Polityka prywatności

Updated: 1 October 2026

1. Controller and contact

The controller of your personal data is ET-BUD Tomasz Tajak, Polish tax identification number (NIP) 5421585124, address: ul. Jana Matejki 43, 15-196 Białystok, Poland. For personal data enquiries, email biuro@et-bud.pl, call +48 885 055 165 or write to the address above.

2. Data we process

The data we process depends on how you use the website:

• Contact and quotations: your name, email, phone number if supplied, company, correspondence and information needed to prepare a quote, such as product, quantity and delivery location.
• Purchases: buyer and recipient details, address, email, phone number, invoice details including company name and NIP, ordered products, and information about payment, collection, complaints and returns.
• Website use: IP address, connection time, visited page address, browser and device information, error information, session identifier and basket contents.
• Customer account: an account is created with your first order. We store your email, account identifier, contact details, order history and a protected password hash. You receive a link to set your password. We do not use account creation as consent to marketing.

Providing data is voluntary. Without required data we cannot respond to an enquiry or fulfil an order. Provide your company details and NIP if you need a business invoice. Do not send health data or other sensitive information that is unnecessary for your enquiry.

If a form or ordering function is unavailable, entering data alone does not mean an enquiry or order has been accepted. You can contact us by phone or email.

3. Purposes and legal bases

• Preparing quotations, managing the account and performing the contract: Article 6(1)(b) GDPR — taking steps at your request before entering into a contract and performing it.
• Invoices, accounting and obligations to buyers: Article 6(1)(c) GDPR — compliance with obligations arising from, among other things, tax and consumer law.
• General correspondence and contact with business representatives: Article 6(1)(f) GDPR — our legitimate interest in responding and maintaining business relationships.
• Website security and legal claims: Article 6(1)(f) GDPR — protecting the system, preventing abuse, and establishing, pursuing or defending claims.

Accepting the terms and acknowledging this policy is not consent to marketing. Purchases do not depend on consent to advertising. The current store does not operate a newsletter or advertising tracking.

4. Data recipients

Authorised ET-BUD staff have access to data. Where needed to provide our services, we also use hosting provider Hostorama and technical support and accounting providers. Processors acting on our behalf work under appropriate agreements.

If you choose delivery, the carrier and logistics intermediary may receive the necessary recipient details. For collection, we do not provide data to a carrier. Payment on collection does not require disclosure to an online payment operator. We may disclose data to authorities entitled to receive it by law. We do not sell personal data.

The current website does not use external analytics or advertising tools requiring transfers outside the European Economic Area. Introducing a service involving such transfers requires this policy to identify the recipient, transfer basis and safeguards beforehand.

5. Retention periods

• Enquiries without an order: until correspondence ends and for up to 12 months after the last contact, unless further retention is needed for a specific claim.
• Orders: for contract performance and then until the applicable limitation period expires; generally 3 years for business claims or 6 years for other claims, subject to rules for calculating, suspending and interrupting that period.
• Tax documents: generally 5 years from the end of the calendar year in which the tax payment deadline expired, unless legislation or ongoing proceedings require longer retention.
• Complaints and returns: while the case is handled and then until related claims become time-barred.
• Session data: until the session expires; a WooCommerce basket session usually expires after 2 days. Data relating to a specific security incident may be retained until it is resolved and subsequently for the applicable claim period.
• Customer account: while the account is maintained, and after deletion only to the extent necessary for legal obligations or claims. You may request account deletion by email; deleting an account does not remove documents we must retain by law.

After the applicable period, data is deleted or anonymised. Retaining data required by law does not mean it is used for marketing.

6. Your rights

Under the conditions set out in the GDPR, you may request access and a copy, rectification, erasure, restriction of processing and portability of data processed automatically under a contract or consent. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing is based on consent in future, you may withdraw it without affecting the lawfulness of earlier processing.

Send requests to biuro@et-bud.pl. We will generally respond within one month. If a GDPR-permitted extension is needed, we will explain why. We may request information needed to verify your identity. Erasure does not cover data we must retain for legal obligations or protection of claims.

You may complain to the President of the Polish Personal Data Protection Office. Information and contact details are available at uodo.gov.pl. We do not make decisions with legal effects based solely on automated processing, or profile users for marketing.

7. Cookies

The store uses cookies needed for the basket, sessions and security, principally:

• woocommerce_items_in_cart and woocommerce_cart_hash — basket display information, retained until the browser session ends;
• wp_woocommerce_session_* — an identifier for the basket session, usually retained for 2 days;
• wordpress_test_cookie, wordpress_logged_in_* and wordpress_sec_* — cookie support checks and login authentication; duration depends on the session and login settings;
• etbud_currency — your chosen PLN or EUR currency, retained for up to 30 days; trp_language — the language preference used by TranslatePress.

The EUR exchange rate is fetched from the public NBP service without sending your personal data. We do not currently use analytics or advertising cookies. Cookies required to deliver the service you request are not used for advertising. Optional tools will require information and prior consent where required by law.

You can delete cookies and change storage rules in your browser settings. Blocking technical cookies may prevent the basket or login from working. Links to other websites lead to services with their own privacy policies.

8. Security and updates

We use access restrictions and technical measures suited to processing risks. This document may be updated when store functions, providers or legislation change. The current version remains available at this address, with the update date shown above.