Privacy policy
This is a translation for your convenience. The legally binding version is the Polish one.
TABLE OF CONTENTS:
- Data controller
- Where the data comes from
- Purposes, legal bases and retention periods
- Data recipients
- Transfers of data outside the European Economic Area
- Profiling and automated decisions
- Rights of data subjects
- Cookies and similar technologies
- Kickomi social media profiles
- Data security
- Final provisions
1. DATA CONTROLLER
1.1. This Privacy Policy contains the information referred to in Articles 13 and 14 of the GDPR concerning the processing of personal data in connection with the use of the Online Store available at www.kickomi.com, the fulfilment of Orders and contact with the Controller. Capitalised terms (e.g. Online Store, Order, Account, Newsletter) have the meanings given to them in the Terms and Conditions of the Online Store.
1.2. The controller of personal data is Katarzyna Lizurej, conducting business activity under the business name Katarzyna Lizurej, entered in the Central Register and Information on Economic Activity (CEIDG), business address and address for service: ul. Stanisławowska 47, 54-611 Wrocław, NIP 8993009475, REGON 540210848 (the “Controller”).
1.3. In all matters concerning personal data, the Controller can be contacted by e-mail at contact@kickomi.com, by phone at +48 736 288 068 or in writing at the address given in point 1.2. The Controller has not appointed a data protection officer.
1.4. Wherever this Privacy Policy refers to the “GDPR”, it means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and “PKE” means the Polish Electronic Communications Law of 12 July 2024 (ustawa – Prawo komunikacji elektronicznej).
2. WHERE THE DATA COMES FROM
2.1. The Controller primarily processes data provided directly by the data subject – in the Order Form, when creating an Account, signing up for the Newsletter or in messages sent to the Controller.
2.2. When the Online Store is used, technical data is also collected automatically, such as the IP address, device and browser type, approximate location and information stored in cookies (details in point 8).
2.3. In addition, the Controller receives information on payment status from payment operators and information on parcel delivery status from carriers.
2.4. Where a Product is purchased through a sales platform (Allegro, Empik, TikTok Shop), the Controller receives from the platform operator the data necessary to fulfil the order, i.e. first and last name, delivery address, e-mail address or phone number and – if the Customer requests it – invoice details. The Controller processes this data for the purposes set out in points 3.2.1, 3.2.3, 3.2.4 and 3.2.8. The platform operator is a separate data controller, and its processing of data is governed by its own privacy policy.
3. PURPOSES, LEGAL BASES AND RETENTION PERIODS
3.1. Providing personal data is voluntary, but to the extent indicated in the Order Form it is a condition for concluding and performing the Sales Agreement (contractual requirement), and as regards invoice details – a condition for the Controller to fulfil its obligations under tax law (statutory requirement). Failure to provide this data makes it impossible to conclude the agreement. Providing data for marketing purposes is entirely up to the data subject.
3.2. The Controller processes personal data for the following purposes:
3.2.1. Concluding and performing the Sales Agreement (accepting and fulfilling the Order, handling payment, delivering the Product, sending messages about the Order) – legal basis: Article 6(1)(b) GDPR. Scope: first and last name, e-mail address, phone number, delivery address and billing address, and for Customers who are entrepreneurs also the company name and NIP (tax identification number). Period: until the agreement has been performed, and thereafter for the periods set out in points 3.2.3, 3.2.4 and 3.2.8.
3.2.2. Maintaining the Account – legal basis: Article 6(1)(b) GDPR. Period: until the Account is deleted.
3.2.3. Handling complaints and withdrawals from the agreement – legal basis: Article 6(1)(c) GDPR in conjunction with the provisions of the Polish Consumer Rights Act (ustawa o prawach konsumenta) and the Polish Civil Code (Kodeks cywilny). Period: until the matter is closed, and thereafter for the period of the Seller’s liability for the Product’s lack of conformity with the agreement.
3.2.4. Fulfilling tax and accounting obligations (issuing and storing invoices and proofs of sale, keeping records) – legal basis: Article 6(1)(c) GDPR in conjunction with the provisions of the Polish Act on Value Added Tax (ustawa o podatku od towarów i usług) and the Polish Tax Ordinance (ustawa – Ordynacja podatkowa). Period: 5 years from the end of the calendar year in which the tax payment deadline expired.
3.2.5. Responding to messages and enquiries (e-mail, phone, contact form, social media messages) – legal basis: Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in communicating with people who contact it, and where the message concerns a concluded or planned agreement – Article 6(1)(b) GDPR. Period: until the matter is closed, and where the correspondence may be needed for the purpose set out in point 3.2.8 – until the limitation periods for claims expire.
3.2.6. Newsletter and other commercial information sent electronically (e-mail, SMS), including abandoned cart reminders and Product suggestions – legal basis: consent, i.e. Article 6(1)(a) GDPR and Article 398 PKE. Scope: e-mail address or phone number, first name (if provided) and information on activity in the Online Store and purchase history, if the messages are personalised. Period: until consent is withdrawn or the person unsubscribes. After unsubscription, the Controller may keep the e-mail address on a suppression list so as not to send messages to it again, as well as information that consent was given as proof of having obtained it – on the basis of Article 6(1)(f) GDPR, no longer than until the limitation periods for claims expire.
3.2.7. Analytics, ad performance measurement and remarketing using cookies and similar technologies – legal basis: consent, i.e. Article 6(1)(a) GDPR and Article 399 PKE. Period: until consent is withdrawn or the cookie in question expires (point 8).
3.2.8. Establishing, pursuing or defending claims – legal basis: Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in protecting its rights. Period: until the limitation periods for claims set out in the Polish Civil Code expire (in particular 2 years for claims arising from sales made in the course of the seller’s business and 3 years for other claims related to conducting business activity, with the limitation period ending on the last day of the calendar year).
3.2.9. Ensuring the security of the Online Store and preventing abuse (e.g. payment fraud attempts), as well as keeping statistics necessary for the proper functioning of the Online Store – legal basis: Article 6(1)(f) GDPR. Period: for as long as necessary to achieve this purpose.
3.3. Once the periods indicated above have expired, the data is deleted or anonymised.
3.4. Consent to the processing of data for marketing purposes may be given independently by a person who is at least 16 years old. For a younger person, consent is given or approved by their parent or legal guardian.
4. DATA RECIPIENTS
4.1. The Controller discloses personal data only when this is necessary to achieve a given purpose, and only to the extent necessary. For example, the data of a Customer who pays with BLIK is not passed to the PayPal operator, and the data of a person who has not consented to marketing cookies is not passed to advertising providers.
4.2. Personal data may be disclosed to the following recipients or categories of recipients:
4.2.1. the online store platform provider – Shopify International Limited (Ireland), which provides hosting and operation of the Online Store, the Account and the Order Form, sending of e-mails (including the Newsletter) and basic store analytics;
4.2.2. the provider of order and shipping management software – BaseLinker (Base), including the Base Courier service used to book shipments;
4.2.3. carriers and postal operators, in particular InPost, DPD, ORLEN Paczka and UPS – to the extent necessary to deliver the parcel (first and last name, delivery address or selected pick-up point, phone number, e-mail address for notifications);
4.2.4. payment operators – Shopify Payments (operated by Stripe Payments Europe Limited) and, depending on the payment method chosen, PayPal and Klarna. PayPal and Klarna also process data as separate controllers under their own terms and privacy policies;
4.2.5. analytics and advertising service providers – Google Ireland Limited (Google Analytics, Google Ads), Meta Platforms Ireland Limited (Instagram, Facebook) and TikTok Technology Limited – only if consent has been given to the relevant cookies (point 8);
4.2.6. providers of e-mail, data storage and other IT tools that the Controller uses in running the business;
4.2.7. entities providing accounting, legal or advisory services to the Controller;
4.2.8. public authorities and other entities authorised by law – only where the obligation to disclose data arises from legal provisions.
4.3. Persons authorised by the Controller also have access to the data, in particular those helping with packing and shipping Orders, who are bound by confidentiality.
4.4. Entities processing data on behalf of the Controller do so on the basis of a data processing agreement (Article 28 GDPR) and only in accordance with the Controller’s instructions.
5. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
5.1. Some of the providers listed in point 4 (in particular Shopify, Google, Meta, TikTok and PayPal) may transfer personal data to countries outside the European Economic Area, including Canada and the United States.
5.2. Such transfers take place on the basis of a European Commission decision finding an adequate level of data protection (this applies, among others, to Canada and to US entities certified under the EU-US Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).
5.3. The data subject may obtain from the Controller information about the safeguards applied and a copy of them by making contact as set out in point 1.3.
6. PROFILING AND AUTOMATED DECISIONS
6.1. The Controller does not make decisions concerning data subjects based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them (Article 22 GDPR).
6.2. With the consent of the data subject (points 3.2.6 and 3.2.7), the Controller may profile them for marketing purposes, i.e. tailor the content of messages, send reminders about unfinished purchases or display tailored advertisements based on the Products viewed, the contents of the cart and purchase history. Such profiling does not affect the ability to conclude an agreement or the terms of purchase.
6.3. Orders may be automatically analysed by the Shopify system for the risk of payment fraud. The final decision on any cancellation of an Order is made by the Controller.
7. RIGHTS OF DATA SUBJECTS
7.1. The data subject has the right to:
7.1.1. access their data and obtain a copy of it (Article 15 GDPR);
7.1.2. rectification of data (Article 16 GDPR);
7.1.3. erasure of data, the so-called “right to be forgotten” (Article 17 GDPR);
7.1.4. restriction of processing (Article 18 GDPR);
7.1.5. portability of data processed on the basis of an agreement or consent (Article 20 GDPR);
7.1.6. object to processing based on the Controller’s legitimate interest – on grounds relating to their particular situation (Article 21(1) GDPR), and to processing for direct marketing purposes, including profiling – at any time and without giving reasons (Article 21(2) GDPR);
7.1.7. withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. You can unsubscribe from the Newsletter using the link in every message, and cookie consents can be changed as described in point 8.4;
7.1.8. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa) if they consider that the processing of their data infringes the GDPR. A person living in another European Union member state may also lodge a complaint with the supervisory authority in that state.
7.2. To exercise the above rights, simply contact the Controller as set out in point 1.3. The Controller responds without undue delay and in any event within one month of receiving the request. In justified cases (e.g. a large number of requests), this period may be extended by a further two months, and the Controller will inform you of this. If the Controller has doubts about the identity of the person making the request, it may ask for additional information to confirm it. Exercising these rights is free of charge.
8. COOKIES AND SIMILAR TECHNOLOGIES
8.1. Cookies are small text files stored on the device of a person visiting the Online Store (computer, phone, tablet). So-called pixels and other tracking scripts work in a similar way. The Online Store uses its own cookies and cookies of the providers listed in point 4.
8.2. The following types of cookies are used in the Online Store:
8.2.1. strictly necessary – they enable the Online Store to function, including the cart, the Order Form and logging in to the Account, remembering the selected language and currency, protection against abuse and remembering consent choices. They do not require consent, and blocking them in the browser may make it impossible to place an Order;
8.2.2. analytics – they show how visitors use the Online Store (e.g. which pages they visit and where they come to the store from), which helps improve it. They may be set by Shopify and Google (Google Analytics). They are used only with consent;
8.2.3. marketing – they are used to display tailored advertisements (also on other websites) and to measure their effectiveness. They may be set by Google (Google Ads), Meta (Instagram, Facebook) and TikTok. They are used only with consent.
8.3. On the first visit to the Online Store, a banner is displayed in which you can accept all cookies, reject those that are not strictly necessary, or choose individual categories. Refusing consent does not affect the ability to shop.
8.4. Consent can be changed or withdrawn at any time using the link to privacy or cookie settings in the footer of the Online Store, and also by deleting cookies in the web browser settings (instructions are available in the help section of the browser). Data transfer to Google Analytics can additionally be blocked with a browser add-on provided by Google: https://tools.google.com/dlpage/gaoptout?hl=pl.
8.5. Session cookies are deleted when the browser is closed. Persistent cookies are stored for the time specified in their parameters – depending on the cookie, from a few minutes to 2 years – or until they are deleted by the user.
9. KICKOMI SOCIAL MEDIA PROFILES
9.1. The Controller runs Kickomi brand profiles on social media, in particular on Instagram and TikTok. If a person follows a profile, comments on or reacts to posts, sends a message or takes part in a live stream, the Controller processes the data visible on their profile and the content of the communication – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest in running the profile, communicating with the audience and promoting the brand. This data is processed for as long as the person is active on the profile or until an effective objection is raised.
9.2. The operators of the social networks (Meta Platforms Ireland Limited, TikTok Technology Limited) process users’ data as separate controllers in accordance with their own privacy policies, and with regard to profile statistics – jointly with the Controller.
10. DATA SECURITY
10.1. The Controller applies technical and organisational measures appropriate to the risk, in particular an encrypted connection (SSL/TLS) throughout the Online Store, restricting access to data to authorised persons and using only providers that offer sufficient guarantees of data protection.
10.2. Payment card data is not passed to or stored by the Controller – it is processed directly by the payment operator.
11. FINAL PROVISIONS
11.1. The Online Store may contain links to other websites. This Privacy Policy applies only to the Online Store – after moving to another website, it is worth reading the privacy policy that applies there.
11.2. This Privacy Policy may be updated, in particular in the event of changes in the law, in the way the Online Store operates or in the providers used by the Controller. The current version is always available on the Online Store website.
11.3. Translations of this Privacy Policy into other languages are for information purposes only; in the event of any discrepancy, the Polish version prevails.
This Privacy Policy is effective from 20 October 2026.