Effective from 2 July 2026
§1. General Information
The controller of the personal data of users of the ribeirastore.com online store is Onlineshoehaven Patrycja Dębowska, ul. Kornela Morawieckiego 3, 32-566 Źródła, Polska, NIP: 6282293268, REGON: 526690612, e-mail: info@ribeirastore.com.
This privacy policy sets out the rules for processing personal data in connection with the use of the ribeirastore.com online store, including account registration, order fulfilment, complaint handling, returns, customer contact, and marketing activities.
The controller exercises particular care to ensure that data is processed lawfully, collected for specified purposes, stored no longer than necessary, and protected against unauthorised access.
The store uses an SSL certificate and regularly updates its software to protect data.
§2. Scope and Purposes of Personal Data Processing
Personal data is processed for the following purposes:
- creation and maintenance of a customer account,
- accepting and fulfilling orders, payment handling, shipment of goods,
- handling complaints, returns, and exchanges,
- contact with customers (including responses to enquiries),
- sending marketing information and newsletters (with consent),
- fulfilling accounting and tax obligations,
- personalisation of content and advertisements based on profiling (remarketing, automatic offer adjustment),
- publication of reviews and product comments,
- statistics and analysis of store usage (Google Analytics, Google Ads, Facebook Pixel).
The legal basis for processing data is:
- sales contract or provision of electronic services (Article 6(1)(b) GDPR),
- legal obligation (accounting, taxes – Article 6(1)(c) GDPR),
- legitimate interest of the controller (e.g. marketing, statistics – Article 6(1)(f) GDPR),
- consent of the data subject (newsletter, marketing activities, cookies – Article 6(1)(a) GDPR).
Providing data is voluntary, but necessary to create an account, complete an order, or use selected store functions.
User data may be processed automatically for profiling, offer personalisation, and remarketing purposes – solely on the basis of consent given in the Cookiebot panel.
§3. Categories of Processed Data
The controller processes the following categories of data:
- First and last name, residential/delivery address, phone number, e-mail address,
- Invoice details (NIP, company name, address),
- Order details, payment information, purchase history,
- Bank account number (in the event of refunds),
- Data related to the use of the service (IP address, cookies, device identifiers),
- Reviews and comments content,
- Age – in the event of use of the store by a minor (recommended under adult supervision).
§4. Data Recipients
Personal data may be disclosed to the following categories of recipients:
- courier company DHL (shipment handling),
- payment operator the Seller’s bank,
- accounting office serving Onlineshoehaven Patrycja Dębowska,
- IT service providers (hosting),
- analytical and advertising services: Google Ireland Ltd., Meta Platforms Ireland Ltd. (Facebook), in accordance with rules regarding transfers outside the EEA,
- state authorities – on the basis of legal provisions.
These entities operate on the basis of data processing agreements and are obliged to apply appropriate safeguards.
User data is not transferred to other controllers for marketing purposes without explicit consent.
Transfers of data outside the EEA may occur only in connection with the use of Google and Meta (Facebook) tools, based on compliance mechanisms, e.g. EU standard contractual clauses.
§5. Data Retention Period
Personal data is retained for the following periods:
- in the case of contract performance – for the duration of the contract and until claims expire (at least 6 years),
- in the case of a customer account – until its deletion,
- data processed for marketing purposes and newsletters – until consent is withdrawn,
- accounting documentation – for the period required by law (minimum 5 years),
- data relating to reviews and comments – until publication or a request for deletion.
After the above periods, data is deleted or anonymised.
§6. User Rights
You have the following rights:
- access to your data,
- rectification, deletion, or restriction of processing,
- objection to processing,
- data portability to another controller,
- lodging a complaint with the President of the Personal Data Protection Office (UODO),
- withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise the above rights, contact the controller at: info@ribeirastore.com.
§7. Cookies and Analytics
The store uses the following analytics and marketing tools:
- Google Analytics, Google Ads – analytics and advertising,
- Facebook Pixel – ad personalisation and remarketing campaigns.
Detailed rules for the use of cookies and similar technologies are set out in the Cookie Policy.
§8. Data Security
The controller applies the following safeguards:
- transmission encryption (SSL),
- regular updates of the store system and software,
- staff training,
- application of data minimisation and access control principles,
- maintaining a register of breaches and procedures for reporting incidents to UODO.
The controller has not appointed a Data Protection Officer (DPO) – obligations are performed independently.
§9. Changes to the Privacy Policy
The Privacy Policy may be updated periodically. A new version of the document will be published on the store website, and users with an account will be informed electronically. Changes take effect from the publication date unless stated otherwise.
§10. Contact
Any questions and requests regarding the privacy policy and personal data processing should be sent to: info@ribeirastore.com.