effective from 25 May 2018

I. FORMALITIES

Thank you for visiting our privacy policy. Before we tell you what personal data we collect about you and for which purposes we process it, let’s turn our focus on some formalities.

This privacy policy is adapted to the standards of the GDPR. What is it? It’s the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR):

Who is the administrator of your data?

The administrator of the epaka.pl website is Epaka Spółka z ograniczoną odpowiedzialnością Spółka komandytowa, ul. Sochacz 16A, 21-400 Łuków (hereinafter referred to as: epaka) entered into the Register of Entrepreneurs of the National Court Register conducted by the District Court for Lublin-Wschód in Lublin seated in Świdnik, 6th Commercial Division of the National Court Register under KRS number: 0000715732.

Epaka Spółka z ograniczoną odpowiedzialnością Spółka komandytowa together with epaka.pl Spółka z ograniczoną odpowiedzialnością (KRS No. 0000500274, hereinafter referred to as: epaka.PL), ul. Sochacz 16A, 21-400 Łuków and F.H.U epaka.pl Dariusz Chornicki (NIP No.: 8252013704, hereinafter referred to as: F.H.U epaka) ul. Sochacz 16A, 21-400 Łuków are co-administrators of your personal data. Hereinafter epaka.pl, epaka.PL and F.H.U epaka.pl - co-administrators - shall be referred to as Administrator or epaka.pl website.

Co-administrators – what does it mean for you?

epaka.pl, epaka.PL and F.H.U epaka.pl jointly define the purposes and methods of processing your personal data on the www.epaka.pl website (we will talk about the purposes below). The common intention of these entities is to create a business platform that allows for efficient intermediation in the delivery of shipments. epaka.pl, epaka.PL and F.H.U epaka.pl also run related websites: zwracam.pl and sklep.epaka.pl. The responsibility resulting from running the www.epaka.pl website shall rest with epaka.pl (that is, let us remind you: Epaka Spółka z ograniczoną odpowiedzialnością Spółka komandytowa), which acts as a leader among the co-administrators mentioned. It is Epaka Spółka z ograniczoną odpowiedzialnością Spółka komandytowa that fulfills all obligations under the GDPR towards you, in particular the obligation to provide information pursuant to Art. 13 GDPR. If you want to exercise your rights under the GDPR (which we will talk about in a moment), we recommend that you turn to Epaka Spółka z ograniczoną odpowiedzialnością Spółka komandytowa. You can also contact other co-administrators (epaka.PL or F.H.U epaka) who will hand over your request to epaka.

The contact point of the co-administrators shall be epaka.pl, which you can contact in several ways:

1. by sending an e-mail to the following address: rodo@epaka.pl

2. by sending a message in the contact form on the epaka.pl website

3. by calling the number: 666 999 392

4. by sending a message on Facebook: @przesylki.epaka

5. by sending a letter to the following address: Epaka Sp. z o.o. Sp. kom., ul. Sochacz 16a, 21-400 Łuków

The recommended way of contacting about your personal data is by sending an e-mail.

II. PERSONAL DATA

In this section, we will tell you which data we collect about you, for which purpose, when and who is the recipient of your data.

Registration on the epaka.pl website

You can use epaka.pl to place an order as a registered user or as a guest. You can register on the website in three ways: via the epaka.pl website, Allegro or Facebook.

During the registration on epaka.pl, you must provide the e-mail address and password that you will use in the future. The password will only be available to you. If you forget your password, you will be able to use the “I forgot my password” option and set a new password. The epaka.pl website also saves your computer’s IP number.

In the case of registration through Allegro, you must provide the login and password for your Allegro user account. The link between epaka.pl and Allegro is a link only in terms of logging in – epaka.pl will not receive any data about you from Allegro. It is possible to unlink an account on Allegro and epaka.pl at any time.

In the case of registration through Facebook, you must provide the login and password for your Facebook user account. The epaka.pl website will receive access to your public profile on Facebook (i.e. a profile to which anyone who uses the Internet has access), however, it will not use it or share your data stored therein. The link between epaka.pl and Facebook is a link only in terms of logging in. It is possible to unlink an account on Facebook and epaka.pl at any time.

During registration on epaka.pl, you decide whether you will use the account as a consumer or as part of your business. Using an account as a consumer means using it only for private purposes, not in connection with any activity (in particular business or professional) – e.g. when you want to send a gift to someone close to you.

If you set up an account in connection with activity performed, you may use it only in connection with this activity (in particular business or professional). What do we mean? If you send a shipment as part of an online store that you are an employee or owner of, you do it in connection with your activity. The same applies to the situation when you send the shipment as part of a foundation, association or any other activity in which the recipient of the shipment is a stranger to you. In this case, you must conclude a contract with epaka.pl entrusting the processing of data of persons whose data you enter as recipients of your shipments. The sample contract can be found here or at the link provided at the time of account registration.

The legal basis for the processing of your personal data provided at the time of registration shall be Art. 6 sec. 1 let. b of GDPR, i.e. a contract for the provision of electronic services (account management on epaka.pl is the service provided).

Data collected in the user account is processed as part of the Administrator’s proprietary system.

Your data shall be processed until you submit a request to delete the account, which you can do at any time. After submitting such a request, your data will be deleted, except for data related to the orders placed. Providing data is voluntary, but necessary to create an account.

The recipients of your personal data will be the hosting providers whose services are used by the Administrator to store personal data on the server, and the IT company – in order to service the Administrator’s system, which entails the possibility of this entity to obtain access to personal data.

Client Panel

If you want to place orders as a user of epaka.pl, you must first complete the client panel before placing the first order. The following data shall be provided in the client panel: first name and last name, e-mail address, phone number and shipping address (country, zip code, city, street, house number) and bank account number. The epaka.pl website also saves your computer’s IP number. You can provide additional data in the form of a company and NIP number.

The legal basis for the processing of your personal data provided in the client panel shall be Art. 6 sec. 1 let. b of GDPR, i.e. the contract. Data collected in the user account is processed as part of the Administrator’s proprietary system. You shall always have the option to modify the data. Your data shall be processed until you submit a request to delete the account, except for data related to the orders placed. Providing data is voluntary, but necessary for keeping an account.

There is also an address book in the client panel where you can save data about the recipients of your shipments (first name and last name, address, phone number, e-mail address). Only you decide to put data in the address book and use it for the purpose of placing an order. Remember, however, that if the person whose data you entered in the address book contacted us with a request to remove them, as a rule, we shall be obliged to fulfill their request (unless data of this person will still be necessary to perform the order or determine, investigate or defend the related claims).

Order

When placing an order as a user of the epaka.pl website, your data provided earlier in the client panel shall be used.

When placing an order as a user who is not logged in, you must provide your personal data necessary to execute the order: first name and last name, e-mail address, phone number and shipping address (country, zip code, city, street, house number). You can provide additional data in the form of a company and NIP number. The epaka.pl website also saves your computer’s IP number. Providing data is voluntary, but necessary to execute an order.

By placing an order as a user who is not logged in, you decide whether you are placing the order as a consumer or as part of your business. Placing an order as a consumer means placing it only for private purposes, not in connection with any activity (in particular business or professional) – e.g. when you want to send a gift to someone close to you.

If you place an order in connection with your activity, in particular business or professional, it means that you are the administrator of personal data of persons indicated in the order form and you must conclude a contract with epaka.pl entrusting the processing of data of persons whose data you entered primarily as recipients of your shipments. You can find the sample contract here or at the link provided at the time of ordering. An example of placing an order as part of your business is placing it as part of a store, association, foundation or any other activity in which you are employed or which you are the owner of. If, as the ordering party, you enter data of other people in such situations, you shall be obliged to notify these people about the transfer of data to epaka.pl, pursuant to Art. 13 of GDPR.

The legal basis for the processing of your personal data contained in the order shall be Art. 6 sec. 1 let. b of the GDPR, i.e. the contract (intermediation in the transport of shipments), Art. 6 sec. 1 let. c of GDPR, i.e. legal obligation – issuing an invoice or other accounting document and storing them in the accounting documentation and Art. 6 sec. 1 let. f of GDPR – the legitimate interest of the administrator, i.e. protection against possible claims or allegations.

Each of your orders shall be recorded in the general database of epaka.pl and stored as a separate item. Data related to the order shall be processed until the claims for the concluded contract are time-barred. In addition to personal data, order details shall be recorded for each item in the database, such as data about the sender (if not the ordering party), data about the recipient of the shipment, date of order, courier company executing the order, selected payment method. If you placed an order as a logged in user, your orders will also be visible in the orders tab.

The recipient of your personal data shall be:

courier company – in order to perform the agency contract in the transport of shipments;
a company providing the Administrator with a system for servicing text messages – in order to perform the agency contract in the transport of shipments (sending text messages regarding the status of the shipment);
a company providing the Administrator with a system for servicing hotline - in order to perform the agency contract in the transport of shipments (hotline for order processing);
hosting providers whose services are used by the Administrator – to store personal data on the server;
IT company – in order to service the Administrator’s system, which entails the possibility of this entity to obtain access to personal data.
payment service providers – in order to carry out a payment transaction related to the performance of the agency contract in the transport of shipments;
if you fail to fulfill the obligations related to the order – the recipient of your data may also be a law company with which the Administrator cooperates.

Invoices

If, in the course of the order, you asked for an invoice or other accounting document or it is obligatory for you, your personal data shall be processed to the extent necessary to issue such a document and include it in the Administrator’s accounting documentation.

The legal basis for data processing shall be Art. 6 sec. 1 let. c of GDPR, i.e. fulfilling the legal obligation to issue and store an accounting document, which results from tax and financial provisions. Data shall be processed as long as required in accordance with the provisions. Invoices are issued by use of the Administrator’s proprietary system and the wfirma.pl program.

The recipient of your personal data shall be:

1. hosting providers whose services are used by the Administrator – to store personal data on the server;

2. IT company – in order to service the Administrator’s system, which entails the possibility of this entity to obtain access to personal data.

3. if you fail to fulfill the obligations related to the order placed – the recipient of your data may also be a law company with which the Administrator cooperates.

5.Complaints, withdrawal from the contract

Under the conditions set out in the Regulations of the epaka.pl website (see above) and the applicable law, you can submit a complaint or withdraw from the contract, which involves the processing of your personal data: first name and last name, address, phone number and e-mail address. Alternatively, you may need to provide your company name and NIP No.

Data shall be processed pursuant to Art. 6 sec. 1 let. c of GDPR, i.e. in connection with the complaint procedure or the withdrawal procedure and pursuant to Art. 6 sec. 1 let. f of GDPR - i.e. on the basis of the Administator’s legitimate interest, i.e. protection against possible claims or allegations. Data shall be processed for the time necessary for the implementation of the above-mentioned procedures or until the limitation period for the deadlines arising from the contract.

The recipient of your personal data shall be:

courier company – if the complaint concerns the service provided by it;
company providing the Administrator with a system for servicing text messages – if the complaint concerns the service provided by it;
company providing the Administrator with a system for servicing hotline – if the complaint concerns the service provided by it;
hosting providers whose services are used by the Administrator – to store personal data on the server;
IT company – in order to service the Administrator’s system, which entails the possibility of this entity to obtain access to personal data.
law company with which the Administrator cooperates – in the case of more complicated procedures.

Newsletter

On the epaka.pl website, you can subscribe to the newsletter in order to receive information about new products, promotions and offers of the epaka.pl website. For this purpose, it is necessary to provide your full name and e-mail address. You can subscribe to the newsletter in several places, e.g. by completing the order form. However, we only need your full name and e-mail address to send the newsletter, and it is the only data to be used for this purpose. The epaka.pl website also saves your computer’s IP number. Your data shall be processed for the duration of the newsletter, unless you unsubscribe earlier – then we will delete your data.

The legal basis for the processing of your personal data in the case of sending the newsletter shall be Art. 6 sec. 1 let. a of GDPR, i.e. your consent. You can express your consent by checking the appropriate checkbox when subscribing to the newsletter. You can withdraw your consent at any time by contacting the Administrator in any way indicated in the first point – formalities or by unsubscribing from the newsletter by clicking on the “here” position or a similar position in each e-mail with the newsletter.

Contact via the form on the website or by e-mail

You can contact the Administrator at any time by filling out the contact form on the epaka.pl website. For this purpose, it is necessary to provide your full name and e-mail address. You can also include other personal data in the content of your inquiry. The epaka.pl website also saves your computer’s IP number.

Similarly, when you contact the Administrator via e-mail – by sending an email to the Administrator, you automatically provide it with your e-mail address because you are the sender of the message. You can also provide other personal data in the e-mail.

The legal basis for the processing of personal data shall be therefore Art. 6 sec. 1 let. a of GDPR, i.e. your consent – you allow epaka.pl to contact you in order to respond to your inquiry or your e-mail. Your inquiry or e-mail may be archived for the period related to the activities undertaken in order to answer or - depending on the content of your inquiry - until any claims or allegations related to your inquiry are time-barred (the basis for processing shall be then Art. 6 sec. 1 let. f of GDPR – legitimate interest of the administrator related to protection against possible allegations or claims).

Partnership program – refer a friend

In the partnership program – refer a friend, you can send a referral link to epaka.pl to your friend or post it on your website.

If your friend registers on the epaka.pl website with this link and agrees to process information about the number of orders placed by them in order to calculate the points in the partnership program, the points will be calculated, in accordance with the regulations of the refer to a friend program, available here.

Partnership program – collect points

Participation in the partnership program for collecting points was regulated in detail in the regulations of this program, available in the “Your Account - Partnership Program” tab. Participation in the program shall require the use of your personal data in the Client Panel and information about the number and value of your orders for marketing purposes, including to send you a newsletter, information about new products, promotions and services of the epaka.pl website. The epaka.pl website also saves your computer’s IP number.

Your data shall be processed pursuant to Art. 6 sec. 1 let. a of GDPR, i.e. your consent in connection with participation in the partnership program. You can express your consent by checking the appropriate checkbox when subscribing to the partnership program. You can withdraw your consent at any time by contacting the Administrator in any way indicated in the first point - formalities.

Withdrawal of consent shall result in the loss of the possibility to collect points in the partnership program. Withdrawal of consent shall not affect the lawfulness of the processing which was carried out on the basis of the consent before its withdrawal, and thus the points accrued before the withdrawal of the consent may be used. Significantly, the withdrawal of consent has no consequences for the use of epaka.pl services and the possibility of concluding agency contracts in the transport of shipments.

III. YOUR RIGHTS

Goals, legal bases and the period of personal data processing are indicated above, separately in relation to each data processing purpose. Providing your personal data is always voluntary, but necessary to set up an account on the epaka.pl website, place an order, subscribe to the newsletter or the appropriate partnership program, or make contact with the epaka.pl website.

Now we will present your rights related to the processing of your personal data by epaka.pl, i.e.:

the right to request access to your personal data, as well as to receive a copy thereof,
the right to rectify your personal data,
the right to delete your personal data,
the right to restrict the processing of your personal data,
the right to object to the processing of your personal data – it is necessary to indicate a special situation which, in your opinion, justifies the cessation of processing,
the right to transfer data – if the Administrator obtained personal data on the basis of your consent or contract,
the right to withdraw consent to the processing of your personal data for a specific purpose – providing that your consent is the basis for the processing of your personal data,
the right to file a complaint with the supervisory body in relation to the processing of your personal data by the Administrator – the supervisory body shall be the President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warszawa.

You shall be entitled to exercise your rights in accordance with the principles contained in Art. 16-21 of GDPR, by contacting the epaka.pl website through one of the solutions indicated in the first point of the formalities – in particular by sending an e-mail to the following address: rodo@epaka.pl. We recommend that you turn to Epaka Spółka z ograniczoną odpowiedzialnością Spółka komandytowa. You can also contact another co-administrator (epaka.PL or F.H.U epaka) who will hand over your request to epaka.

Your rights shall not be unconditional and you shall be entitled to them depending on the circumstances. For example – the right to transfer data can be exercised only if the Administrator obtained it on the basis of your consent or contract. The right to file a complaint with the supervisory body shall be absolute, you can use it whenever you believe that the protection of your personal data was violated by the Administrator.

Your personal data shall not be processed automatically (including – not profiled).

Referring to each of the purposes of processing of your personal data, we indicated the categories of recipients who may have access to it. If you want to find out which specific companies process your personal data, send an e-mail to: rodo@epaka.pl.

IV. PROTECTION

The Administrator shall guarantee the confidentiality of all personal data provided. For this purpose, they shall take all security and personal data protection measures required by the provisions on the protection of personal data, appropriate to the threats and categories of data protected. Personal data is adequately protected against access by unauthorized persons, including against alteration, loss, damage or destruction of data. The Administrator shall use a SSL certificate to secure data transmission.

All recipients of your personal data, indicated for each purpose of the processing of your personal data, shall be trusted entities that guarantee the level of services related to the processing of personal data, complying with the GDPR standards.

V. DATA TRANSFER TO THIRD COUNTRIES

Data is transferred to countries outside the European Union only if the ordering party places an order for delivery to a selected country outside the European Union. The provision of personal data is then necessary for the performance of the shipment delivery contract concluded between the ordering party and the Administrator.

The epaka.pl website shall also use the Google reCAPTCHA mechanism, the purpose of which is to test whether the behavior of website users does not bear the characteristics of the behavior of web robots. In connection with the use of this mechanism, the Administrator may disclose your IP address to Google LLC, and therefore your data will be transferred to the USA.

VI. COOKIES

By using the epaka.pl website, you shall agree to the use of the cookies in accordance with this document. If you do not agree to our use of cookies, you shall change your browser settings appropriately or opt out of using the website.

Cookies are small files saved and stored on your computer, tablet or smartphone while you visit various websites on the Internet. A cookie usually contains the name of the website it comes from, the “lifetime” of the cookie (i.e. the duration of its existence), and a randomly generated unique number used to identify the browser from which the website is connected.

What do we use cookies for?

Our website uses cookies for advertising and statistical purposes and to adapt our website to the individual needs of users. By using cookies, we never identify the users on the basis of information stored in the cookies.

Types of cookies used

The following types of cookies are used as part of the Website:

cookies enabling the use of services available on the epaka.pl website;
cookies used to ensure security;
cookies enabling the collection of information on the use of epaka.pl websites, and the creation of statistics.

Third party cookies

By using the epaka.pl website, you can receive cookies from third parties cooperating with us, such as Facebook and Google, as well as from companies launching advertising campaigns. For more information on these cookies, please visit the websites of particular third parties.

How can I change cookies’ settings or delete them?

Typically, web browsers allow cookies to be stored on the user’s device by default. Users of the epaka.pl website can change their cookies’ settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the web browser settings or to notify about putting them on the device of the website user each time. Detailed information on the possibilities and methods of handling cookies is available in the software (web browser) settings.

Privacy policy