Polski
English
English translation for information only. The legally binding version of this document is the Polish one. In case of any discrepancy, the Polish version prevails.
Privacy Policy
This Privacy Policy explains how we process the personal data of Customers and visitors to the Alfa System online store, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
1. Data controller
The data controller is Alicja Włodarczyk, running a business under the name ALFA SYSTEM Alicja Włodarczyk, ul. Zemborzycka 53, 20-445 Lublin, NIP 9461117762, REGON 432644579 (hereinafter: the "Controller").
For matters related to personal data, you can contact the Controller: by email at biuro@alfasystem.lublin.pl, by phone at 81 744 10 91, or in writing at the registered office address. The Controller has not appointed a Data Protection Officer.
2. Purposes, legal bases, and retention periods
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Concluding and performing the sales contract, including order handling, payment, and delivery | Art. 6(1)(b) GDPR (necessity for the performance of a contract) | until the contract is performed, and then until the limitation period for claims expires |
| Maintaining the Customer's account in the Store | Art. 6(1)(b) GDPR | until the account is deleted |
| Handling complaints and statements of withdrawal from the contract | Art. 6(1)(c) GDPR (legal obligation arising from the Consumer Rights Act (ustawa o prawach konsumenta) and the Civil Code) | until the matter is closed, and then until the limitation period for claims expires |
| Issuing invoices and keeping accounting and tax records | Art. 6(1)(c) GDPR (tax and accounting regulations) | 5 years from the end of the calendar year in which the tax payment deadline fell |
| Responding to enquiries sent by email, phone, or through the contact form | Art. 6(1)(f) GDPR (legitimate interest: communicating with people contacting us) | for the duration of the correspondence, no longer than 12 months after it ends (unless the enquiry leads to a contract) |
| Sending a newsletter with information about our offer and promotions | Art. 6(1)(a) GDPR (consent) | until consent is withdrawn |
| Establishing, pursuing, or defending against claims | Art. 6(1)(f) GDPR (legitimate interest) | until the limitation period for claims expires |
| Ensuring the operation and security of the Store, including the use of necessary cookies | Art. 6(1)(f) GDPR; for cookies other than necessary ones — consent (Art. 6(1)(a) GDPR) | in accordance with the Cookie Policy |
3. Scope of data and voluntariness of providing it
We process, in particular: first and last name, company name and NIP (for business purchases), delivery and invoice address, email address, phone number, order history, and payment-related data (excluding full payment card details, which are processed by the payment operator).
Providing your data is voluntary, but necessary to conclude and perform the contract (without it we cannot fulfil your order), and, with respect to invoicing data, required by tax law. Providing data in order to receive the newsletter is entirely voluntary.
4. Recipients of data
Personal data may be shared, only to the extent necessary to achieve the purposes described above, with the following categories of recipients:
- the payment operator — PayPro SA, based in Poznań (ul. Pastelowa 8, 60-198 Poznań), operator of the Przelewy24 service — where online payment is chosen;
- courier companies — to the extent necessary to deliver the parcel;
- hosting, email, and IT service providers that we use to run the Store;
- accounting service providers;
- entities financing the purchase (instalments, leasing) — only when the Customer chooses this form of financing;
- public authorities — only where an obligation to disclose data arises from the law.
Entities processing data on our behalf do so under data processing agreements and only in accordance with our instructions. We do not transfer personal data to countries outside the European Economic Area.
5. Rights of data subjects
Every person whose data we process has the right to:
- access their data and receive a copy of it (Art. 15 GDPR),
- rectify their data (Art. 16 GDPR),
- erase their data (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on the Controller's legitimate interest (Art. 21 GDPR),
- withdraw consent at any time — without affecting the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the supervisory authority — PUODO (President of the Personal Data Protection Office) (ul. Stawki 2, 00-193 Warszawa).
To exercise these rights, please contact us using the details given in section 1.
6. Automated decision-making
We do not make decisions based solely on automated processing of data, and we do not use profiling that produces legal effects for Customers.
7. Data security
We apply technical and organizational measures to protect personal data against loss, unauthorized access, and disclosure, including an encrypted SSL connection and access to data limited solely to authorized persons.
8. Cookies
The Store uses cookies. Detailed information, including how to change your settings, can be found in the Cookie Policy. You can change your cookie decision at any time by clicking Cookie settings.
9. Changes to the Privacy Policy
The Privacy Policy may be updated, for example due to changes in the law or in how our services are provided. The current version is always available on this page. Version effective from 11 September 2026.