PRIVACY POLICY

§1. INTRODUCTION

The online store VEL LEES, operated at the internet address: www.vellees.pl, belonging to the company Silvexcraft Mateusz Wójcik Sp. k., places the utmost importance on protecting the privacy of its Customers regarding the transfer of personal data to the Customer contact department, approaching the issue of Customer privacy with commitment and taking the responsibility for the security of their data seriously. We will clearly and transparently inform our Customers about what information we collect and what we do with it.

This Privacy Policy defines the following issues:

1. What personal data we collect and process in connection with being our Client and in connection with using our website and online services;
2. Where do we obtain the data?
3. What do we do with this data?
4. How do we store the data?
5. To whom do we transfer/disclose the data?
6. How do we fulfill your right to data protection?
7. How do we comply with data protection principles?

All personal data is collected and processed in accordance with the data protection legislation applicable in Poland and the European Union.

§2. DEFINITIONS

• Administrator – the data controller indicated in point III of the Policy.
• Personal data – all information about an identified or identifiable natural person through one or several specific factors defining their physical, physiological, genetic, mental, economic, cultural, or social identity, including the device's IP, location data, online identifier, and information collected through cookies and other similar technologies.
• Policy – this Privacy Policy.
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• Service – an online store operated by the Administrator at the address www.vellees.pl
• User (Client) – any natural person visiting the Service or using one or more services or functionalities described in the Policy.

§3. PERSONAL DATA ADMINISTRATOR

We kindly inform you that the administrator of your personal data is Silvexcraft Mateusz Wójcik Sp. k. based in Tyczyn, ul. Orkana 5, 36-020 Tyczyn, NIP: 5170373027, REGON: 363361395, entered in the register of entrepreneurs of the National Court Register by the District Court in Rzeszów, XII Economic Division of the National Court Register under number 0000588340 hereinafter referred to as “VEL LEES”. Contact with VEL LEES regarding personal data protection is possible at the email address: support@vellees.com.

§4. PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

In order to provide services in accordance with the scope of our activities, VEL LEES processes your personal data — for various purposes, but always in compliance with the law. Below you will find the specified purposes of personal data processing along with the legal bases.

ACCOUNT REGISTRATION IN THE SERVICE

Individuals registering in the online store VEL LEES are asked to provide the data necessary to create and manage an account. Providing data marked as mandatory is required to establish and manage the account, and failure to provide such data will result in the inability to create an account. Data such as gender and date of birth may be provided optionally by the User.The above data is transmitted via the contact form available on the page www.vellees.pl 

Personal data is processed:

• for the purpose of providing services related to the management and servicing of an account in the online store VEL LEES – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR). Optionally, for data provided voluntarily – the legal basis for processing is consent (Article 6(1)(a) GDPR);
  
• for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR) consisting of conducting analyses of your activity in the Service and how you use your account, as well as your preferences in order to improve the functionalities used;
  
• for the potential establishment and pursuit of claims or defense against them – the legal basis for processing is the legitimate interest of the Administrator (Article1 lit. b RODO);
•  for handling complaints - in this case, the legal basis for processing is the necessity of processing for the performance of the contract (Article 6(1)(b) of the GDPR);
1 lit b GDPR); for analytical and statistical purposes – in this case, the legal basis for processing is the legitimate interest of the Administrator (art. 6 sec. 1 lit f GDPR) consisting of conducting analyses of User activity, as well as their preferences in order to improve the functionalities used and the services provided;
•  for the potential establishment and pursuit of claims or defense against them – the legal basis for processing is the legitimate interest of the Administrator (art. 6 sec. 1 lit f GDPR) consisting of protecting its rights;
•  for the marketing purposes of the Administrator - a detailed description of the purposes and legal bases can be found in the marketing and direct marketing tab.

PLACING ORDERS IN THE SERVICE:

Placing an order (purchasing goods) by the Customer of the online store VEL LEES is associated with the processing of their personal data.Providing data marked as mandatory is required for the acceptance and processing of the order, and failure to provide it results in the inability to fulfill the order.

Personal data is processed:

1. for the purpose of fulfilling the placed order – the legal basis for processing is the necessity of processing for the performance of the contract (Article 6(1)(b) of the GDPR); for the data provided voluntarily, the legal basis for processing is consent (Article 6(1)(a) of the GDPR);
2.  for the purpose of fulfilling legal obligations imposed on the Administrator, resulting in particular from tax regulations and accounting regulations – the legal basis for processing is a legal obligation (Article 6(1)(c) of the GDPR);
3.  for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR); f GDPR) consisting of analyzing User activity on the Service, as well as their purchasing preferences in order to improve the functionalities used;
4.  in order to potentially establish and pursue claims or defend against them – the legal basis for processing is the legitimate interest of the Administrator (art. 6 sec. 1 lit. f GDPR) consisting of protecting its rights.

CONTACT FORM:

The Administrator provides the possibility to contact him using an electronic contact form. Using the form requires providing personal data necessary to contact the User and respond to the inquiry. Providing data marked as mandatory is required for the acceptance and handling of the inquiry, and failure to provide them results in the inability to process the request.

Personal data is processed:

1. for the purpose of identifying the sender and handling their inquiry submitted through the provided form – the legal basis for processing is the necessity of processing for the performance of a service contract (Article 6(1)(b) of the GDPR);
2. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR) consisting of conducting statistics of inquiries submitted by Users through the Service in order to improve its functionality.

MARKETING:

The Administrator processes Users' personal data for the purpose of carrying out marketing activities, which may include:

1.  sending email notifications about interesting offers or content, which in some cases may contain commercial information;
2.  conducting other types of activities related to direct marketing of goods and services (sending commercial information electronically);
3.  for the purpose of carrying out marketing activities, the Administrator in some cases uses profiling, i.e. through so-called geolocation, obtains knowledge about the country of the User's place of residence, using the online store VEL LEES and so-called. segmentation – that is, the selection of Customers who have not placed any orders since registering an account in the online store VEL LEES, with the aim of sending such a Customer an offer or discount code to the email address provided by the Customer. This means that, through automated data processing, the Administrator evaluates selected factors concerning individuals to analyze their behavior or create forecasts;

In the case of data processing operations for the aforementioned marketing purposes, except for those carried out within the framework of the newsletter, which operates based on the regulations, the basis for such processing is the fulfillment of objectives arising from the legitimate interests pursued by the Administrator (Article 6(1)(f) GDPR).

DIRECT MARKETING:

If the Customer has consented to receive marketing information via e-mail, SMS, and other electronic communication means, the User's personal data will be processed for the purpose of sending such information. The basis for data processing is the legitimate interest VEL LEES consisting of sending marketing information within the limits of the consent granted by the User (direct marketing). The User has the right to object to the processing of data for direct marketing purposes, including profiling. Data will be stored for this purpose for the duration of the legally justified interest VEL LEES, unless the User objects to receiving information.

SOCIAL MEDIA PLATFORMS:

The Administrator processes the personal data of Users visiting the Administrator's profiles maintained on social media (Facebook, Instagram).These data are processed solely in connection with managing the profile, including informing Users about the Administrator's activities and promoting various events, services, and products, as well as communicating with users through functionalities available on social media. The legal basis for the processing of personal data by the Administrator for this purpose is its legitimate interest (Article 6(1)(f) GDPR) consisting of promoting its own brand and building and maintaining a community related to the brand.

HANDLING COMPLAINTS:

In order to handle complaints, we process your personal data, such as: first and last name, email address, order number, possibly home address and bank account number — if a refund is made.
The legal basis for such data processing is Article 6(1)(f)b GDPR, which allows the processing of personal data if it is necessary for the performance of a contract or for taking steps to enter into a contract.

EMAIL NOTIFICATIONS:

In order to send email notifications to the Client regarding the service being provided, we process personal data such as: email address and order number.
The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows the processing of personal data if the Data Controller is pursuing a legitimate interest (in this case, the Company's interest is to inform you about activities related to the service execution to enhance your comfort in using the service).

PHONE CONTACT:

In order to contact you by phone regarding the service being provided, we process personal data such as: phone number, order number.
The legal basis for such data processing is Article.6 para. 1 point a GDPR, which allows for the processing of personal data based on voluntarily given consent.

REGISTERS AND RECORDS GDPR:

In order to create registers and records related to GDPR, including, for example, a register of customers who have lodged an objection in accordance with GDPR, we process personal data such as: first name and last name, email address, because firstly, GDPR regulations impose certain documentation obligations on us to demonstrate compliance and accountability, and secondly, if you lodge an objection to the processing of your personal data for marketing purposes, we need to know against whom not to apply direct marketing, as they do not wish for it.
The legal basis for such data processing is firstly, Article 6 para. 1 point c GDPR, which allows for the processing of personal data if such processing is necessary for the Data Controller to fulfill obligations arising from the law; secondly, Article6 sec. 1 letter f of the GDPR, which allows the processing of personal data if the Data Controller is pursuing a legitimate interest (in this case, the Company's interest is to have knowledge about individuals exercising their rights under the GDPR).

COOKIES:

In order to use cookies on the website, we process such text information (cookies will be described in a separate section). The legal basis for such processing is Article 6 sec. 1 letter a of the GDPR, which allows the processing of personal data based on voluntarily given consent (upon the first visit to the website, a request for consent to use cookies appears).

ADMINISTERING THE WEBSITE:

In order to administer the website, we process personal data such as: IP address, server date and time, browser information, operating system information — this data is automatically recorded in so-called server logs each time the online store is used www.vellees.pl. Administering the website without the use of a server and without this automatic recording would not be possible. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows for the processing of personal data if the Data Controller is pursuing a legitimate interest (in this case, the Company's interest is administering the website).

COMMENTS ON THE SERVICE PAGE:

In order for you to post a comment on the website of the online store VEL LEES, we process personal data such as your first and last name.The legal basis for such processing is Article 6(1)(a) of the GDPR, which allows for the processing of personal data based on voluntarily given consent (in this case, we assume that posting a comment is simultaneously expressing consent to the processing of personal data).


§5. COOKIES

1. On our website, like other entities, we use so-called cookies, which are short text information stored on the User's computer, phone, tablet, or other device. They can be read by our system as well as by systems belonging to other entities whose services we use (e.g., Facebook, Google).
2.  Cookies serve many functions on a website, most of which are useful, and we will try to describe them below (if the information is insufficient, please contact us):
   a)    ensuring security — cookies are used to authenticate users and prevent unauthorized access to the Client's panel. They thus serve to protect the Client's personal data from access by unauthorized persons;
   b)    impact on processes and performance of using the website — cookies are used to ensure that the site operates smoothly and that the available functions can be used, which is possible, among other things, by remembering settings between subsequent visits to the site. Thanks to them, it is possible to navigate efficiently on the website and its individual subpages;
   c)    session state — cookies often store information about how visitors use the website, e.g., which subpages are viewed most frequently. They also allow for the identification of errors displayed on certain subpages. Cookies used to store the so-called "session state" thus help improve services and enhance browsing comfort;
   d)    session maintenance — if the Customer logs into their panel, cookies enable the session to be maintained. This means that after navigating to another subpage, there is no need to repeatedly enter the login and password, which enhances the comfort of using the website;
   e)    creating statistics — cookies are used to analyze how Users interact with the website (how many open the website, how long they stay on it, which content generates the most interest, etc.). This allows for continuous improvement of the website and tailoring its functionality to the preferences of Users. To track activity and create statistics, we use Google tools, such as Google Analytics; in addition to reporting website usage statistics, the Google Analytics pixel can also be used, along with some of the cookies described above, to help display more relevant content to the user in Google services (e.g. in the Google search engine) and across the network;
   f)    use of social functions — on our website, we have the so-called Facebook, Instagram, and YouTube pixel, which allows you to like our fan page on these services while using the site. However, for this to be possible, we need to use cookies provided by Facebook, Instagram, and YouTube.
3. Importantly, many cookies are anonymized for us — without additional information, we are unable to identify your identity based on them.
4. Your web browser by default allows the use of cookies on your device, therefore, upon your first visit, we ask for your consent to the use of cookies.If you do not wish to use cookies while browsing the website, you can change the settings in your web browser — completely block the automatic handling of cookies or request a notification each time cookies are placed on your device. Settings can be changed at any time.
5. Respecting the autonomy of all individuals using the website, we feel obliged to warn that disabling or limiting the handling of cookies may cause quite serious difficulties in using the website, e.g., the need to log in on every subpage, longer loading times, limitations in using functionalities, restrictions in liking the page on Facebook, etc.
6. You can withdraw your consent regarding cookies on our site at any time by using the information available on this page.

§6.USING KLAVIYO (EMAIL/SMS MARKETING AUTOMATION)

1. For marketing communication purposes, we use the Klaviyo platform provided by Klaviyo, Inc. In relation to our Users' data, Klaviyo acts primarily as a data processor based on our Data Processing Agreement containing the EU Standard Contractual Clauses (SCC). Information about Klaviyo's privacy practices can be found in their Privacy Notice  https://www.klaviyo.com/legal/privacy/privacy-notice and  DPA: https://www.klaviyo.com/legal/data-processing-agreement
2. We may transfer or collect the following categories of User data to Klaviyo:
   a)    contact data (e.g., name, email address, phone number),
   b)    transactional data and shopping preferences (e.g., order history, cart, returns),
   c)    data regardinginteraction with our messages (opens, clicks, unsubscribes),
   d)    online identifiers and device/activity data on the Website (m.in. IP address, Klaviyo cookie identifier __kla_id, events such as "active on page", "viewed product"). This data comes from the User (e.g., sign-up forms), from our sales systems (Shopify), and from Cookies/pixels on our Website and messages. Klaviyo Help Center+1
3. Processing purposes:
   a)    sending and personalizing marketing communication (email/SMS),
   b)    automations (e.g., abandoned cart, availability notifications, birthday),
   c)    segmentation and campaign effectiveness analytics,
   d)    sending transactional messages (e.g., order confirmations),
   e)    maintaining subscription lists and managing consents.
4. Legal bases:
   a)     Consent (Article 6(1)(a) GDPR) — for email/SMS marketing, when required by law;
   b)     Performance of a contract (Article 6(1)(b) GDPR) — transactional messages related to the order;
   c)     Legitimate interest (Article 6(1)(f) GDPR) — analytics, segmentation, and personalization within the bounds of the User's reasonable expectations and the security of our systems.
5. The online store VEL LEES may use Klaviyo scripts (e.g., klaviyo.js), which save the cookie __kla_id used for identifying visitors and linking activities to the subscriber's profile, as well as pixels in our email/SMS messages to measure opens/clicks. Details regarding cookies and how they work are available in the Klaviyo documentation. The User can control Cookies in accordance with the "Cookies" section of this Policy. Klaviyo Help Centerdevelopers.klaviyo.com
6. In connection with the use of Klaviyo, data may be transferred to the USA and other jurisdictions. We implement appropriate safeguards as provided by GDPR, in particular the Standard Contractual Clauses included in the Klaviyo DPA, Data Privacy Framework (DPF), which provides additional guarantees for transfers to the USA. More information about SCC and DPF can be found in the sources listed below. KlaviyoKlaviyo Help CenterEuropean Commissiondataprivacyframework.gov+1
7.   We store data in Klaviyo for as long as necessary for the purposes for which it was collected (e.g., maintaining subscriptions, executing campaigns, and legal obligations), and then we delete or anonymize it in accordance with our retention policies and Klaviyo account settings.
8.  The user can at any time:
   a)    withdraw consent and unsubscribe from marketing emails by clicking the "unsubscribe" link in the footer of each message,
   b)    unsubscribe from SMS by sending a command (e.g., "STOP"), if SMS messages are being used,
   c)    contact us regarding the exercise of rights (access, deletion, restriction, objection). Klaviyo provides mechanisms for recording/managing consent, and details can be found in its help materials. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Klaviyo Help Center
9. Within Klaviyo, we can create segments and use the resulting profiles (e.g., product interests, purchase frequency) to tailor content and offers.However, we do not make decisions regarding the User that have legal effects or significantly affect them in a similar way solely based on automated processing (Article 22 of the GDPR).
10. Additional information about Klaviyo:
    a)    Klaviyo Privacy Policy (Privacy Notice) and privacy center, including questions regarding compliance: privacy@klaviyo.com.
    b)    Klaviyo DPA: https://www.klaviyo.com/legal/data-processing-agreement
    c)    Information about cookies/tracking (m.in. __kla_id) in the help documentation. Klaviyo+1Klaviyo Help Center

§7. RIGHT TO WITHDRAW CONSENT

1. If the processing of personal data is based on consent, you may withdraw this consent at any time — at your discretion.
2. If you would like to withdraw your consent to the processing of personal data, you can do so by:
   a)    sending an email directly to VEL LEES at the address support@vellees.com lub
   b)    checking the appropriate box in the Client panel, in the "My Account" → "Personal Data" tab or 
   c)    clicking the link in the email included at the end of each message sent.
   
3. If the processing of your personal data was based on consent, withdrawing it does not render the processing of personal data up to that point illegal. In other words, until the consent is withdrawn, we have the right to process your personal data, and its withdrawal does not affect the legality of the processing that has taken place so far.

§8. REQUIREMENT TO PROVIDE PERSONAL DATA

1. Providing any personal data is voluntary and depends on your decision.However, in some cases, providing certain personal data is necessary to meet your expectations regarding the use of services offered by VEL LEES.
2.  In order to fulfill your order, it is necessary to provide your email address — without this, we are unable to send information about the status of order fulfillment electronically.
3.   In order for you to receive your order, it is necessary to provide address details — without this, we are unable to deliver the order.
4. In order to contact you, it is necessary to provide a phone number — without this, we are unable to reach out in case of questions regarding the order, delivery, or significant changes in the offer of VEL LEES.
   

§9.AUTOMATED DECISION MAKING AND PROFILING

1. In order to carry out marketing activities, the Administrator in some cases uses profiling, i.e., through so-called geolocation, obtains knowledge about the country of the User's location who is using the online store VEL LEES and so-called segmentation – that is, selecting Customers who have not placed any orders since registering an account in the online store VEL LEES, with the aim of sending such a User an offer or discount code to the email address provided by the Customer. This means that through automated data processing, the Administrator assesses selected factors concerning individuals to analyze their behavior or create forecasts.
2. In order to carry out marketing activities, the Administrator uses solutions that examine User behavior by creating so-called heat maps and recording User behavior on the site.The above information is anonymized before being sent to the service operator; therefore, the operator does not have information about which individual the aforementioned data pertains to. The Administrator states that the recorded User behavior does not include passwords entered by the User and other personal data. 
   

§10. RECIPIENTS OF PERSONAL DATA

1. In connection with the provision of services, your personal data will be disclosed to external entities, including in particular suppliers responsible for the operation of IT systems, entities such as banks and payment operators, entities providing accounting, legal, auditing, consulting services, couriers (in connection with order fulfillment), marketing agencies (in the scope of marketing services), as well as entities related to the Administrator and business partners.
2. If you give your consent, the data may also be shared with other entities for their own purposes, including marketing purposes.
3.  The Administrator reserves the right to disclose selected information about you to the relevant authorities or third parties who request such information, based on the appropriate legal basis and in accordance with applicable law. It is extremely difficult for us to predict who may come forward with a request for personal data disclosure. Nevertheless, we assure you that we analyze each case of a request for personal data disclosure very carefully and thoroughly.

§11. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

The level of protection of personal data outside the European Economic Area (EEA) differs from that provided by European law.For this reason, the Administrator transfers personal data outside the EEA only when necessary and with the provision of an appropriate level of protection. 

§12. PERIOD OF PROCESSING PERSONAL DATA

1. In accordance with applicable law, we do not process your personal data "indefinitely," but for the time necessary to achieve the designated purpose. After this period, your personal data will be irreversibly deleted or destroyed.
2.  In situations where we do not need to perform any other operations on your personal data than storage (e.g., order fulfillment), until permanent deletion or destruction, we additionally secure it — through pseudonymization. Pseudonymization involves encrypting personal data or a set of personal data in such a way that, without an additional key, it cannot be read, and thus such information becomes completely useless to unauthorized persons.
3. Regarding the specific periods for processing personal data, we kindly inform you that we process personal data for the following periods:
   a)    duration of the contract — in relation to personal data processed for the purpose of concluding and performing the contract;
   b)    3 years or 10 years + 1 year — in relation to personal data processed for the purpose of establishing, pursuing, or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
   c)    6 months — in relation to personal data collected during the service valuation, and at the same time, the contract was not concluded immediately;
   d)    5 years — in relation to personal data related to the fulfillment of tax obligations;
   e)    until the consent is withdrawn or the processing purpose is achieved, but no longer than for 5 years — in relation to personal data processed based on consent;
   f)    until an effective objection is raised or the processing purpose is achieved, but no longer than for 5 years — in relation to personal data processed based on the legitimate interest of the Data Controller or for marketing purposes;
   g)    until it becomes outdated or loses its usefulness, but no longer than for 3 years — in relation to personal data processed mainly for analytical purposes, the use of cookies, and website administration.
4. Periods in years are counted from the end of the year in which we began processing personal data, in order to streamline the process of deleting or destroying personal data. Separate counting of the deadline for each event would involve significant organizational and technical difficulties, as well as a substantial financial burden, therefore establishing a single date for the deletion or destruction of personal data allows us to manage this process more efficiently. Of course, in the case of exercising your right to be forgotten, such situations are considered individually.
5. The additional year related to the processing of personal data collected for the purpose of executing the contract is due to the fact that hypothetically you may file a claim just before the expiration of the limitation period, the request may be delivered with significant delay, or you may incorrectly determine the limitation period for your claim.

§13.RIGHTS OF DATA SUBJECTS

1. We kindly inform you that you have the right to:
   a)    access your personal data;
   b)    rectify personal data;
   c)    delete personal data;
   d)    restrict the processing of personal data;
   e)    object to the processing of personal data;
   f)    data portability.
2. We respect your rights arising from data protection regulations and strive to facilitate their exercise to the highest possible extent.
3. We indicate that the mentioned rights are not absolute, and therefore, in some situations, we may legally refuse to fulfill them. However, if we refuse to comply with a request, it is only after thorough analysis and only in situations where refusal is necessary.
4. Regarding the right to object, we clarify that you have the right to object to the processing of personal data based on the legitimate interests of the Data Controller (which are listed in point V) in relation to your particular situation at any time. However, you must remember that according to the regulations, we may refuse to consider the objection if we demonstrate that:
   a)    there are legitimate grounds for processing that override your interests, rights, and freedoms, or
   b)    there are grounds for establishing, pursuing, or defending claims.
5. Furthermore, you may object to the processing of your personal data for marketing purposes at any time. In such a case, upon receiving the objection, we will cease processing for this purpose.
6.  You can exercise your rights by:
   a)    sending an email directly to VEL LEES at the address support@vellees.com lub
   b)    clicking the link in the email, included at the end of each sent message.
   

§14. RIGHT TO LODGE A COMPLAINT

If you believe that your personal data is being processed in violation of applicable law, you may lodge a complaint with the President of the Personal Data Protection Office.

§15. FINAL PROVISIONS

1. In matters not regulated by this Privacy Policy, the provisions of personal data protection law shall apply.
2.  You will be notified of any changes made to this Privacy Policy via email.
3. The privacy policy is continuously reviewed and updated as necessary.
4. This Privacy Policy is effective as of September 12, 2025.