Privacy Policy

  • Privacy Policy

    Last updated: [24.08.26]

    § 1. General provisions

    1. This Privacy Policy defines the rules for the processing and protection of personal data of Users of the online store operating at vaporum.pl (hereinafter: "the Store").
    2. The administrator of personal data is:
      Hubert Szymański
      e-mail address: kontaktvaporum@proton.me
      (hereinafter: "the Administrator").
    3. Data protection is carried out in accordance with the requirements of generally applicable laws, including in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Act of 10 May 2018 on the protection of personal data.
    4. The Administrator exercises particular care to protect the interests of data subjects, and in particular ensures that the data collected by him are processed lawfully, fairly and transparently.

    § 2. What data we collect

    In connection with the use of the Store, the Administrator collects data to the extent necessary to provide the individual services offered, including:

    Data provided when placing an order:

    • first and last name,
    • delivery address (street, house/apartment number, postal code, city, country),
    • e-mail address,
    • phone number,
    • (optional) company name and NIP (tax identification number) — when purchasing with an invoice,
    • data necessary for payment processing (handled by an external payment operator — the Administrator does not store payment card data).

    Automatically collected data:

    • IP address,
    • device and browser data,
    • data regarding website activity (visited subpages, visit time) — via cookies and similar technologies.

    Data provided when subscribing to the newsletter (if applicable):

    • e-mail address,
    • (optional) name.

    § 3. Purposes and legal bases of data processing

    Purpose of processing Legal basis (GDPR)
    Order fulfillment (conclusion and performance of a sales contract) Art. 6(1)(b) — performance of a contract
    Issuance of an invoice / sales document Art. 6(1)(c) — legal obligation (tax regulations)
    Consideration of complaints and returns Art. 6(1)(b) and (c)
    Contact regarding an order Art. 6(1)(b)
    Direct marketing of own products (newsletter) Art. 6(1)(a) — consent
    Website traffic analysis, statistics, Store optimization Art. 6(1)(f) — legitimate interest of the Administrator
    Establishment, exercise or defense of claims Art. 6(1)(f) — legitimate interest of the Administrator

    § 4. Data recipients

    Personal data may be transferred to the following categories of recipients, solely to the extent necessary to achieve the specified purposes:

    1. Suppliers fulfilling the order shipment — including foreign suppliers / wholesalers from whom goods are ordered in the dropshipping model. The User acknowledges that, in connection with the sales model used by the Store (dropshipping), data necessary for delivery (name, surname, address, phone number) may be transferred directly to the goods supplier for the purpose of fulfilling and shipping the order.
    2. Payment operators handling transactions in the Store.
    3. IT service providers — including the e-commerce platform provider (Shopify) and tools supporting order fulfillment (e.g., order management systems like DSers), based on concluded data processing entrustment agreements.
    4. Courier companies / logistics operators carrying out the delivery.
    5. Entities providing accounting and legal services to the Administrator.
    6. State authorities — solely on the basis and within the limits of applicable law.

    § 5. Transfer of data outside the European Economic Area (EEA)

    1. Orders in the Store are generally fulfilled using warehouses located in Poland / European Union, which limits the need to transfer personal data outside the EEA.
    2. However, the Administrator reserves that due to the specifics of the sales model (cooperation with external goods suppliers), in some cases, order fulfillment may involve the transfer of data necessary for delivery (name, surname, address, phone number) to a supplier located outside the EEA. This applies in particular to situations involving a change of supplier for a given product or the introduction of new product variants.
    3. In such cases, the Administrator makes every effort to ensure that data transfer takes place with an adequate level of protection, based on standard contractual clauses approved by the European Commission (where applicable) or on the basis of exceptions provided for in Article 49 of the GDPR, in particular the necessity of the transfer for the performance of a contract concluded in the interest of the data subject.
    4. By placing an order, the User acknowledges the above rules for delivery fulfillment.

  • Personal data related to order fulfillment are stored for the period necessary to:
    • perform the sales contract,
    • fulfill tax and accounting obligations (in accordance with regulations — generally 5 years from the end of the tax year in which the tax obligation arose),
    • pursue any claims (until the expiry of the claims limitation period).
  • Data processed based on consent (e.g., newsletter) are stored until the consent is withdrawn.
  • Automatically collected data (cookies) are stored according to the periods indicated in § 8.

    • § 7. Rights of the data subject

    Every person whose data is processed by the Administrator has the right to:

    1. access their personal data,
    2. rectify (correct) data,
    3. erase data ("right to be forgotten") — to the extent that it does not conflict with the Administrator's legal obligations,
    4. restrict processing of data,
    5. data portability — receive data in a structured, commonly used format,
    6. object to data processing based on the Administrator's legitimate interest,
    7. withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
    8. lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, if they believe that data processing violates GDPR provisions.

    To exercise the above rights, please contact the Administrator at the e-mail address indicated in § 1 sec. 2.

    § 8. Cookies

    1. The Store uses cookies and similar technologies for the purpose of:
      • ensuring the proper functioning of the Store (essential cookies — e.g., shopping cart operation),
      • remembering User preferences,
      • keeping visit statistics (e.g., Google Analytics, Meta Pixel — if used),
      • for marketing and remarketing purposes (e.g., social media advertising) — only with the User's consent.
    2. The User can change cookie settings at any time in their internet browser settings, including completely blocking their saving. Limiting the use of cookies may affect some functionalities available in the Store.
    3. Upon the first visit to the Store, a banner is displayed to the User with the option to consent to individual categories of cookies (unless they are essential for the Store's functioning).

    § 9. Data security

    1. The Administrator applies technical and organizational measures to ensure the protection of processed personal data appropriate to the threats and categories of data covered by protection, including securing data against unauthorized access, loss, damage or destruction.
    2. Data transmission between the User's device and the Store's server takes place using the encrypted SSL/TLS protocol.
    3. Access to personal data is restricted to persons authorized by the Administrator, who are bound by confidentiality.

    § 10. Automated decision-making and profiling

    The Administrator does not make decisions concerning Users based solely on automated processing of personal data, including profiling, which would produce legal effects concerning them or similarly significantly affect them.

    § 11. Changes to the Privacy Policy

    1. The Administrator reserves the right to make changes to this Privacy Policy, in particular in connection with changes in applicable law, changes in the functioning of the Store, or the development of internet technology.
    2. The current version of the Privacy Policy is always available at: vaporum.pl/policies/privacy-policy.

    § 12. Contact

    For matters related to personal data protection and this Privacy Policy, you can contact the Administrator: