Privacy and Cookie Policy

1. Who is responsible for your data?

The controller of your personal data isELETOR Sp. z o.o., ul. Pod Sosno 28, 87-305 Zbiczno, Poland, KRS 0000793000, NIP 8741795623.

You can contact us by email:[email protected]or in writing at the address above. We have not appointed a data protection officer; the controller handles privacy matters directly.

This policy applies to the ELETOR online shop and contacts relating to its operation, including data concerning customers, company representatives and parcel recipients. It does not replace the shop’s terms and conditions, information about consumer rights or voluntary marketing consents. Processing rules are based primarily on the GDPR and the Polish Electronic Communications Law.

2. What data do we receive?

Depending on how you use the shop, this may include: your first and last name, email address, telephone number, delivery and billing address, company details and NIP, information about an order, payment, return or complaint, and the contents of correspondence. If you create an account, we also process login details and purchase history.

The server also receives technical connection data, in particular your IP address, the time of the request, the address of the page visited and information about your browser. This data is used to operate and protect the shop, not to track users for advertising purposes.

We receive data primarily from you. If you place an order for another person or represent a company, you may provide us with the recipient’s or contact person’s details. Provide only the information needed to handle the order and inform that person about this policy. Informing them as the purchaser does not replace ELETOR’s duty to provide privacy information. Unless an applicable exception under Article 14(5) GDPR applies, this duty must be fulfilled no later than one month after obtaining the data; if the first contact with that person or the first disclosure of their data to another recipient occurs earlier, it must be fulfilled by that earlier time. In such a case, the source of the data is the person placing the order, and the data includes contact, address and purchase-fulfilment details.

Providing data is voluntary, but data marked as required in the form is needed to provide the relevant service. Without a delivery address, we cannot send the parcel, and without data required by law, we cannot issue a correct sales document. We do not require data unrelated to operating the shop.

3. What do we use data for?

4. Who may receive your data?

We share only the data needed for a specific task. Recipients may include:

• OVH— server infrastructure provider;
• Google Workspace (Gmail)— email provider for [email protected], operating as a paid business service; it processes sender and recipient data, as well as the contents of messages and attachments;
• OpenAI— provider of the API and ChatGPT Business/Enterprise, used to translate and prepare messages and product content; when handling correspondence, it may receive personal data included in the content provided;
• InPostand the carrier selected for delivery, especially international delivery — recipient, contact and parcel details;
• Apaczka— if we use this intermediary to arrange a parcel shipment;
• banks and payment service providers handling the selected method — data necessary to settle the transaction;
• providers supporting accounting, legal or technical services, to the extent needed to provide their services;
• public authorities and other entities entitled by law to receive data.

Providers processing data on our behalf act under appropriate agreements. A carrier, bank or payment service provider may also act as a separate controller, in accordance with its own privacy policy. We indicate available payment and delivery methods when you make a purchase. The mere plan to offer card or BLIK payments does not mean that data is shared with a provider you have not yet selected.

We do not sell customer data or share customer databases to create advertising audiences on social media.

5. How long do we retain data?

Different information serves different purposes, so we do not apply a single retention period to all data. We determine the period according to the purpose, legal obligations and the actual need to serve the customer. We do not retain all correspondence indefinitely just because it might be useful someday.

• Orders and purchase history:for the time needed to fulfil the purchase and for the period required for accounting, after-sales service and protection of claims. Information about the model purchased, its configuration and significant arrangements may also be needed later if a customer asks for technical assistance or help selecting parts.
• Technical and service records:for as long as the device or installation is being serviced and there is a justified need to continue support, repairs and parts selection, taking into account the nature and expected period of use of the product. Keeping service history does not mean that all old contact details, delivery addresses and attachments need to be retained. Personal data that is no longer needed for this purpose or other legally justified purposes will be deleted or anonymised.
• Complaints, returns and disputes:until the matter is concluded and for the period necessary to demonstrate that obligations have been fulfilled and to protect claims, in accordance with the applicable limitation periods. If proceedings are ongoing, we retain the relevant records for as long as needed to conclude and settle them.
• Tax records:for the period required by law, generally until 5 years have elapsed from the end of the calendar year in which the tax payment deadline expired. The period may be longer, for example if limitation is suspended or interrupted. Accounting records are subject to separate statutory periods.
• Customer account:until it is deleted; order and documentation data that we must retain on other grounds remain for the periods applicable to them.
• Routine enquiries and correspondence:for the time needed to handle the matter and any justified need to continue dealing with it. If a message documents a purchase, configuration, service, complaint or dispute, the period is determined by that matter. The fact that there has been previous contact does not justify retaining the entire exchange indefinitely.
• Data in AI tools:we usually use it for the current session of translating or preparing a message. Ending the session usually ends ELETOR’s work with the data for that task, but does not mean that the data is automatically deleted from the provider’s conversation history, files or systems. The retention period depends on the feature used, account settings and OpenAI’s service terms. An output needed to serve the customer may be retained in correspondence or documentation relating to the relevant matter.
• Google Workspace email:we retain messages and attachments according to the purpose of the specific correspondence described above. Archiving a message does not mean it has been deleted; technical deletion periods and any additional retention also depend on the service settings and terms.
• Logs and backups:for as long as needed to protect, diagnose and restore the system. Records relating to an incident may be needed until an investigation or proceedings have concluded. Deleting data from a live system does not mean it is immediately deleted from all backups; how long it remains in backups depends on their retention cycle.
• Cookies:for the period described below or until they are deleted earlier through your browser.

Deleting an account or withdrawing consent does not automatically delete documents that must be retained under the law or on another basis that still applies. You can ask us about the retention period or criteria for data relating to your specific matter.

7. Cookies and similar technologies

Cookies are small pieces of information stored by your browser. Similar rules apply to other ways of storing or accessing information on your device.

You can delete cookies or restrict their storage in your browser settings. Blocking cookies needed for the shop to work may make it harder to log in or use the basket. Deleting cookies does not delete order data stored in the shop’s system.

8. Marketing contact and social media

The shop does not currently offer newsletter subscriptions. Messages about an order or replies to your enquiry are used to handle the matter. Sending commercial information through channels covered by Article 398 of the Polish Electronic Communications Law requires separate prior consent. We do not make a purchase conditional on giving that consent.

Links to Facebook, Instagram and LinkedIn lead to external services. When you open them, the operator of the relevant service processes data under its own rules. If you contact ELETOR through such a service, we receive the information you share in the message and data that enables us to reply; we use it to handle the contact on the legal bases described in section 3.

9. Transfers outside the European Economic Area

Using Google email and OpenAI services may involve processing data outside the European Economic Area, in particular in the United States, including by those providers’ subcontractors. The location of processing depends on the specific service, contract and settings; we do not claim that all correspondence and all AI operations remain within the EU. Delivery to a country outside the EEA may also require the recipient’s data to be transferred abroad.

Transfers outside the EEA require a legal basis consistent with Chapter V of the GDPR. This may be a European Commission adequacy decision, if it covers the relevant recipient and transfer, or appropriate safeguards, such as standard contractual clauses together with an assessment of the transfer circumstances and, where needed, additional protective measures. We do not assume that using a business version of a service or selecting a European region replaces these requirements.

You can ask us about the recipient, country and legal basis for a specific transfer, and how to obtain information about the safeguards in place. The operators of external social media services you visit by clicking a link describe their own rules.

10. AI tools, automated decisions and security

We use the OpenAI API and ChatGPT Business/Enterprise to translate and prepare product content, as well as messages related to customer service. If a message contains personal data, submitting it to an AI tool means that the service provider processes that data. This may include contact details, order information and other information in the message or attachment. The purpose is to make communication easier, particularly in different languages. The legal basis for using AI to assist with correspondence is our legitimate interest in communicating efficiently with customers — Article 6(1)(f) GDPR, taking their rights and right to object into account. AI is not an additional marketing purpose. The data shared should be limited to the information necessary for the specific task; do not include sensitive data in correspondence unless it is needed to handle your enquiry.

Under the shop configuration covered by this policy, we do not make decisions about customers based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them.

Protecting data requires technical and organisational measures appropriate to the risk. Do not send full card details, security codes, passwords or BLIK codes in ordinary correspondence. If a payment is handled by a provider, use the payment form intended for that purpose.