Version 1.0 – effective 9 August 2026
This Privacy Policy explains how personal data is processed when you use https://prepack.pl, contact us or place an order. It is based on the GDPR and applicable Polish privacy and electronic communications law.
1. Controller
Prepack Solutions – Przemysław Chrapek
ul. Sycowska 29, 56-504 Dziadowa Kłoda, Poland
Tax ID (NIP): 8942966149, REGON: 527564565
e-mail: kontakt@prepack.pl
tel.: +48 663 666 217
No data protection officer has been appointed. Privacy requests may be sent to kontakt@prepack.pl.
2. Data we process
Depending on how you use the website, we may process your name, company name, tax number, billing and delivery addresses, e-mail, telephone number, order and payment details, account data, purchase history, correspondence, IP address, cookie identifiers, device/browser data, security logs and information about activity on the website.
Data is normally obtained directly from you. If you provide another person’s data, for example a delivery recipient, you should have a lawful basis to do so and inform that person about this Policy.
3. Purposes, legal bases and retention
- Orders, delivery, returns and complaints: performance of a contract, legal accounting/tax duties and legitimate interest in handling claims. Contract data is kept for the transaction, statutory accounting/tax periods (generally five years as calculated under Polish law) and applicable limitation periods.
- Customer account: performance of the account service. The account may be deleted on request. Inactive accounts may be deleted or anonymised after 24 months, except for data that must be retained for contracts, tax, complaints or claims.
- Contact and B2B quotations: steps requested before entering into a contract or legitimate interest in handling enquiries. Enquiries not followed by a contract are usually kept for up to 24 months after the matter is closed.
- Direct marketing: legitimate interest in presenting our own offer, with a right to object. Marketing by e-mail, SMS, messenger or telephone is used only where the consent required by electronic communications law has been obtained.
- Analytics: Google Analytics 4 is used only after consent, until consent is withdrawn or the relevant cookie/identifier expires.
- Advertising: Google Ads conversion measurement and remarketing are used only after consent.
- Security: technical logs may be processed on the basis of legitimate interest in preventing abuse and diagnosing faults, usually for up to 12 months unless an incident requires longer retention.
4. Required and voluntary data
Data marked as required during checkout is necessary to conclude and perform the contract. Without it, we cannot process the order or delivery. Contact form data is voluntary, but missing contact details may prevent a reply. Analytics and marketing consent is voluntary and is not required for basic use of the shop.
5. Recipients
Data may be disclosed, only where necessary, to hosting, e-mail, backup and IT providers; shop, form, security and optimisation providers including WooCommerce, Wordfence and LiteSpeed/QUIC.cloud; CookieYes; Google Ireland Limited for GA4 and Google Ads after consent; Meta Platforms Ireland Limited if you choose WhatsApp/Meta contact through Chaty; couriers and logistics providers including InPost; banks; accountants, advisers and public authorities where required by law.
6. Transfers outside the EEA
Some providers may process data outside the European Economic Area, particularly in the USA. Transfers may rely on an adequacy decision, including the EU–US Data Privacy Framework for a certified recipient, or on the European Commission’s Standard Contractual Clauses with additional safeguards where required. Information about the mechanism and a copy of relevant safeguards can be requested at kontakt@prepack.pl.
7. Your rights
Depending on the legal basis, you may request access, a copy, rectification, erasure, restriction, portability and may object to processing based on legitimate interest. Consent may be withdrawn at any time without affecting earlier lawful processing. You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
8. Profiling
After consent, activity data may be used to create advertising audiences. We do not make solely automated decisions producing legal or similarly significant effects.
9. Cookies
Necessary cookies support the cart, account and security. Functional, analytics and marketing technologies are used according to the choices available in the cookie settings panel. Analytics and marketing cookies are activated only after consent. Consent can be changed or withdrawn at any time through the cookie settings button.
10. Security and changes
We use measures appropriate to the risk, including TLS encryption, access controls, updates, security tools and backups. This Policy may be updated following changes in law or services. Each new version will state its effective date.