Privacy Policy - Viscoto

1. Data Controller

The controller of your personal data is:

Company: PARO PAULINA WALKOWICZ Address: ul. Zygmunta Starego 1E/20, 30-198 Kraków, Poland VAT number: 7532394084 REGON: 161468534 Email: office@viscoto.com Phone: +48 508 019 881

You may use the above contact details for any matter relating to the processing of your personal data.

2. Purposes and Legal Bases for Processing

2.1 Order Fulfilment and Sales Contracts When you place an order in our online store, we process your personal data such as your name, delivery address, email address, phone number, and data required for invoicing. The legal basis is Article 6(1)(b) GDPR — processing is necessary for the performance of a contract to which you are a party. We retain data for 5 years from the end of the tax year in which the transaction took place, as required by tax and accounting regulations.

2.2 User Account Management If you create an account in our store, we process your data to maintain and operate the account, provide access to your order history, and manage your preferences. The legal basis is Article 6(1)(b) GDPR. Data is retained until the account is deleted or for 3 years from the last login.

2.3 Newsletter and Marketing Communications If you have subscribed to our newsletter, we process your email address to send information about products, promotions, and news. The legal basis is Article 6(1)(a) GDPR — your voluntary consent. You may withdraw your consent at any time by clicking the “Unsubscribe” link in any message or by writing to office@viscoto.com. Withdrawal of consent does not affect the lawfulness of processing that took place before it was withdrawn.

2.4 Handling Enquiries and Complaints When you contact us via the contact form, email, or phone, we process your data in order to respond to your enquiry or handle your complaint. The legal basis is Article 6(1)(b) and (f) GDPR. Data is retained for the time necessary to handle the matter, and in the case of complaints — for 3 years.

2.5 Analytical and Statistical Purposes We analyse how our website is used for statistical and optimisation purposes, in order to continuously improve our offering and the functioning of the site. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in improving our services.

2.6 Compliance with Legal Obligations We process data in order to fulfil obligations imposed by law, such as tax, accounting, and consumer protection requirements. The legal basis is Article 6(1)(c) GDPR.

3. Recipients of Personal Data

Your personal data may be shared with the following categories of recipients:

Courier and postal service providers — to deliver ordered products (e.g. InPost, DPD, DHL).
Electronic payment providers — to process payments (e.g. PayU, Przelewy24, Stripe).
IT and hosting service providers — to maintain the technical infrastructure of the site.
Accounting firms and tax advisors — to fulfil financial obligations.
Meta Platforms Ireland Ltd. (Facebook Pixel) — for ad performance analysis and remarketing. Details: https://www.facebook.com/privacy/policy/
Google LLC (Google Analytics) — for website traffic analysis. Data may be transferred to the USA on the basis of Standard Contractual Clauses. Details: https://policies.google.com/privacy
Newsletter service providers (e.g. Mailchimp, Freshmail) — to handle email delivery.

We share your data only to the extent necessary to provide services and require third parties to maintain the confidentiality and security of your data.

4. Your Data Protection Rights

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR) — you may obtain information about what data we process about you and receive a copy.
Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR) — you may request deletion of your data in certain circumstances (“right to be forgotten”).
Right to restriction of processing (Art. 18 GDPR) — you may request restriction of processing in certain situations.
Right to data portability (Art. 20 GDPR) — you have the right to receive your data in a structured, machine-readable format.
Right to object (Art. 21 GDPR) — you may object to processing based on our legitimate interest.
Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without giving a reason.
Right to lodge a complaint — you have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl).

To exercise your rights, contact us by email at office@viscoto.com or in writing to our registered address. We will respond without undue delay and no later than 30 days.

5. Cookies and Tracking Technologies

5.1 What are cookies? Cookies are small text files saved on your device by your web browser. They allow the site to recognise your device on subsequent visits and remember your preferences and settings.

5.2 Types of cookies used

Essential — required for the site to function properly (session, cart, login). They cannot be disabled without losing key site features.
Functional — remember your preferences (language, region, font size) to personalise displayed content.
Analytical — collect anonymous information about how the site is used (Google Analytics). They help us improve the site.
Marketing — enable targeted advertising and measurement of campaign effectiveness (Facebook Pixel).
Session — temporary, automatically deleted when the browser is closed.
Persistent — stored on your device for a set period or until manually deleted.

5.3 Managing cookies On your first visit to the site, we display a banner asking for your consent to use non-essential cookies. You may change your preferences at any time in the cookie settings available in the site footer or directly in your browser settings.

Instructions for managing cookies in popular browsers:

Google Chrome: Settings → Privacy and security → Cookies and other site data
Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
Safari: Preferences → Privacy → Manage Website Data
Microsoft Edge: Settings → Cookies and site permissions

5.4 Google Analytics We use Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to collect anonymous information such as the number of visits, referring pages, and user behaviour. This information does not identify you personally. You can opt out of Google Analytics tracking by installing the browser add-on: https://tools.google.com/dlpage/gaoptout

5.5 Facebook Pixel We use the Facebook Pixel tool provided by Meta Platforms Ireland Ltd. The Pixel collects information about your behaviour on the site and may be used to display targeted ads on Meta platforms (Facebook, Instagram) and measure their effectiveness. You can manage your ad preferences on Facebook under: Settings → Ads.

6. Data Transfers Outside the European Economic Area

In connection with the use of Google Analytics and Facebook Pixel, your data may be transferred to the United States. Such transfers are made on the basis of Standard Contractual Clauses approved by the European Commission or an adequacy decision. We take all necessary steps to ensure an adequate level of protection for your personal data in accordance with the GDPR.

7. Automated Decision-Making and Profiling

Your personal data is not used for automated decision-making that could produce legal effects or similarly significantly affect you. We may use data in an automated manner (e.g. via analytical tools) solely for statistical and optimisation purposes.

8. Data Security

We apply appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

Encryption of data transmission using SSL/TLS protocol (HTTPS connection).
Access controls limiting data access to authorised personnel only.
Regular data backups.
Use of strong passwords and two-factor authentication where possible.

9. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy in the event of changes to applicable law, changes to the technologies we use, or changes in how we process data. We will notify you of any material changes via a prominent notice on the website or by email (if you are subscribed to our newsletter or have an account in the store).