Privacy policy
PRIVACY AND COOKIE POLICY
for the online store www.graff-team.com (compliant with GDPR)
§ 1. Data Controller
The controller of your personal data is the partnership:
P.P.H.U GRAFF civil law partnership (spółka cywilna) Jacek Antoniewicz Mirosław Dolecki, with its registered office at ul. Zbożowa 1B, 78-600 Wałcz, Poland,
Tax ID (NIP): 765-164-05-37, REGON: 320211522.
For matters related to personal data protection, you may contact the Controller via:
- E-mail address: iod@graff-team.com
- Phone contact: +48 67 258 22 77 (Monday to Friday, 7:00 AM – 3:00 PM CET)
- Postal address: P.P.H.U GRAFF spółka cywilna Jacek Antoniewicz Mirosław Dolecki, ul. Zbożowa 1B, 78-600 Wałcz, Poland
§ 2. Purposes, Legal Grounds, and Retention Periods
We process personal data for clearly defined purposes, on applicable legal grounds, and for specified retention periods:
| Purpose of Processing | Legal Basis (GDPR) | Scope of Data | Retention Period |
|---|---|---|---|
| Order processing and sale contract execution | Art. 6(1)(b) GDPR (necessary for contract performance) | First and last name, delivery address, billing address, phone number, e-mail, order details | For the duration required to complete the order and until the expiry of the statutory limitation period for potential claims |
| Registration and maintenance of customer accounts | Art. 6(1)(b) GDPR (contract for the provision of electronic services) | First and last name, e-mail address, purchase history, saved addresses, encrypted password | Until a request for account deletion is submitted by the customer |
| Tax and accounting obligations | Art. 6(1)(c) GDPR (legal obligation under tax and statutory laws) | First and last name / company name, Tax ID (NIP), billing address, order and invoice numbers | For a period of 5 years, calculated from the end of the calendar year in which the tax payment deadline expired |
| Handling complaints, returns, and warranties | Art. 6(1)(b) & (c) GDPR (legal obligation of statutory warranty and non-conformity) | Identification data, contact details, order number, bank account number (for refunds) | For 1 year after the expiry of warranty/guarantee rights or until disputed claims are resolved |
| Contact form and communication | Art. 6(1)(f) GDPR (legitimate interest – efficient customer support) | First and last name, e-mail address, optional phone number, message body | For the duration of communication and the period necessary to evidence the correspondence (up to 3 years) |
| Sending newsletter and marketing offers | Art. 6(1)(a) GDPR (voluntary, explicit consent) | E-mail address, first name (if provided) | Until the withdrawal of consent (unsubscribing from the newsletter) by the user |
| Defense and establishment of legal claims | Art. 6(1)(f) GDPR (legitimate interest of the Controller) | Data gathered during the conclusion and execution of transactions | Until the statutory limitation period for claims specified in the Civil Code expires |
§ 3. Data Recipients (Data Processors)
To ensure proper operation of the store and fulfillment of orders, your personal data may be shared with trusted third parties:
- Postal and logistics operators: courier companies and postal services (e.g., InPost, DPD, DHL, Poczta Polska) to the extent necessary to deliver the parcel,
- Payment gateways: electronic payment operators and credit card payment providers (e.g., PayU, Przelewy24, PayPal),
- IT and technical service providers: web agency maintaining the store software (2ClickShop / Agencja TI), web hosting, server providers, and e-mail marketing platforms,
- Accounting and tax advisory services: external accounting office handling the Controller's financial statements,
- Public authorities: authorized state bodies (e.g., tax authorities, police, courts) solely on the basis of applicable legal regulations and formal requests.
All data processors guarantee the implementation of appropriate technical and organizational measures to ensure personal data protection.
§ 4. Your Rights Under the GDPR
Every data subject whose data is processed by the Controller is entitled to:
- Right of access: request confirmation as to whether personal data is processed and obtain a copy of such data (Art. 15 GDPR).
- Right to rectification: request immediate correction of inaccurate data or completion of incomplete data (Art. 16 GDPR).
- Right to erasure ("right to be forgotten"): request data deletion when there is no longer a legal ground for processing (Art. 17 GDPR).
- Right to restriction of processing: restrict processing operations under conditions specified in Art. 18 GDPR.
- Right to data portability: receive the personal data provided in a structured, commonly used format (e.g., CSV, XML) or transfer it to another controller (Art. 20 GDPR).
- Right to object: object at any time to processing based on legitimate interests (Art. 21 GDPR), including direct marketing.
- Right to withdraw consent: where processing is based on consent (e.g., newsletter), consent can be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Right to lodge a complaint with a supervisory authority:
If you consider that the processing of your data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, tel. +48 22 531 03 00, e-mail: kancelaria@uodo.gov.pl, www.uodo.gov.pl (or with the local supervisory authority in your country of residence within the EU).
§ 5. Voluntary Provision of Data
Providing personal data on www.graff-team.com is voluntary, but constitutes a prerequisite to:
- Place and fulfill orders (failure to provide data prevents order shipment and invoice issuance),
- Create and manage a customer account,
- Receive the newsletter (requires providing an e-mail address),
- Receive a reply to an inquiry sent via the contact form.
§ 6. Cookie Policy and Analytics Tools
1. What are cookies?
Cookies are small text files stored on your end device (computer, smartphone) while browsing the website. They ensure proper operation of the site, maintain user sessions, and remember preferences.
2. Categories of cookies used
- Strictly necessary (technical): essential for store operation (e.g., shopping cart, session maintenance after login, transaction security). Processed under the legitimate interest of the Controller.
- Functional and preferences: enable remembering choices made by the user (site language, currency PLN/EUR/USD, country settings).
- Analytics and statistics: help analyze site traffic and improve shop structure (e.g., Google Analytics). Information is anonymized and processed only upon user consent.
- Marketing and advertising: used to deliver tailored promotional materials within partner networks (e.g., Meta Ads, Google Ads). Explicit consent is required.
3. Cookie management and changing consent
You may adjust your cookie preferences at any time via the cookie banner in the footer (link "Manage cookie files") or directly through your web browser settings:
- Google Chrome: Settings > Privacy and security > Cookies and other site data
- Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
- Microsoft Edge: Settings > Cookies and site permissions
- Apple Safari: Preferences > Privacy > Block all cookies
- Opera: Settings > Privacy & security > Cookies
§ 7. Automated Decision-Making and Profiling
Customer personal data will not be used for automated decision-making that produces legal effects or similarly significantly affects the customer (including automated price profiling within the meaning of Art. 22 GDPR).
§ 8. Transfers of Data Outside the European Economic Area (EEA)
As a rule, the Controller does not transfer personal data outside the European Economic Area. In case of using global software tools (e.g., Google Ireland Limited), any transfer is based on Standard Contractual Clauses (SCC) approved by the European Commission or the EU-US Data Privacy Framework.
§ 9. Amendments to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy to reflect legislative changes or new store functionalities. The updated version will be published each time at www.graff-team.com.
Date of last update: September 9, 2026