FIDEI.PL PRIVACY POLICY
Effective date: 20 October 2026
§ 1. Controller and contact details
1. The personal data controllers operating https://fidei.pl are the partners of Wydawnictwo FIDEI s.c. Krystyna Kamińska, Wanda Zagórska, ul. Truskawiecka 5, 02-929 Warsaw, Poland, NIP 521-34-99-405, REGON 141561999 (the “Controller”).
2. For data protection queries contact wydawnictwo@fidei.pl or write to the above address. Details of a data protection officer will be provided separately if one is appointed.
§ 2. Data and sources
1. Depending on the service, the Controller processes names, shipping and billing addresses, email addresses, telephone numbers where necessary, invoice details and tax identification numbers, correspondence, order, complaint and withdrawal details and payment status or transaction identifiers (generally not full card numbers).
2. Technical data may include IP addresses, browser and device data, server request times, logs and cookie identifiers, depending on actual configuration and user choices.
3. Availability alerts involve an email address and an item identifier; contact forms involve information and messages submitted by the user.
4. Most data comes directly from individuals. Payment and delivery status may be received from payment providers and carriers.
§ 3. Purposes, lawful bases and retention
1. Order handling, payment, shipping and contractual communication: GDPR Article 6(1)(b), for performance and thereafter for the time needed for lawful claims.
2. Tax, accounting, invoicing (including KSeF where applicable) and mandatory consumer obligations: Article 6(1)(c), for legally prescribed periods.
3. Handling complaints, withdrawals and disputes; establishing, exercising and defending legal claims: Article 6(1)(c) or (f) depending on the specific activity, for the case duration and applicable limitation periods.
4. Pre-contractual enquiries: Article 6(1)(b), and other enquiries: Article 6(1)(f), for the period needed to respond and document the exchange where justified.
5. One-off alerts about book availability: Article 6(1)(b) as performance of a service requested by the user; information is erased after sending, cancellation or discontinuation of the item, unless limited retention is justified by claims.
6. Site security, abuse prevention and technical logs: legitimate interests, Article 6(1)(f), for a period objectively justified by security needs and any incident.
7. Optional analytics, advertising and other non-essential cookies and related processing, where based on consent: Article 6(1)(a), until consent is withdrawn or the stated storage period ends. Device-storage consent is also regulated by Article 399 of Poland's Electronic Communications Law.
8. An email address provided solely for an availability alert is not automatically used for newsletters or direct advertising.
§ 4. Data recipients
1. Necessary recipients may include Store hosting and IT providers, an external email server provider, accountants and advisers, carriers (Poczta Polska, Pocztex, domestic couriers and foreign postal operators), payment providers (PayPro S.A./Przelewy24 and PayPal), banks and legally authorised bodies including tax authorities and KSeF.
2. Payment providers and carriers may act as independent controllers for their own legal purposes; their privacy notices govern those activities.
3. Google reCAPTCHA may be used to detect automated abuse. Depending on setup, Google may receive IP addresses, device identifiers and interaction information. Google's current terms and privacy notice apply. The Store must configure the service consistently with consent and privacy requirements.
4. The Controller uses processing agreements where vendors process personal data on its behalf.
§ 5. Transfers outside the EEA
1. Google reCAPTCHA, PayPal, email or IT infrastructure may involve data transfers outside the European Economic Area, including to the United States, depending on actual vendor arrangements.
2. International transfers occur only under GDPR Chapter V mechanisms, such as an applicable adequacy decision or appropriate safeguards including standard contractual clauses and supplementary measures where required.
3. Information about the safeguards applying to a particular transfer is available on request from the Controller.
§ 6. Individual rights
1. Subject to GDPR conditions and exemptions, individuals may request access, rectification, erasure, restriction and portability of data and object to processing based on Article 6(1)(f).
2. Consent may be withdrawn at any time without affecting the lawfulness of earlier processing.
3. Requests may be directed to the Controller. Complaints may be lodged with Poland's President of the Personal Data Protection Office (https://uodo.gov.pl).
4. Information needed for an order and statutory documentation is required to provide those services; other information is voluntary, though refusal may prevent a feature such as an availability notification.
5. The Controller does not make decisions about users producing legal or comparably significant effects solely by automated processing within GDPR Article 22. Automated anti-spam screening does not necessarily constitute such decision-making.
§ 7. Cookies and security
1. The separate Cookie Policy describes cookie categories, purposes, retention and consent controls.
2. Appropriate technical and organisational measures are used, including access controls and encryption in transit where suitable.
3. Material policy changes will be published in the Store and will not restrict rights under the GDPR.