STOCKED IN POLAND · FAST SHIPPING · B2B ONLINE
EN
PL
0

Privacy policy

What data we collect, why we process it, who receives it, and what rights you have.

Data controller

Controller
NASEL SP. Z O.O. · NIP PL5223188871
Address
EACC HALA B24-26, Nadrzeczna 7A, 05-552 Wólka Kosowska, Polska
Data contact
contact@i8denim.pl
Data protection officer
The controller has not appointed a data protection officer, as it is not required to (art. 37 GDPR). For any matter concerning personal data please write to the e-mail address above.

What data we process

  1. Company data: name, address, EU VAT number, country.
  2. Contact person data: name, e-mail address, telephone number.
  3. Account data: e-mail address and a password stored only as a hash.
  4. Order data: line items, values, delivery address, payment and shipment documents.
  5. Enquiries: the production inquiry form, requests for quotation, back-in-stock notifications.
  6. Technical data: catalogue search terms, a per-session visit counter and an anonymous counter of interactions on the homepage and product pages (carrying no identifier of a person).
  7. Cookie decisions: a random browser identifier kept in the cookie, the chosen categories, the policy version and the time of the decision — without an IP address.
  8. Where a registration came from, recorded with the company: campaign parameters (utm), the referring domain and the first page visited; an ad click identifier (gclid, fbclid) only with marketing consent.
  9. Marketing consent for each channel (e-mail, WhatsApp/SMS, telephone) together with its history.
  10. An audit log of events and a register of e-mail messages sent; for the account-approval e-mail the register also holds the time its link was first opened.

The visit statistics store no IP address: the session identifier is kept only as a one-way hash that cannot be reversed. We record an IP address in three cases only, as evidence of an action: when the terms are accepted on the registration form, when marketing consent for a channel is given or withdrawn, and in the audit log of operations performed in the admin panel.

We receive most data directly from you. Some company data comes from public registers: the VIES system (the company name and address registered to an EU VAT number) and, for Polish companies whose number VIES does not confirm, also the VAT taxpayer White List and the National Court Register (name, legal form, registered address, VAT status, REGON and KRS numbers).

Purposes and legal bases

Contract performance
Running the account, handling orders, delivery and settlement — art. 6(1)(b) GDPR.
Legal obligation
Issuing and retaining accounting documents and validating the EU VAT number — art. 6(1)(c) GDPR.
Legitimate interest
Service security, abuse prevention, the audit log, evidence of the consents given, verifying the company in public registers, measuring where a registration came from (campaign parameters) and the pursuit of claims — art. 6(1)(f) GDPR.
Consent
Analytics and ad measurement (cookies and the Google and Meta tools) and marketing messages in the channels you choose — art. 6(1)(a) GDPR, and for cookies also art. 399 of the Polish Electronic Communications Law. Consent can be withdrawn at any time, as easily as it was given.

Data recipients

  1. Transactional e-mail provider (Resend) — sending account and order messages.
  2. The European Commission VIES system — validating the EU VAT number given at registration.
  3. Carriers (InPost, DPD Polska) — the data needed to deliver the parcel.
  4. The hosting provider and the accounting office — within the scope of their processing agreements.
  5. The Polish Ministry of Finance (the VAT taxpayer White List) and Ministry of Justice (the National Court Register, KRS) — only a Polish company's NIP, when VIES does not confirm it, to check that the company exists and is an active taxpayer.
  6. Google Ireland Limited (Google Analytics, Google Ads) — only with your consent: visit statistics and measuring how ads perform.
  7. Meta Platforms Ireland Limited (Meta Pixel and the Conversions API) — only with your marketing consent: measuring ads on Facebook and Instagram; at registration and on an order we send one-way hashes (SHA-256) of the company's e-mail address, phone number, country, city and postal code, together with the IP address and browser details.

We do not sell data. Google and Meta receive data only with your consent, as separate controllers for their own services. Both groups may transfer data to the United States (Google LLC, Meta Platforms, Inc.); the basis is the European Commission adequacy decision for the EU-US Data Privacy Framework, in which both companies participate, supplemented by standard contractual clauses. No other transfer outside the European Economic Area takes place.

Retention period

  1. Account and company data (including where the registration came from): for as long as the account exists, and after it is closed until claims become time-barred — as a rule 3 years (art. 118 of the Polish Civil Code).
  2. Orders and settlement documents: 5 years from the end of the calendar year in which the tax payment deadline passed (art. 70 of the Tax Ordinance, art. 74 of the Accounting Act).
  3. Enquiries (production, quotations, back-in-stock notifications): until the matter is closed, then until claims become time-barred (3 years).
  4. Visit statistics: 90 days; the counter of interactions on the homepage and product pages: 180 days; search terms: 365 days; carts not ordered: 180 days, ordered: 30 days — after that the data is deleted automatically.
  5. Cookie decisions: 1095 days from the decision, as proof of consent; then deleted automatically.
  6. Marketing consent: the current decision for as long as it is in force; an earlier decision replaced by a new one for 1095 days after it was replaced, as proof; then deleted automatically.
  7. The audit log: for as long as the service is run, as a security and accountability record (art. 5(2) GDPR); entries are neither modified nor deleted.
  8. Cookies: as in the table below. Data collected by Google Analytics is kept for up to 14 months; Google and Meta keep data in their own services under their own policies.

Cookies

Necessary files always work, because the service does not work without them: the session (staying signed in, the cart, the language choice, protecting forms against CSRF) and the record of your cookie decision. We additionally store, in browser storage, the fact that the welcome dialog was dismissed so that it is not shown again.

The Google and Meta tools are loaded only after you consent in the banner — without consent the browser does not contact their servers. You choose the analytics and marketing categories separately; rejecting is as easy as accepting. You can change your decision at any time through the “Cookie settings” link in the footer; once consent is withdrawn the tools are not loaded on the following pages, and files Google or Meta have already stored can be deleted in your browser settings.

Independently of the banner we keep our own anonymous counters on the server: a per-session visit counter and a counter of interactions on the homepage and product pages. They store nothing on your device and hold no IP address and no identifier that would link two events to the same person.

Name Purpose Lifetime Category
i8-denim-b2b-session Session: staying signed in, the cart, the language choice, form protection (CSRF). 120 min after the last activity Necessary
remember_customer_* Keeps you signed in — only when you tick “Remember me”. 400 days Necessary
i8_zgoda Your cookie-banner decision and a random identifier of that decision. 12 months Necessary
_ga Google Analytics: tells browsers apart in the visit statistics. 2 years Analytics
_ga_* Google Analytics: the state of the current session. 2 years Analytics
_gcl_au Google Ads: measuring conversions from ads. 90 days Marketing
_fbp Meta Pixel: a browser identifier for measuring ads. 90 days Marketing
_fbc Meta: the identifier of the last ad click (fbclid). 90 days Marketing
Cookie settings

Marketing consent

We send commercial information only in the channels your company agreed to — separately for e-mail, WhatsApp/SMS and telephone, as art. 398 of the Polish Electronic Communications Law requires. Nothing is pre-ticked on the registration form. You can change the consents at any time under “My account”, in the “Marketing consent” section — withdrawing is as easy as giving. Every decision is kept with its history (channel, decision, text version, where it was given, IP address and time) as evidence.

Your rights

You have the right to:

  1. access to your data and a copy of it
  2. rectification of inaccurate data
  3. erasure of data
  4. restriction of processing
  5. data portability
  6. objection to processing
  7. withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal

A request sent to the e-mail address above is enough; we reply without undue delay and within one month at the latest. If you believe the processing of your data breaches the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

Whether providing data is required

Providing data is voluntary but necessary to open an account, verify the company and fulfil orders — without it we cannot conclude or perform the contract. Marketing consent and consent to analytics and marketing cookies are entirely voluntary; not giving them does not affect the account or orders.

Automated decisions and profiling

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you (art. 22 GDPR). The VAT number check in VIES and the registers and the opening of the account after registration are automatic; a company whose VAT number could not be confirmed can contact us and a person will review its case. With your marketing consent Google and Meta may use data to tailor ads in their own services.

Terms of Sale Contact