Privacy policy

Z Kopytem spółka z ograniczoną odpowiedzialnością

I. General Information

This Privacy Policy sets out the rules for processing personal data by Z Kopytem spółka z ograniczoną odpowiedzialnością in connection with the use of the website https://kopyto.com, including the online store.

This Privacy Policy is of an informational nature and, in particular, fulfils the obligation referred to in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, as amended) (hereinafter: “GDPR”).

Z Kopytem sp. z o. o. takes particular care to protect the privacy of users and the security of the personal data processed.

As a company, we strive to make every effort to ensure that the level of protection of your personal data improves year on year. We believe that reading our privacy policy will allow you to feel secure and enjoy shopping at kopyto.com.

II. Personal Data Controller

The Personal Data Controller (hereinafter: “Controller”), i.e. the entity responsible for processing your personal data, is: Z Kopytem spółka z ograniczoną odpowiedzialnością with its registered office in Sopot, Poland, ul. Władysława Łokietka 46/1, 81-376 Sopot, KRS (National Court Register no.): 0000617134, NIP (tax no.): 5851474404, REGON (statistical no.): 364408532, conducting business in the field of selling products through the online store.

Contact with the Controller is possible:

by email – sklep@kopyto.com
in writing to the registered address of the company.

III. Personal Data Protection System

The Controller applies technical and organisational measures ensuring the protection of processed data in accordance with the requirements set out in applicable personal data protection legislation.

The most important elements of the personal data protection system in place include:

an SSL certificate, which guarantees that communication between your computer and kopyto.com is encrypted with a 256-bit key;
the collection and processing by us of only necessary personal data, for the shortest possible period, for the specific purposes set out below, on the basis of legal grounds enabling the processing of your personal data. One such legal ground is the provision of explicit, unambiguous consent to the processing of personal data (this applies in particular to direct marketing, e.g. in the form of sending a Newsletter);
ensuring access to your personal data exclusively to authorised persons trained in personal data protection, who guarantee the security of your data.

The Controller's IT systems and internal procedures meet all personal data protection standards.

IV. Personal Data, Purpose and Retention Period

A. Placing an Order

When an Order is placed, we process your personal data for the purpose of its fulfilment (i.e. for the purpose of concluding and performing the sales agreement for the Controller's products), as well as for handling payment and delivery of the goods.

The legal bases for processing your personal data in connection with the fulfilment of an Order are:

performance of the agreement (sales agreement) or taking steps at the request of the data subject prior to entering into the agreement, pursuant to Art. 6(1)(b) GDPR;
legal obligations imposed on the Controller in the scope of accounting for payments for products sold (Art. 6(1)(c) GDPR); and
in certain situations – the legitimate interest of the Controller, consisting in processing data for the purpose of establishing, pursuing or defending potential claims (Art. 6(1)(f) GDPR).

When placing an Order, we ask you to provide us with the data necessary for its fulfilment, i.e. we ask you to provide personal data such as:

first name and surname – required for issuing the sales document and addressing the shipment;
address (street, house number and/or flat number, postal code and city) – required for addressing the shipment;
email address – required for communication related to the fulfilment of the Order;
telephone number – required in the case of delivery methods offered in the store (required by carriers).

In the event that when placing an Order the customer chooses delivery to an address other than the one provided during registration or when placing the Order, or chooses to have the sales document issued with data other than those provided during registration or when placing the Order, we additionally ask you to provide:

first name and surname or company/institution name – required for addressing the shipment;
address (street, house number and/or flat number, postal code and city) – required for addressing the shipment;
telephone number for the recipient of the shipment – required in the case of certain delivery methods (required by carriers);
tax identification number (NIP) – for the purpose of issuing the appropriate proof of purchase (invoice).

In connection with the fulfilment of the Order, your personal data may be transferred to entities providing postal and courier services, including, inter alia, Poczta Polska S.A., DPD Polska sp. z o. o., InPost sp. z o. o., GLS General Logistics Systems Poland sp. z o. o., as well as to online payment operators: PayPro S.A. (Przelewy24), Blue Media S.A., InPost sp. z o.o. (InPost Pay).

Your personal data are stored for a period of 5 years from the end of the calendar year following the year in which the sales document was issued, in accordance with the applicable regulations governing the retention period of accounting documents.

B. Handling Complaints and Returns

Where you exercise the right of withdrawal from the agreement, make a return of goods, or submit a complaint, we process your personal data for the purpose of handling the request, exercising the rights available to you under applicable law, and settling the refund or exchange of goods.

The legal bases for processing your personal data in connection with the handling of returns and complaints are:

performance of the agreement or taking steps at the request of the data subject, in connection with the exercise of consumer rights (Art. 6(1)(b) GDPR);
legal obligations imposed on the Controller, arising in particular from the provisions of the Act of 23 April 1964 – Civil Code (consolidated text: Journal of Laws of 2025, item 1071, as amended) and the Act of 16 February 2007 on competition and consumer protection (consolidated text: Journal of Laws of 2025, item 1714, as amended), in the scope of handling complaints and withdrawal from the agreement (Art. 6(1)(c) GDPR);
the legitimate interest of the Controller, consisting in processing data for the purpose of establishing, pursuing or defending potential claims related to a complaint or return (Art. 6(1)(f) GDPR).

In connection with the handling of returns and complaints, we process the personal data necessary for the proper conduct of this process, in particular:

first name and surname – required for identifying the person submitting the complaint or making the return;
email address – required for communication related to the handling of the return or complaint;
telephone number – used where rapid contact is necessary;
residential address or correspondence address – required in the case of dispatch of goods following resolution of the complaint;
order number, data concerning the purchased product and bank account number – required for identifying the transaction and effecting the refund.

In the event of a return or complaint requiring the goods to be sent back, your personal data may be transferred to entities providing postal and courier services, including, inter alia: Poczta Polska S.A., DPD Polska sp. z o.o., InPost sp. z o.o. and GLS General Logistics Systems Poland sp. z o. o.

Where a return or complaint involves a refund of funds, your personal data may be transferred to payment operators for the purpose of processing the refund, including PayPro S.A. (Przelewy24), Blue Media S.A. or other operators used by the store.

Your personal data processed in connection with the handling of returns and complaints are stored:

for the duration of liability under warranty or guarantee, i.e. as a rule 2 years from the date of delivery of the goods, and after the expiry of that period – until the limitation of any potential claims arising therefrom;
in respect of data contained in accounting and tax documents, including invoices and other proof of sale – for a period of 5 years, calculated from the end of the calendar year in which the tax payment deadline expired, in accordance with applicable tax law.

Upon expiry of the specified periods, personal data are deleted or anonymised, unless their further processing is required under applicable law or is necessary for the establishment, pursuit or defence of claims.

C. Marketing (Newsletter & Tracking Technologies), Including Profiling

Where a Newsletter subscription is taken out and consent is given to receive commercial information from Z Kopytem sp. z o. o., we process your personal data for the purpose of conducting marketing activities, in particular sending information about products, promotions, new arrivals and special offers available in the kopyto.com store.

In the course of marketing activities, the Controller may apply profiling, consisting in the automated analysis of the user's personal data for the purpose of assessing their interests and purchasing preferences.

Profiling is carried out in particular on the basis of data such as: purchase history, information on abandoned Carts, activity on the store's website (where linked to an email address), as well as data concerning interactions with marketing communications sent (e.g. message opens, link clicks).

On the basis of the above information, the Controller may assign the user to specific recipient groups (segments) and direct tailored marketing content to them, including personalised offers, product recommendations or reminders about unfinished purchases, using tools such as Edrone.

Profiling does not result in any decision being taken in relation to the user that produces legal effects or similarly significantly affects the user within the meaning of Art. 22 GDPR.

The consequence of profiling is in particular the receipt of more tailored marketing communications and content corresponding to the user's interests.

Legal bases for the processing of personal data

The processing of personal data for marketing purposes, including the profiling of users, takes place on the basis of the user's consent (Art. 6(1)(a) GDPR in conjunction with the provisions of the Electronic Communications Law and the Act on the provision of services by electronic means), expressed in particular by subscribing to the Newsletter, giving consent to receive commercial information, or accepting the use of marketing technologies (e.g. cookies).

Profiling for marketing purposes takes place exclusively on the basis of the consent given.

In the scope of statistical analyses and improvement of the functioning of the store, to the extent that such activities are not of a marketing nature and do not involve profiling, the legal basis for the processing of personal data is the legitimate interest of the Controller (Art. 6(1)(f) GDPR).

In the course of marketing activities, we process the following personal data:

email address – required for sending the Newsletter and commercial information;
first name (if provided);
information on marketing consents and their history – for the purpose of demonstrating that processing is carried out in accordance with the law;
purchase history;
statistical data concerning use of the Newsletter (e.g. information on a message being opened or a link being clicked) – for the purpose of analysing the effectiveness of marketing activities conducted;
transaction data (in the case of customers – to a limited extent);
behavioural data: information on abandoned Carts, activity on the store's website (where linked to an email address), data concerning interactions with marketing communications sent (e.g. message opens, link clicks).

You may unsubscribe from the Newsletter at any time by clicking the unsubscribe link located in the footer of each email, or by contacting the Controller. You may also withdraw your consent to direct marketing conducted by the Controller.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

In connection with the conduct of marketing activities, your personal data may be transferred to the following entities processing data on behalf of the Controller:

MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland – for the purpose of using the mailing system for sending the Newsletter;
Edrone sp. z o.o., ul. Lekarska 1, 31-203 Kraków, NIP: 6762482064, KRS: 0000537197 – for the purpose of using the edrone.me system for sending the Newsletter and conducting marketing campaigns, including email and SMS campaigns and marketing activities on social media channels, activated or indicated by the Controller via the Edrone system;
TrustMate S.A., Bartoszowicka 3, 51-641 Wrocław, NIP: 8971854393, KRS: 0000737597 – for the purpose of collecting, gathering and publishing reviews of products offered by the Controller.

Personal data processed for marketing purposes are stored until the consent to their processing is withdrawn, and after withdrawal – for the period necessary to demonstrate that the processing was carried out in accordance with the law, i.e. until the limitation of any potential claims related to the processing of data for marketing purposes.

Tracking Technologies

The Controller informs that tracking technologies enabling the analysis of user activity and the conduct of marketing activities are used on the kopyto.com store website.

In particular, the Controller uses tools offered by Edrone, which may use cookies or similar technologies for the following purposes:

analysis of statistics concerning the use of the store's website;
conducting marketing activities, including email and SMS campaigns and activities on social media, carried out exclusively on the instructions of and in accordance with the directions of the Controller.

In each case, the processing of personal data for marketing purposes takes place exclusively on the basis of an appropriate legal ground, in particular:

the user's consent – in the case of direct marketing carried out using electronic communications;
the legitimate interest of the Controller – in the scope of statistical analyses and improvement of the functioning of the Store, to the extent permitted under applicable law.

The user has the ability to manage consents to the use of marketing and analytical technologies, including cookies, via the web browser settings or a dedicated consent management tool, in accordance with the rules set out in the Cookie Policy at https://kopyto.com/pages/cookie-policy.

D. Correspondence and Other Data

Where personal data are provided to the Controller that are not necessary for the performance of the agreement concluded, fulfilment of a legal obligation incumbent upon the Controller, or handling of the user's request (in particular in the content of correspondence, withdrawal forms, complaint requests or requests related to warranty or guarantee), such data are not subject to further processing and are deleted or anonymised without delay, unless applicable law provides otherwise.

The Controller processes only personal data that are adequate, relevant and limited to what is necessary in relation to the purpose for which they were provided. In light of the above, we kindly ask you not to provide information or personal data that are not required for the performance of the agreement, fulfilment of a legal obligation or handling of the request, and that are irrelevant from the perspective of these purposes.

V. Cookies

The kopyto.com store uses cookies and other similar technologies to ensure the correct functioning of the website, to improve the quality of the services provided, to conduct statistics, and – subject to consent – for marketing purposes.

Cookies are IT data, in particular text files, which are stored on the end device of the kopyto.com customer.

The user may at any time:

give or refuse consent to the use of specific categories of cookies;
withdraw consent previously given;
change their cookie settings via the cookie management panel available in the Service.

Detailed information regarding the cookies used, their storage periods, third parties and consent management rules can be found in the Cookie Policy available at: https://kopyto.com/pages/cookie-policy.

VI. Recipients of Personal Data

Personal data may be transferred to third parties exclusively in cases provided for by law and to the extent necessary for the fulfilment of specified processing purposes.

In particular, where applicable law imposes on the Controller an obligation to transfer personal data to authorised public authorities (e.g. law enforcement agencies or other state authorities), such data will be disclosed to the extent required.

Beyond the above cases, personal data may be transferred exclusively to trusted entities cooperating with the Controller, on the basis of concluded data processing agreements or other legal instruments compliant with the GDPR, and solely to the extent necessary for the performance of the Controller's contractual or legal obligations.

Depending on the purpose and scope of processing, personal data may be transferred to the following categories of recipients:

electronic payment operators – for the purpose of processing payments for Orders;
banks and payment institutions;
entities providing accounting and bookkeeping services;
courier companies, carriers and logistics operators – for the purpose of fulfilling deliveries;
IT service providers and hosting providers – for the purpose of maintaining and ensuring the correct functioning of the store's IT infrastructure;
mailing and marketing tool providers – for the purpose of handling the Newsletter and marketing activities (e.g. Edrone sp. z o.o.);
analytical tool providers – for the purpose of analysing statistics and improving the functioning of the website.

The Controller ensures that all entities to which personal data are transferred process them exclusively on documented instructions from the Controller, with appropriate technical and organisational measures in place ensuring the security and confidentiality of personal data.

VII. Transfer of Data Outside the EU/EEA

Personal data may be transferred to third countries exclusively in the scope of the use of IT tools of providers with infrastructure outside the EU.

Data transfers are carried out using standard contractual clauses approved by the European Commission or other mechanisms compliant with Chapter V of the GDPR.

VIII. Your Rights

In connection with the processing of personal data, you have the right to:

access your personal data;
obtain a copy of your personal data;
rectify or supplement your personal data; please note that some personal data can be edited independently via your account;
erasure of your personal data;
restriction of the processing of your personal data;
portability of your personal data.

You may exercise your rights by writing to us at: sklep@kopyto.com.

The Controller shall, without undue delay – and in any event within one month of receipt of the request – provide you with information on the actions taken in response to your request. Where necessary, the one-month period may be extended by a further two months due to the complex nature of the request or the number of requests.

Withdrawal of Consent

To the extent that the processing of your data is based on consent, your data will be processed until the consent is withdrawn. Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Right to Object

You have the right to object at any time to the processing of your data for the purposes of direct marketing, including profiling, where processing takes place on the basis of the legitimate interest of the Controller.

You also have the right to object at any time to the processing of your data on grounds relating to your particular situation, in cases where the legal basis for the processing of data is the legitimate interest of the Controller (e.g. in connection with the pursuit of analytical and statistical purposes, including profiling).

Complaint to the Supervisory Authority

If you believe that the processing of your personal data violates the law, you have the right to lodge a complaint with the supervisory authority competent for the place of your residence. In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office (https://uodo.gov.pl/). Before lodging a complaint, we encourage you to contact us and to exercise the rights available to you as described in this section.

IX. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy, in particular where such amendment is required by applicable law, where the technological conditions of the functioning of kopyto.com change, or where the amendment would introduce a standard higher than the minimum required by law.

Date of policy update: 30 April 2026, Bielsko-Biała, Poland