Privacy Policy
1. Data controller
The controller of your personal data is R&L sp. z o.o., registered office in Warsaw (ul. Marcina Kasprzaka 31/119, 01-234 Warszawa, Poland), entered in the Polish National Court Register under KRS 0001238807, NIP (tax ID) 5273217497, REGON 544629001 (“we”). Data protection contact: info@automatics.pro, phone +48 793 996 171, or by post to our registered office.
This policy covers the automatics.pro website, including the online shop, and contact with us. We apply Regulation (EU) 2016/679 (“GDPR”) and the Polish Personal Data Protection Act of 10 May 2018.
2. What data, why and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Operating and securing the website (server logs, protection against abuse and bots) | IP address, date and time, requested URL, response code, browser type | Art. 6(1)(f) GDPR — legitimate interest: security, abuse detection | up to 14 days (deleted automatically), unless needed to investigate an incident |
| Running the cart and the order form | cart contents, selected country of delivery, currency, net/gross price view, cart identifier (store_session) | Art. 6(1)(b) GDPR — steps at your request prior to a contract | cart — 30 days from the last change (store_session lifetime); settings — 365 days |
| Concluding and performing the sales contract (order, payment, delivery, order communication, individual delivery quote) | name, email, phone, delivery address or selected parcel locker, company details (name, NIP/EU VAT number, address), goods ordered, amounts, payment status | Art. 6(1)(b) GDPR | for the contract term and then until claims are time-barred |
| Customer account (if you use one) | email, order details, order history | Art. 6(1)(b) GDPR | until the account is deleted; order data — as in the row above |
| Checking the EU VAT number in VIES and determining the correct VAT rate | NIP/EU VAT number, company name and address, result and date of the check | Art. 6(1)(c) GDPR with Polish VAT law | 5 years from the end of the calendar year in which the tax payment deadline expired (as part of tax records) |
| Handling withdrawals and complaints | order data, content of the notice, photos, bank account for the refund | Art. 6(1)(c) GDPR (obligations under the Consumer Rights Act and the Civil Code); Art. 6(1)(b) GDPR | until claims are time-barred |
| Accounting and tax obligations (invoices, including KSeF) | data on invoices and accounting records | Art. 6(1)(c) GDPR with Polish tax and accounting law | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Replying to messages, quotation requests, designs or configurator lists you send | name, email, phone, company, message content and attachments | Art. 6(1)(b) GDPR — steps prior to a contract at your request; Art. 6(1)(f) GDPR — correspondence | up to 3 years after the correspondence ends |
| Establishing, pursuing or defending claims | data needed for the matter | Art. 6(1)(f) GDPR | until claims are time-barred |
| Analytics and marketing (only if we enable them in the future) | cookie identifiers, usage data | Art. 6(1)(a) GDPR — your consent | until consent is withdrawn |
Providing data is voluntary, but without the data marked as required in the order form we cannot conclude or perform the contract, and without contact details we cannot reply to an enquiry. We do not send marketing communications without your separate consent.
3. Orders and the CRM system
We handle orders, customer data, order correspondence, VIES check results and sales documents in our own CRM system. It runs on our server in an OVH data centre within the European Economic Area and is accessible only to authorised staff. Order notifications are sent by email from our own mail service.
4. VIES checks
If you buy as a company from another EU country, we check the EU VAT number you provide in VIES (VAT Information Exchange System), run by the European Commission together with the tax administrations of the Member States. We send the VAT number and country code; the response confirms whether the number is valid and sometimes includes the company name and address. We store the result and date of the check as evidence for tax purposes.
The result matters for applying the 0% rate (intra-Community supply) — only once the Seller is registered for EU VAT (intra-Community transactions); until then we charge Polish VAT. If your number is not confirmed but you believe it is valid, write to us — a member of staff will check it again.
5. InPost delivery and the parcel locker map
To deliver your order we pass to InPost sp. z o.o. (Kraków, Poland) the data needed to send and deliver the parcel: name, phone, email, delivery address or the code of the selected parcel locker. InPost processes this data as a separate controller under its own privacy policy (inpost.pl).
The parcel locker map (InPost Geowidget) loads only at the delivery step of the order form, after you choose delivery to a Paczkomat. Only then does your browser connect to InPost servers, which receive your IP address and technical browser information and — if you allow it in your browser — your approximate location to find nearby lockers. InPost scripts are not loaded on any other page of the website.
6. Configurator — your data stays in your browser
Projects created in the configurators are stored only in your browser (localStorage). They are not sent to our server and we cannot see them. We receive a list only when you send it yourself, e.g. with the “Send an enquiry” button. You can delete the data by removing the project or clearing site data in your browser.
7. Cookies and similar technologies
We use only necessary cookies and browser storage without which the website and shop cannot work. Under Article 399 of the Polish Electronic Communications Law of 12 July 2024 they do not require consent, but we inform you about them:
- store_session (cookie) — cart identifier; set when you first add a product to the cart, it remembers the cart contents and lets you complete the order (30 days);
- ap_country, ap_cur, ap_vat (cookies) — selected country of delivery, currency and net/gross price view; set only when you change that setting yourself (365 days);
- ap_consent (browser localStorage, not a cookie) — your choice in the consent banner (365 days);
- apro_cfg_current, apro_cfg_projects (browser localStorage) — configurator projects (until you delete them).
The shop sets no other cookies. Fonts are hosted on our own server. We currently use no analytics or marketing tools; if we enable them, they will run only with the consent you give in the banner. You can change or withdraw consent at any time via “Cookie settings” in the footer; withdrawal does not affect the lawfulness of earlier processing. The InPost parcel locker map described in section 5 loads only at the delivery step.
8. Recipients
We share data only with entities that help us run our business, under data processing agreements or as separate controllers:
- OVH SAS (France) — hosting of the website, shop, CRM system and email (processor);
- InPost sp. z o.o. — parcel delivery and the parcel locker map (separate controller);
- the bank that holds our account — data contained in the transfer (separate controller);
- the European Commission and EU tax administrations — for VIES checks;
- the Head of the Polish National Revenue Administration — invoices in the National e-Invoicing System (KSeF);
- our accounting office — bookkeeping;
- manufacturers and distributors of the goods — only where necessary to fulfil an order or complaint (e.g. order number, description of a defect), as a rule without the customer’s personal data;
- public authorities — where required by law.
We do not sell personal data and do not transfer it outside the European Economic Area. Should this become necessary, we will apply the safeguards of Chapter V GDPR (e.g. standard contractual clauses) and update this policy.
9. Your rights
You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. The right to erasure does not cover data we must keep by law (e.g. invoices). To exercise your rights, write to info@automatics.pro. We will reply without undue delay and within one month at the latest.
You may also lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the authority in your country of residence.
10. Automated decisions and security
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The automatic VIES check may affect the VAT rate; at your request a member of staff will review it (section 4). Configurator results are supporting calculations. We use encrypted connections (HTTPS/HSTS), restricted access to the server and the CRM system, and collect as little data as possible.
11. Changes
We update this policy when our processing changes (e.g. new payment or delivery methods, enabling analytics). The current version is always available on this page. See also the Shop Terms and Conditions and the Terms of Service.