed primarily in Poland and elsewhere in the European Economic Area (EEA). From the perspective of the UK GDPR, sending your data from the UK to us is a "restricted transfer"; it is covered by the UK's adequacy regulations for the EEA, so no further safeguards are needed for that transfer.
In connection with the Google and Meta tools described in section 9, data (in particular cookie data) may be transferred to third countries, including the USA, to companies in the Google and Meta groups. Such transfers take place with appropriate safeguards: for UK data, on the basis of the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") for entities certified under it, or the International Data Transfer Agreement (IDTA) / UK Addendum to the EU standard contractual clauses; for EEA data, on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses. You can obtain a copy of the applicable safeguards by contacting us.
Data may also be transferred to a third country where necessary for the performance of your contract (for example, delivery of an Order outside the EEA, including to the UK).

7. How long we keep data

Data connected with concluded contracts (Orders, returns, complaints, correspondence), for the duration of the contract and then until the expiry of the limitation periods for claims arising from the contract.
Data in accounting and tax records (invoices), for 5 years from the end of the calendar year in which the tax payment deadline fell, as required by Polish tax law applicable to the Controller.
Data processed on the basis of consent (newsletter, marketing, non-essential cookies), until you withdraw consent; permanent deletion of your Account is also treated as withdrawal of consent to processing of Account data.
Data processed on the basis of legitimate interests, until a valid objection is raised or the interest ceases (for claims, until the limitation periods expire).
Account data, for as long as the Account exists; after deletion, data connected with Orders placed is kept to the extent and for the periods described in points 1–2.

8. Your rights

Everyone whose data we process has the right of access to their data, and the rights to rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, including an objection to direct marketing, which is always effective, and withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal (Articles 15–18, 20, 21 and 7(3) UK GDPR).
To exercise your rights: e-mail office@praska.shop or write to the Controller's registered office. We respond without undue delay, at the latest within one month (extendable by two further months in complex cases, in which case we will let you know).
If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113. As we are established in Poland, you may also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl), which is the authority competent for the Controller in the EU.
We do not make decisions about Customers based solely on automated processing, including profiling, that would produce legal effects concerning them or similarly significantly affect them. The analytics and marketing tools (section 9) may use data about your activity in the Store for statistics and content personalisation, only with your consent.

9. Cookies and similar technologies

The Store uses cookies, small text files stored on your device. We use:
- a. essential cookies: enabling the Store's basic functions (session, Basket, login, security); these do not require consent;
- b. functional cookies: remembering your chosen settings;
- c. analytics cookies: used to produce statistics on how the Store is used (Google Analytics, Google Ireland Limited);
- d. marketing cookies: used to personalise advertising content (Meta Platforms Ireland Limited tools).
Cookies other than essential ones (analytics, marketing, and functional cookies beyond what is strictly necessary) are used only with your consent, given via the consent banner shown on your first visit, in line with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR. You can withdraw or change your consent at any time in the consent settings available in the Store.
Independently of the above, you can manage cookies in your browser settings (including Google Chrome, Mozilla Firefox, Safari, Microsoft Edge, Opera), block them and delete stored ones. Restricting essential cookies may make some Store functions, including placing an Order, difficult or impossible.
Information about user behaviour may be logged at server level (server logs). This data is used solely to administer the Store and keep it secure.

10. Newsletter

Subscribing to the newsletter is voluntary and requires providing an e-mail address and consenting to receive commercial communications. The legal basis is consent (Article 6(1)(a) UK GDPR; for UK subscribers, consent is also collected in accordance with PECR). You can unsubscribe at any time, using the unsubscribe link in every message or by e-mailing office@praska.shop; your data will then be removed from the newsletter mailing list.

11. Data security

We apply technical and organisational measures appropriate to the risk (Article 32 UK GDPR / EU GDPR), including encryption of data in transit (SSL/TLS), access controls, and data processing agreements with our processors, to protect data against unauthorised access, loss or destruction.

12. Changes to this Privacy Policy

We may update this Privacy Policy, in particular where the law changes or where the tools we use or the recipients of data change. The new version is published in the Store together with a notice of the change and its effective date; Customers with an Account or newsletter subscription will additionally be informed of material changes by e-mail with reasonable notice. Changes do not limit rights already acquired and do not change the basis of processing of data collected earlier without a legally required ground.

If you have any questions about this Privacy Policy, please contact us at office@praska.shop.