Privacy policy

Thank you for the trust you have placed in us. Protecting your personal data and acting in compliance with the applicable privacy protection laws is our priority. Below, we provide information concerning the processing of data in connection with the use of our websites and services.

1. General information

This Privacy Policy sets out the principles governing the processing and protection of personal data provided in connection with the use of services offered through our websites. These principles are based in particular on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Act of 12 July 2024 — Electronic Communications Law (Journal of Laws of 2024, item 1221, as amended), in particular with regard to marketing communications and cookies.

2. Controller, details and contact information

The controller of your personal data is “TERRAVITA” spółka z ograniczoną odpowiedzialnością, with its registered office in Poznań at ul. Szarych Szeregów 48, 60-462 Poznań, entered in the National Court Register by the District Court Poznań — Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number 0000028540, NIP 781-00-09-491, REGON 630013822, BDO registration number: 000019181, with a share capital of PLN 62,589,000.00 (hereinafter: the “Controller”).

The Controller may be contacted:

• by post: ul. Szarych Szeregów 48, 60-462 Poznań;
• by email: office@terravita.pl.

3. Data Protection Officer, details and contact information

The Controller has appointed a Data Protection Officer whom you may contact in all matters concerning the processing of personal data and the exercise of rights granted under data protection laws.

• by post: ul. Szarych Szeregów 48, 60-462 Poznań;
• by email: iod@terravita.pl.

4. Scope of data collected and how it is used

1. We process personal data received from you in connection with transactions, contacts with us, the conclusion and performance of contracts, steps taken prior to entering into a contract, correspondence, participation in competitions or lotteries, purchases from the online store, requests for information, and subscription to the Newsletter.

2. The scope of the data may include, in particular: first name and surname, residential or correspondence address, telephone number, email address, data relating to an order and payment, and other data voluntarily provided in forms. Mandatory data is identified separately from optional data.

3. If you make payments for products through a bank or payment institution, we may process data concerning the account from which the payment was made and the account designated for any potential refund.

4. Data provided in connection with participation in a competition is used for purposes related to its organisation in accordance with the rules set out in the relevant competition terms and conditions.

5. Data provided through the contact form is used to handle and respond to the enquiry.

6. Where you subscribe to the Newsletter, the Controller processes at least your email address and data relating to registration, subscription confirmation, the sending of messages, and unsubscribing. Subscription via the website is integrated with the GetResponse system. Subscribers’ data is transferred to and stored in that system for the purpose of maintaining the mailing list, handling subscriptions and unsubscriptions, sending the Newsletter, and documenting the subscription process.

7. Where you register or place an order in the online store, the data is used to create a Customer Account, handle and fulfil orders, and comply with the related legal obligations.

8. When you use the websites, the server may automatically record technical data such as the IP address, date and time of connection, information about the device and browser, the requested resource, and the internet service provider.

9. Technical data contained in server logs may constitute personal data. We process it to the extent necessary to ensure the security, stability, and proper operation of the websites and to diagnose errors, on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR).

10. Depending on the functionalities used and the consents obtained, we may process data concerning activity on the websites, in the online store, and on social media channels, including information about products viewed, the device, cookies, and interactions. This data may be used for analysis, statistics, customer service, and — where an appropriate legal basis exists — marketing and personalisation activities.

5. Principles governing the processing of personal data

1. As a rule, the provision of personal data is voluntary. In certain circumstances, it may be a condition for entering into or performing a contract, complying with a legal obligation, or using a particular functionality, such as receiving the Newsletter.

2. Failure to provide required data may prevent, among other things, making a purchase, creating an account, issuing an invoice, handling a complaint, processing a withdrawal from a contract, or delivering the Newsletter.

3. The scope of the data required for a specific activity is indicated in the relevant form or document.

4. We may also request optional data, such as a telephone number for the purpose of arranging delivery details, provided that supplying it is not necessary for the provision of the core service.

6. Purpose, legal basis and duration of personal data processing

Your personal data may be processed, in particular, for the following purposes and on the following legal bases:

• taking steps at your request prior to entering into a contract — Article 6(1)(b) GDPR — for the time necessary to take those steps;
• entering into and performing a contract — Article 6(1)(b) GDPR — for the time necessary to perform the contract and complete the related settlements;
• compliance with legal obligations, including tax, accounting, consumer protection, and accountability obligations — Article 6(1)(c) GDPR — for the period resulting from the applicable laws;
• the establishment, pursuit, or defence of claims, system security, internal analysis and statistics, and customer service support — Article 6(1)(f) GDPR — for the period necessary to pursue the relevant interest, no longer than until that interest ceases to exist or an effective objection is made, where applicable;

Newsletter and marketing communications:

• provision of the Newsletter service following subscription — Article 6(1)(b) GDPR, if subscription results in the conclusion of an agreement for the provision of the Newsletter service, or Article 6(1)(a) GDPR to the extent that the processing is based on consent — until you unsubscribe from the Newsletter or withdraw your consent;
• the sending of commercial information, including direct marketing, to an email address takes place after obtaining the prior consent required under Article 398 of the Electronic Communications Law; consent may be withdrawn at any time;
• documenting the consent given, its scope, the manner and date on which it was obtained, and defence against claims — Article 6(1)(f) GDPR — for the period necessary to demonstrate compliance with the law and until the expiry of the applicable limitation periods for claims.

Where data is processed on the basis of consent, it may be processed until that consent is withdrawn. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

In the case of marketing based on the Controller’s legitimate interests, data is processed until an effective objection is made or until the purpose of the processing ceases to exist, whichever occurs first. The previously used wording “for the duration of the contract” should not be applied as a universal retention period for marketing purposes.

7. Data recipients, processors and data transfers

Data may be disclosed to persons authorised by the Controller and to entities supporting the Controller, to the extent necessary to provide services and fulfil the stated purposes, in particular to IT and hosting service providers, entities handling the online store and payments, courier companies, advisers, auditors, entities carrying out marketing activities, and other recipients where an obligation or right to disclose data arises from the law.

In connection with the operation of the Newsletter, the Controller uses the services of GetResponse S.A., with its registered office in Gdańsk at ul. Grunwaldzka 413, 80-309 Gdańsk. With respect to subscribers’ data, GetResponse acts as a processor of personal data on behalf of the Controller, under a data processing agreement compliant with Article 28 GDPR. GetResponse provides tools used, among other things, to collect and store subscribers’ data, manage the mailing list, handle subscriptions and unsubscriptions, and send the Newsletter.

GetResponse may use further processors (sub-processors) to the extent necessary to provide its service. Up-to-date information on the entities engaged by GetResponse and the applicable processing rules is set out in GetResponse’s documentation and data processing agreement.

In connection with the use of IT, analytics, or advertising service providers, or further processors, data may in certain cases be transferred outside the European Economic Area. Where such a transfer takes place, the Controller ensures that a mechanism provided for in Chapter V of the GDPR is applied, in particular a European Commission adequacy decision or standard contractual clauses together with supplementary safeguards, where required. Information about the mechanism applied may be obtained by contacting the Controller or the Data Protection Officer.

8. Rights of data subjects

To the extent provided for under the GDPR, you have the right to:

• access your data (Article 15 GDPR);
• rectify your data (Article 16 GDPR);
• erase your data (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR);
• withdraw consent at any time where processing is based on consent.

Requests concerning these rights may be sent to iod@terravita.pl. If you believe that the processing of data infringes the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office.

In the case of the Newsletter, you may unsubscribe at any time by using the unsubscribe link (“wypisz się” / “unsubscribe”) included in a message sent through GetResponse, or by contacting the Controller. Unsubscribing from the Newsletter results in the discontinuation of further messages to the specified address, without prejudice to data whose continued storage is necessary to demonstrate compliance with the law or to defend against claims.

9. Cookies

1. Cookies and similar technologies may be used on our websites (in particular terravita.pl, terravitapro.pl, and sklep.terravita.pl).

2. Cookies are small pieces of information stored on a user’s terminal device and read during subsequent visits. They may be used, among other things, to ensure the operation of the website, remember settings, conduct analytics, measure effectiveness, and — after obtaining the appropriate consent — for advertising and remarketing purposes.

3. Cookies and similar technologies that are not necessary for the transmission of a communication or the provision of a service requested by the user are stored or accessed after obtaining prior consent in accordance with Article 399 of the Electronic Communications Law. The user should be able to reject such cookies as easily as accepting them and to change their choice subsequently.

4. Information associated with cookies may include, among other things, the IP address, browser and device type, operating system, date and time of the visit, online identifiers, and information about activity on the website.

5. Depending on the tools actually implemented, we may use analytics or advertising services provided by suppliers such as Google or Meta. The scope of the tools identified in the Policy should correspond to the tools actually operating on the websites and the settings of the consent management platform (CMP).

6. Cookie categories may include: strictly necessary, functional, analytics/performance, and marketing. Cookies other than strictly necessary cookies should be activated in accordance with the user’s choice made through the consent management mechanism.

7. The user may change cookie settings using the mechanism available on the website and, additionally, through the browser settings. Restricting strictly necessary cookies may affect the operation of certain website functions.

10. Data security

The Controller applies appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, such data. Access to the data is restricted to authorised persons and entities acting under appropriate agreements and instructions.

11. Amendments to the Privacy Policy

The Controller may update this Policy, in particular in the event of changes to the law, processing methods, technologies used, service providers, or website functionalities. The current version of the Policy will be published on the Controller’s website.

In the event of changes material to data subjects, the Controller may additionally inform them of such changes in an appropriate manner commensurate with the nature of the change.