Privacy policy

The controller of personal data is Tomasz Maciejewski e-feniks, Myśliszów 2E, 58-262 Ostroszowice, Poland, EU VAT ID PL8821923112, statistical number (REGON) 022367611. Contact in data matters: sklep@e-feniks.com.pl.

• Order fulfilment — name or company name, delivery address, e-mail, phone, VAT ID. Basis: necessity to perform the contract (Art. 6(1)(b) GDPR).
• Accounting and settlements — invoice data. Basis: legal obligation (Art. 6(1)(c) GDPR).
• Customer and business accounts — login data, company data, order history, price level, credit limit. Basis: performance of the account service contract.
• Business verification at B2B registration — VAT ID and data from public business registers. Basis: legitimate interest in confirming that the buyer runs a business.
• Shop traffic analysis — IP address, device type, pages visited and phrases typed into the shop's search box. We keep the IP address in order to recognise a returning business customer by the fixed address of their office; we do not combine it with external sources and do not use it to profile individuals. Basis: legitimate interest in operating and improving the shop (Art. 6(1)(f) GDPR). This data is deleted after 13 months.
• Handling contact form messages and requests for quotation — the data provided in the form. Basis: legitimate interest in replying.
• Commercial messages — e-mail address. Basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Shop security and statistics — data on viewed products and search phrases, processed in the seller's own systems. Basis: legitimate interest in maintaining and improving the shop.

We share data only with entities involved in fulfilling the order or maintaining the shop, to the extent necessary for their tasks:

• carriers delivering the parcel (InPost, DHL, GLS) — recipient address and phone for delivery notification,
• the order and warehouse system (BaseLinker) — order data,
• the accounting system (inFakt) — invoice data,
• the e-mail provider (Resend) — e-mail address and the content of transactional messages,
• the hosting provider — for technical maintenance of the shop.

Signing in with Google or Facebook works the other way round: we receive your first name, last name and e-mail address from the provider you choose — that much and no more, and only after you consent in their dialogue. The provider learns that the sign-in concerned this shop; we do not pass on your basket or order history. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR). An account can also be created with the form, without those companies involved. If an account already exists under that address, signing in through the provider attaches to it instead of creating a second one. An account created through a provider has no shop password — you keep using the same button.

If a business customer uses shipping directly to their own recipient, they provide us with that recipient's data — the seller then processes it solely to deliver the parcel.

The shop runs an assistant based on a language model provided by Anthropic. The content of the conversation is transferred to that provider in order to generate an answer. Please do not enter sensitive data in the chat or information you would not want to share with an external provider; use your account and the contact form for order matters.

• Settlement data and invoices — for the period required by tax law, as a rule 5 years from the end of the tax year.
• Account data — until the account is deleted by the customer or a deletion request is made.
• Correspondence and requests for quotation — until the matter is closed and for the limitation period of any claims.
• Data processed on the basis of consent — until consent is withdrawn.

• access to your data and a copy of it,
• rectification of incorrect data,
• erasure — to the extent not precluded by a legal obligation,
• restriction of processing,
• portability of data processed under a contract or consent,
• objection to processing based on legitimate interest,
• withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal,
• a complaint to the President of the Polish Personal Data Protection Office.

You can unsubscribe from commercial messages with a single click — the unsubscribe link is in the footer of every such message.

The shop uses cookies necessary for its operation: keeping the session, the cart contents, the sign-in state and the selected country and language. Placing an order is not possible without them.

Cookie settings can be changed in your browser. Restricting necessary cookies may make the shop unusable.

Shop usage analytics: we record the pages you visit, search terms, products viewed, cart changes, the checkout process and any errors you encounter. This is used to improve the shop and customer service. To recognise a visit, the shop stores a random identifier in the browser's storage; it contains no personal data. We do not store IP addresses.

If you are signed in, this activity is linked to your account — so that your account manager can, for example, offer an item you could not find. The legal basis is the shop's legitimate interest (Art. 6(1)(f) GDPR). The data is kept for 13 months. You can object or request deletion at any time by sending a message through the contact form.

Providing data is voluntary but necessary to conclude and perform the contract — without a delivery address and invoice details an order cannot be fulfilled. Providing an e-mail address for commercial messages is entirely voluntary.