Privacy Policy

peptydy-sklep.com — effective from March 4, 2026.

1. Data Controller

The controller of personal data processed in connection with the operation of the online store peptydy-sklep.com is Vantaris Research sp. z o.o. with registered office in Warka (05-660), ul. Grójecka 79A, KRS 0001226339, NIP 7972095902, REGON 54407069200000.

Contact with the Controller: [email protected].

The Controller has not appointed a Data Protection Officer (DPO). All matters concerning the protection of personal data can be addressed directly to the Controller at the above email address.

The Controller undertakes to protect personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) and Polish data protection legislation.

2. Scope of Processed Data

In order to process orders and ensure proper functioning of the Store, the Controller processes:

Identification data: first and last name.
Contact data: email address, phone number, shipping address (street, postal code, city).
Transaction data: order history, selected product variants, order amounts.
Technical data: IP address, browser type, operating system, server logs.
Loyalty program data: points balance, accrual and redemption history.

Providing identification and contact data is voluntary but necessary to place and process an order.

3. Purposes and Legal Bases of Processing

Personal data is processed for the following purposes:

Order fulfillment (acceptance, picking, shipping, cash on delivery payment handling) — basis: contract performance (Art. 6(1)(b) GDPR).
Returns and complaints handling — basis: contract performance (Art. 6(1)(b) GDPR).
Legal obligations (accounting, taxes, record keeping) — basis: legal obligation (Art. 6(1)(c) GDPR).
Customer account and loyalty program management — basis: contract performance (Art. 6(1)(b) GDPR).
Newsletter (product information, promotions) — basis: voluntary consent (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time.
Analytics and Store optimization (Google Analytics 4) — basis: voluntary consent (Art. 6(1)(a) GDPR).
Marketing and remarketing (Google Ads, Meta Pixel) — basis: voluntary consent (Art. 6(1)(a) GDPR).
Service security (logs, abuse protection) — basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).

4. Data Retention Period

Data is retained for the period necessary to fulfill the processing purpose:

Order data and accounting records: 5 years from the end of the calendar year in which the transaction took place (tax obligation).
Customer account data: until the account is deleted by the Customer or upon their request.
Loyalty program data: for the duration of the customer account.
Newsletter: until consent is withdrawn (unsubscription).
Analytics and marketing data: in accordance with cookie retention periods (details in the Cookie Policy).
Server logs: maximum 12 months.

5. Data Recipients

Personal data may be shared only with entities necessary for the provision of Store services:

InPost S.A. — logistics operator, for package delivery (name, parcel locker address, phone, email).
Accounting office — for invoice issuance and tax settlements.
Hosting provider — for server and Store infrastructure maintenance.
Google Ireland Ltd. — Google Analytics 4 and Google Ads (upon consent to analytical/marketing cookies).
Meta Platforms Ireland Ltd. — Meta Pixel (upon consent to marketing cookies).

The Controller does not sell or share personal data with third parties for marketing purposes.

6. Data Transfers Outside the EEA

Data collected through analytics and marketing tools (Google Analytics, Google Ads, Meta Pixel) may be transferred to servers in the United States. Data transfers are based on:

Standard Contractual Clauses (SCC) adopted by the European Commission,
additional security measures applied by Google and Meta.

Data is transferred only upon consent to the respective cookie categories. Details in the Cookie Policy.

7. User Rights

Every data subject has the right to:

Access their data and receive a copy thereof.
Rectification (correction) of inaccurate data.
Erasure of data („right to be forgotten”) — if there is no legal basis for further processing.
Restriction of processing — e.g., during verification of data accuracy.
Data portability — receiving data in a machine-readable format.
Objection to processing based on legitimate interest.
Withdrawal of consent at any time (without affecting the lawfulness of processing carried out prior to withdrawal).

To exercise the above rights, please contact: [email protected]. The Controller will respond without undue delay, no later than 30 days from receipt of the request.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

8. Profiling and Automated Decisions

The Controller does not make automated decisions (including profiling) within the meaning of Art. 22 GDPR that would produce legal effects or similarly significantly affect the Customer.

The loyalty program calculates points automatically based on order value, but this does not constitute profiling that affects service availability or pricing.

9. Cookies

The Store uses cookies to ensure proper functioning, collect statistics, and conduct marketing activities. Users can manage cookie consents via the banner (Complianz) or browser settings.

Detailed information about cookie types, their purposes, and retention periods can be found in the Cookie Policy.

10. Data Security

The Controller applies appropriate technical and organizational measures to protect personal data, including:

SSL/TLS encryption (HTTPS),
regular updates of server and Store software,
access to data restricted exclusively to authorized persons,
data stored on servers located within the European Union.

11. Changes to the Privacy Policy

The Controller reserves the right to update this Privacy Policy in the event of changes in legislation or data processing methods. The new version will be published on the Store website with the date of the last update.

This Privacy Policy takes effect on March 4, 2026.