Privacy policy

1. Data controller

Your personal data is controlled by Beata Tkacz, trading as ZENA BEATA TKACZ, Grabiec 80a, 42-445 Szczekociny, NIP 6492195224 (“we”). For anything about your data, write to info@misoci.com.

2. What we process and why

• Orders and delivery: name, phone number, email, delivery address or chosen locker, and the configuration ordered; for an invoice, also your NIP and company name. Basis: performing the contract (GDPR Art. 6(1)(b)).
• Invoices and accounting: order and payment data. Basis: legal obligation (Art. 6(1)(c)).
• Phone verification and order view: your phone number and one-time SMS codes, and after verification your saved delivery address for autofill. Basis: performing the online-service contract (Art. 6(1)(b)).
• Security: IP address and technical browser data, the Cloudflare Turnstile bot check and limits on sending codes. Basis: our legitimate interest in protecting the shop from abuse (Art. 6(1)(f)).
• Complaints and claims: the data needed to handle them. Basis: legitimate interest (Art. 6(1)(f)).

We send no newsletters or advertising, do no profiling and make no automated decisions. Our emails and SMS messages are only verification codes and messages about your order.

Providing data is voluntary, but without it we cannot accept or deliver your order.

3. Who receives the data

We share data only with providers who help us run the shop, and only as much as they need:

• Amazon Web Services (shop hosting, database, email and SMS sending; servers in Frankfurt, in the European Union),
• Cloudflare (bot protection, product image storage),
• PayU S.A. of Poznań, ul. Grunwaldzka 186, 60-166 Poznań (payments; PayU also processes payment data as a separate controller),
• InPost and courier companies (delivery),
• our accountant, and public authorities where the law requires.

4. Transfers outside the EEA

The shop’s database is hosted in the European Union. Cloudflare (bot protection and product image storage) may still process data outside the European Economic Area. This relies on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission. You can request a copy of the safeguards at info@misoci.com.

5. How long we keep data

• order and invoice data: for the period required by tax law, generally 5 years from the end of the year the tax obligation arose, and until any claims are time-barred,
• phone number and saved delivery address: until you ask us to delete them, unless we must keep them as part of an order record,
• SMS codes: we store only an encrypted hash, and a code is valid for 10 minutes.

6. Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interest. Write to us at info@misoci.com.

You may also complain to the Polish data protection authority, the President of UODO (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

7. Cookies

See the Cookie policy.