Privacy Policy

# PRIVACY POLICY FOR THE autolandparts.eu ONLINE SHOP

Last updated: 18 August 2026

This Privacy Policy sets out the rules for the processing and protection of personal data provided by Customers in connection with their use of the online shop available at **autolandparts.eu** (hereinafter: the “Shop”).

> **Note:** the document contains placeholders `[TO BE COMPLETED]` in places requiring confirmation of the tools actually used by the client (e.g. Google Analytics, Meta Pixel, Klaviyo). The tools listed below (Shopify, Przelewy24, courier) have been assumed to be correct based on previous arrangements — the rest need to be verified, as the list of data recipients must reflect the actual situation.

---

## §1 Data controller

1. The controller of personal data collected via the Shop is:

**Autoland Grzegorz Broniecki**
41B Wał Miedzeszyński Street, 04-987 Warsaw
Tax Identification Number (NIP): 9521395796, National Business Registry Number (REGON): 711687908
email: autoland@autoland.net.pl
tel.: 516 066 855

(hereinafter: “Controller” or “Seller”)

2. For matters relating to the protection of personal data, you may contact the Controller at the email address provided above.

## §2 Legal basis for data processing

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Act of 10 May 2018 on the protection of personal data.

## §3 Purposes, legal bases and data retention periods

| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Fulfilment of orders and the conclusion and performance of a sales contract | Article 6(1)(b) of the GDPR (performance of a contract) | For the duration of the contract, and after its termination until the limitation period for claims expires (as a rule, 6 years) |
| Issuing invoices and accounting documents; tax settlements | Article 6(1)(c) of the GDPR (legal obligation) | 5 years from the end of the tax year in which the tax liability arose |
| Handling complaints and returns | Article 6(1)(b) and (c) of the GDPR | For the period necessary to handle the complaint and for the period until the limitation period for claims expires |
| Creation and maintenance of a Customer Account | Article 6(1)(b) of the GDPR | Until the Customer deletes the Account |
| Direct marketing of our own products and services (Newsletter) | Article 6(1)(a) of the GDPR (consent) | Until consent is withdrawn |
| Marketing and remarketing on social media and advertising networks [TO BE COMPLETED if applicable] | Article 6(1)(a) of the GDPR (consent) | Until consent is withdrawn or cookies expire |
| Analysis of traffic on the Shop and statistics [SPECIFY tool] | Article 6(1)(f) of the GDPR (the Controller’s legitimate interest) | Up to 26 months (for Google Analytics) or in accordance with the settings of the relevant tool |
| Establishing, investigating and defending against claims | Article 6(1)(f) of the GDPR (the Controller’s legitimate interest) | Until claims become time-barred |
| Responding to enquiries submitted via the contact form / email / telephone | Article 6(1)(f) of the GDPR (the Controller’s legitimate interests) | Until the correspondence is concluded, not exceeding 3 years |

## §4 Scope of data processed

Depending on the purpose of processing, the Controller may process the following data: first name and surname, email address, telephone number, delivery address and residential/registered office address, company details (name, tax identification number) in the case of Customers who are business entities, bank account number (in the case of refunds), and for orders of car parts, additionally vehicle identification data (make, model, year of manufacture, VIN, engine number) necessary for the proper fulfilment of the order.

## §5 Recipients of personal data

Customers’ personal data may be disclosed to the following categories of recipients, solely to the extent necessary to fulfil the purposes set out above:

1. **Shopify International Limited** (Ireland) / Shopify Inc. (Canada) – the provider of the e-commerce platform on which the Shop operates, acting as a data processor on behalf of the Controller.
2. **Przelewy24 (PayPro S.A.)** – for the purpose of processing online payments.
3. **[TO BE COMPLETED – name of courier company(ies)]** – for the purpose of delivering parcels.
4. The accountancy firm serving the Controller – for the purposes of bookkeeping and tax returns.
5. The provider of hosting and email services.
6. [TO BE COMPLETED, if applicable: Google LLC (Google Analytics/GTM), Meta Platforms Ireland Ltd. (Meta Pixel), Klaviyo Inc. (email marketing) – for analytical and marketing purposes, on the basis of consent or the Controller’s legitimate interest].
7. State authorities authorised to receive data under the law (e.g. tax offices), where this arises from a legal obligation.

All data processors acting on behalf of the Controller are obliged to maintain confidentiality and to implement appropriate security measures, in accordance with the data processing agreements concluded (Article 28 of the GDPR).

## §6 Transfer of data outside the European Economic Area

1. Some of the service providers listed in §5 (in particular Shopify Inc., based in Canada, and any analytics/marketing tool providers based in the USA) may process personal data outside the European Economic Area (EEA).
2. Data transfers outside the EEA are carried out whilst ensuring an adequate level of data protection, in particular on the basis of standard contractual clauses approved by the European Commission, a decision by the European Commission confirming an adequate level of protection (e.g. under the EU-USS. Data Privacy Framework) or other legally permissible mechanisms.
3. The Customer has the right to obtain a copy of the safeguards applied when transferring data outside the EEA by contacting the Controller.

## §7 Rights of the data subject

In connection with the processing of personal data, the Customer has the following rights:

1. **Right of access** – to obtain information about the data being processed and to receive a copy of it.
2. **Right to rectification** – to request the correction of inaccurate data or the completion of incomplete data.
3. **Right to erasure** (‘right to be forgotten’) – in the circumstances provided for by the GDPR.
4. **Right to restriction of processing**.
5. **Right to data portability** – in respect of data processed on the basis of consent or a contract, by automated means.
6. **Right to object** to the processing of data on the basis of the Controller’s legitimate interests, including profiling.
7. **Right to withdraw consent** at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.
8. **The right to lodge a complaint** with the supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) – if the Customer considers that the processing of their data infringes the provisions of the GDPR.

To exercise the above rights, please contact the Controller at the following email address: autoland@autoland.net.pl.

## §8 Voluntary provision of data

1. The provision of personal data is voluntary; however, it is necessary for the conclusion and performance of the Sales Contract, the creation of an Account or the handling of a request (e.g. a complaint). Refusal to provide the data necessary for the fulfilment of an order prevents it from being placed and fulfilled.
2. Providing data for marketing purposes (Newsletter) is entirely voluntary and independent of the ability to make a purchase.

## §9 Profiling

1. The Controller may use profiling for the purposes of direct marketing, which involves tailoring the marketing content provided (e.g. product recommendations) to the Customer’s previous activity in the Shop; however, these decisions do not produce any legal effects on the Customer nor do they significantly affect them in any similar way.
2. The Customer may object to profiling at any time by contacting the Controller.

## §10 Cookies

The Shop uses cookies and similar technologies. Detailed rules governing their use, including the types of cookies used and how consent is managed, are set out in aseparate **Cookie Policy**, available at: autolandparts.eu/policies/cookies.

## §11 Data security

The Data Controller implements appropriate technical and organisational measures to ensure the protection of the personal data being processed, in particular against unauthorised access, loss, damage or destruction, including, amongst other things, connection encryption (SSL/TLS protocol), restricting access to data solely to authorised persons, and regular system updates.

## §12 Automated decision-making

The Data Controller does not make decisions regarding Customers based solely on automated data processing, including profiling, which would produce legal effects concerning them or similarly significantly affect them.

## §13 Changes to the Privacy Policy

1. The Controller reserves the right to amend this Privacy Policy, in particular in connection with changes to legislation, the development of the Shop’s functionality or changes to the tools used.
2. The current version of the Privacy Policy is always available at autolandparts.eu/policies/privacy-policy.

## §14 Final Provisions

In matters not covered by this Privacy Policy, the provisions of the GDPR and the relevant provisions of Polish law shall apply.