Customer information
Privacy policy
Updated: 21 September 2026
This English version is provided for information only. The Polish version is legally binding.
We respect your privacy. Below we explain what data we process, why, on what legal basis and for how long, who we share it with and what rights you have.
Contents
1. Data controller
The controller of your personal data is Skybiotic spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Bielsko-Biała, ul. Zacisze 5, 43-300 Bielsko-Biała, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Bielsko-Biała, 8th Commercial Division of the National Court Register, under KRS number 0001107302, Tax ID (NIP) 5273113697, REGON 528716445, share capital PLN 5,000.00 (hereinafter: “we”).
For all matters relating to personal data, write to kontakt@skybiotic.com, call +48 513 035 630 or write to: ul. Zacisze 5, 43-300 Bielsko-Biała, Poland. We have not appointed a data protection officer.
2. Purposes, legal bases and retention periods
| Purpose | Legal basis | How long |
|---|---|---|
| Placing and fulfilling an order: contact about the order, payment, shipping, handling withdrawals from the contract | Art. 6(1)(b) GDPR (contract) | until the contract has been performed, and then for the limitation period for claims |
| Issuing invoices, accounting and tax settlements (including via the National e-Invoicing System, KSeF) | Art. 6(1)(c) GDPR (legal obligation – tax and accounting laws) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Handling complaints | Art. 6(1)(b) and (c) GDPR (contract, obligations under the Consumer Rights Act) | until the complaint has been handled, and then for the limitation period for claims |
| Replying to messages sent via the form, emails and phone calls, including partnership enquiries | Art. 6(1)(f) GDPR (our legitimate interest – replying and conducting correspondence); where the enquiry concerns concluding a contract – Art. 6(1)(b) GDPR | until the matter is closed, and then for no longer than 3 years |
| Maintaining a shop Account (if one has been created) | Art. 6(1)(b) GDPR (Account agreement) | until the Account is deleted |
| Establishing, pursuing and defending claims | Art. 6(1)(f) GDPR (our legitimate interest) | until the limitation periods for claims expire |
| Visit statistics and shop security (e.g. preventing abuse) | Art. 6(1)(f) GDPR (our legitimate interest) | up to 12 months |
| Commercial information by email (e.g. newsletter) – only if you give your consent | Art. 6(1)(a) GDPR (consent) and the consent required by the Polish Electronic Communications Law | until consent is withdrawn |
3. What data we process
- Order: full name, email address, phone number, delivery address, selected pick-up point, order notes, order history.
- Company invoice: company name, Tax ID (NIP) and company address.
- Payment: transaction status and ID. We do not receive payment card details – they are processed by the payment operator.
- Contact: the data provided in the message (e.g. name, email, phone, salon name) and the content of the correspondence.
- Use of the shop: IP address, browser and device information, pages visited, data stored in cookies.
Providing data is voluntary, but without the data needed for an order we cannot fulfil it. You provide invoice data because tax laws require it.
4. Who we share data with
We share data only when necessary for the purposes described above:
- Odoo S.A. (Belgium) – provider of the software and hosting for the shop and of the order and invoicing system;
- Microsoft Ireland Operations Ltd. – our email provider;
- Stripe Payments Europe, Limited (Ireland) – online payment operator; to the extent required by payment services and fraud prevention laws, it acts as a separate data controller;
- carriers and pick-up point operators – depending on the delivery method chosen: InPost, DPD or DHL (including points in Żabka stores), as well as a shipping intermediary, if we use one;
- the accounting firm that keeps our books;
- the National e-Invoicing System (KSeF) (Ministry of Finance) – for invoices;
- legal advisers and public authorities – where required by law.
Service providers who process data on our behalf do so under data processing agreements and only in accordance with our instructions.
5. Transfers of data outside the European Economic Area
Some providers (e.g. Stripe, Microsoft) may also process data outside the EEA, including in the United States. This is based on a European Commission adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to us.
6. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify your data,
- have your data erased,
- restrict processing,
- data portability – where we process data on the basis of a contract or consent,
- object to processing based on our legitimate interest – at any time where we process data for marketing purposes,
- withdraw your consent at any time – without affecting the lawfulness of processing before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
To exercise your rights, write to kontakt@skybiotic.com. We will reply without undue delay, as a rule within one month.
7. Automated decision-making
We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. The payment operator may automatically screen transactions for fraud – under the rules described in its privacy policy.
8. Security
The shop uses an encrypted connection (HTTPS). Only authorised persons have access to the data. We apply technical and organisational measures appropriate to the risk.
9. Cookies
The shop uses cookies necessary for it to work (e.g. cart, session, language choice) and, with your consent, optional cookies as well. Details, the list of cookies and how to change your settings: Cookie policy.
10. Changes to this policy
We may update this policy, e.g. when laws or our services change. The current version is always available on this page. Version of 21 September 2026.