Privacy policy
Data controller
- Controller
- NASEL SP. Z O.O. · NIP PL5223188871
- Address
- EACC HALA B24-26, Nadrzeczna 7A, 05-552 Wólka Kosowska, Polska
- Data contact
- contact@i8denim.pl
- Data protection officer
- To be confirmed — if no DPO has been appointed, a statement to that effect will appear here.
What data we process
- Company data: name, address, EU VAT number, country.
- Contact person data: name, e-mail address, telephone number.
- Account data: e-mail address and a password stored only as a hash.
- Order data: line items, values, delivery address, payment and shipment documents.
- Enquiries: the production inquiry form, requests for quotation, back-in-stock notifications.
- Technical data: catalogue search terms, a per-session visit counter and an anonymous counter of homepage interactions (carrying no identifier of a person).
- An audit log of events and a register of e-mail messages sent.
The visit statistics store no IP address: the session identifier is kept only as a one-way hash that cannot be reversed. We record an IP address in two cases only, as evidence of an action: when the terms are accepted on the registration form, and in the audit log of operations performed in the admin panel.
Purposes and legal bases
- Contract performance
- Running the account, handling orders, delivery and settlement — art. 6(1)(b) GDPR.
- Legal obligation
- Issuing and retaining accounting documents and validating the EU VAT number — art. 6(1)(c) GDPR.
- Legitimate interest
- Service security, abuse prevention, the audit log and the pursuit of claims — art. 6(1)(f) GDPR.
Data recipients
- Transactional e-mail provider (Resend) — sending account and order messages.
- The European Commission VIES system — validating the EU VAT number given at registration.
- Carriers (InPost, DPD Polska) — the data needed to deliver the parcel.
- The hosting provider and the accounting office — within the scope of their processing agreements.
- The document-reading provider (LlamaIndex, EU region) — warehouse documents we upload so their line items can be read.
We do not sell data and do not share it with third parties for marketing purposes. Any transfer outside the European Economic Area requires legal confirmation and will be described here.
Retention period
Account data is kept for as long as the account exists. Accounting documents are kept for the period required by tax law. The audit log is append-only and cannot be modified. Exact periods will be filled in once confirmed by the accounting office.
Cookies
We use only files necessary for the service to work: session cookies (staying signed in, the cart, the language choice) and a token that protects forms against CSRF. We additionally store, in browser storage, the fact that the welcome dialog was dismissed so that it is not shown again.
We use no marketing or tracking files and no third-party analytics tools. We keep only our own anonymous counters on the server: a per-session visit counter and a counter of homepage interactions. They store nothing on your device and hold no IP address and no identifier that would link two events to the same person.
For that reason the service shows no cookie consent banner — consent is not required for strictly necessary files. The scope of that exemption is one of the points awaiting legal confirmation.
Your rights
You have the right to:
- access to your data and a copy of it
- rectification of inaccurate data
- erasure of data
- restriction of processing
- data portability
- objection to processing
A request sent to the e-mail address above is enough. You also have the right to lodge a complaint with the supervisory authority — the exact wording of that notice will be added once legally confirmed.
B2B Wholesale