Privacy Policy

This document explains what personal data we collect at oem-motordecals.com, why, on what legal basis, whom we pass it to and what rights you have.

§ 1Data controller

The controller of your personal data is MOTOR DECALS BEATA KIZIUKIEWICZ, ul. Słowiańska 17, 75-846 Koszalin, Poland, VAT ID PL4990494114, REGON 383944951.
For all matters concerning personal data write to [email protected] or to the registered address.
We have not appointed a data protection officer - we are not required to, and data matters are handled directly by the controller.

Identification and address data - first name and surname or company name, delivery and billing address, and for business purchases a tax or EU VAT number.
Contact data - e-mail address and telephone number.
Order data - items ordered, amounts, chosen delivery and payment method, history of orders, returns and complaints.
Account data - e-mail address and password. Passwords are stored only as a hash; we do not know them and cannot read them.
Correspondence - the content of messages you send us, together with the address they came from.
Technical data - IP address, browser and device type, and the country determined from the IP address. We use the country to calculate the correct VAT rate and show the price in your currency.
We do not store payment card data. The payment is handled entirely by the payment provider; we only receive the result.

Performing your order - accepting and performing the contract, delivery, contact about the order, handling returns and complaints. Basis: performance of a contract (Art. 6(1)(b) GDPR).
Running your account, if you create one. Basis: performance of the account contract (Art. 6(1)(b) GDPR).
Tax and accounting obligations - issuing and storing invoices and transmitting them to the National e-Invoicing System. Basis: legal obligation (Art. 6(1)(c) GDPR).
Defending against claims and pursuing our own. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
Security of the shop - protection against abuse, bots and attacks, including protection of forms. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
Answering your message when you write to us without placing an order. Basis: our legitimate interest in replying (Art. 6(1)(f) GDPR).
We do not run a newsletter, we do not profile and we do not take automated decisions producing legal effects concerning you.

Order data, invoices and related correspondence - 6 years, counted from the end of the year in which the order was completed. The period follows from the limitation of claims and covers the shorter five-year tax obligation.
Account data - until the account is deleted. You may delete it at any time by writing to us; deletion does not remove accounting documents that the law requires us to keep.
Correspondence unrelated to an order - up to 2 years from the last message.
Technical data in server and protection logs - up to 12 months.

Data goes only to entities without which the shop could not operate. Each of them processes it on our instructions or as an independent controller within its own service:
Payment service providers, when you choose an electronic payment. With a bank transfer the data is seen only by the bank.
Carriers and postal operators, to the extent needed to deliver the parcel. You see the name of the carrier chosen for your order when placing it and in the dispatch notice.
Server infrastructure providers on which the shop runs. The servers are located in Germany.
The provider of the site protection and acceleration service, through which traffic to the shop passes, including the IP address.
The provider of the e-mail sending service - your e-mail address and the content of the message we send you go there, together with the order data it concerns.
The provider of the invoicing system.
The National e-Invoicing System (KSeF) - a system run by the Polish Ministry of Finance, to which the law requires invoices to be transmitted.
Data may also be disclosed to state authorities where they request it under the law.

Some of the services we use - in particular payment handling, site protection and e-mail sending - belong to entities established outside the European Economic Area or using servers outside it.
In such cases the transfer takes place on the basis of a European Commission adequacy decision or standard contractual clauses approved by the European Commission.
We will provide a copy of the safeguards applied on request, to the address given in § 1.

You have the right of access to your data and to receive a copy of it.
You have the right to rectification of inaccurate data and completion of incomplete data.
You have the right to erasure of your data if we have no basis to keep it further. This right does not cover invoice data, which tax law requires us to retain.
You have the right to restriction of processing where you contest the accuracy of the data or have raised an objection.
You have the right to data portability for data you provided to us under a contract, in a commonly used, machine-readable format.
You have the right to object to processing based on our legitimate interest.
We answer requests without undue delay and no later than one month from receiving them.

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

The shop stores on your device only files necessary for it to work. We do not run analytics or advertising, we do not embed tracking tools and we do not tell anyone what you look at.
We store: the session identifier (keeps your basket and login), the chosen currency and language, the delivery country used to calculate VAT and the price, and the list of recently viewed products.
Necessary files do not require consent, which is why the shop does not ask for it. You can block them in your browser settings, but the basket and login will then stop working.

We may change this policy when the law, the scope of our services or the list of entities we entrust data to changes.
We publish the new text in the shop. A change does not limit rights you acquired under an earlier version.
This policy applies from the day it is published in the shop.