Effective from 2 July 2026
§1. Personal Data Controller
The controller of your personal data is Onlineshoehaven Patrycja Dębowska, ul. Kornela Morawieckiego 3, 32-566 Źródła, Polska, NIP: 6282293268, REGON: 526690612, e-mail: info@ribeirastore.com.
§2. Purposes, scope, and legal basis for data processing
Personal data is processed for the following purposes:
- fulfilling orders and providing electronic services, including account creation and maintenance, accepting and processing orders, payment handling, product shipment, handling complaints, returns, and exchanges,
- carrying out marketing activities, including sending newsletters and personalising offers – subject to consent,
- preparing statistics and analysing traffic on the website,
- fulfilling obligations arising from legal provisions, in particular accounting and tax obligations,
- contact with the customer and handling contact forms,
- collecting product reviews and publishing comments,
- conducting remarketing activities and profiling users for advertising purposes – subject to consent.
The legal basis for data processing is:
- the necessity to conclude and perform a contract or provide electronic services (Article 6(1)(b) GDPR),
- the fulfilment of the controller’s legal obligations (Article 6(1)(c) GDPR),
- the legitimate interest of the controller (Article 6(1)(f) GDPR), including preparing statistics, customer contact, direct marketing, pursuing claims, and defending against claims,
- the user’s consent (Article 6(1)(a) GDPR), e.g. for newsletters, marketing activities, cookies, or the publication of reviews or comments.
§3. Scope of processed data
The controller processes the following personal data of users:
- first name, last name, residential or delivery address, e-mail address, phone number,
- invoice details, including company name, NIP, and address,
- information about orders, payments, and returns,
- bank account number in the event of a refund,
- data related to the use of the website, such as IP address, cookies, and device identifiers,
- the content of reviews and comments,
- age – in the case of underage users.
§4. Data recipients
Personal data may be disclosed to the following categories of recipients:
- the courier company DHL – to the extent necessary to complete delivery,
- the payment operator the Seller’s bank,
- the controller’s accounting office,
- IT service providers, including hosting, technical support, and website maintenance,
- providers of analytical and advertising services, in particular Google Ireland Ltd. and Meta Platforms Ireland Ltd.,
- state authorities authorised under the law.
Data may be transferred outside the European Economic Area only in connection with the use of Google and Meta/Facebook tools, in accordance with applicable GDPR provisions, for example on the basis of EU standard contractual clauses.
§5. Data retention period
Personal data is retained for the period necessary to achieve the purposes for which it was collected, namely:
- for the purpose of performing the contract – for the duration of the contract and until the expiry of the limitation period for claims,
- in the case of a customer account – until the account is deleted,
- for marketing purposes – until consent is withdrawn,
- for accounting and tax purposes – for the period specified by law,
- in the case of reviews and comments – for the duration of publication or until a deletion request is submitted.
§6. Rights of data subjects
You have the right to:
- access your data,
- rectify your data,
- erase your data,
- restrict processing,
- transfer your data to another controller,
- object to processing,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (UODO).
To exercise your rights, contact the controller at: info@ribeirastore.com.
§7. Voluntary provision of data and consequences of not providing it
Providing personal data is voluntary, but necessary to complete an order, create an account, or receive the newsletter. Failure to provide data may make it impossible to use certain store functionalities.
§8. Automated processing and profiling
In the ribeirastore.com store, automated decision-making, including user profiling, may occur, for example for the purpose of ad personalisation or remarketing – solely on the basis of consent given for marketing or analytical cookies or other marketing activities.
Profiling does not produce legal effects concerning the user and does not significantly affect their situation.
The user has the right to object to profiling or withdraw consent at any time.