CUDOVERO
Privacy Policy.
This Privacy Policy is addressed to users visiting the website www https://www.cudovero.com and using the services available on it, such as the online shop and the contact form.
Hereinafter, the website together with its related services shall be collectively referred to as the Service. This Policy describes the rules for collecting and using the data of Service users, which is gathered directly from them or through cookies and similar technologies.
Data controller and contact details.
The controller of the data processed in connection with the use of the Service is DNL Equity Partners Sp. z o.o., with its registered office in Gdynia [81-389], ul. Świętojańska 87, KRS 0000989577, NIP 586-238-41-13, REGON 523009944, contact details: tel. +48 794 665 579.
You can contact the Controller by email: kontakt@cudovero.com or in writing at: 81-389 Gdynia, ul. Świętojańska 87.
Scope of data collected
During a visit to the Service, data related to activity is collected automatically, such as the time spent on the site, searched phrases, the number of subpages viewed, and the date and source of the visit.
A user may provide their data in order to register an account in the online shop. The form requires identification and contact details to the extent necessary to use the account and complete purchases. Additional data may also be provided, but it is optional. The user's account will record their orders, favourite products, payment history, complaints, etc.
In the case of purchases without registering an account, the user provides the data necessary to purchase, pay for and receive the order.
The Service makes it possible to contact the Controller and provide identification and contact details, as well as data related to the content of the message.
With the user's consent, their contact and/or analytical data may be collected for marketing purposes.
Processing for analytics purposes
The Service uses Google Analytics tools, which collect information about users' visits, including the time spent on the site, the subpages visited, and the source of the visit.
A user can block Google Analytics by installing the plugin provided by Google: https://tools.google.com/dlpage/gaoptout
Source of data
1. We collect data directly from users.
2. A user may provide the data of another person authorised to receive their order — in which case they are the source of the order recipient's data.
Purpose and legal basis for processing personal data
The data may be processed for the purpose of:
analysing network traffic, ensuring security within the Service and tailoring content to users' needs, on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR);
answering questions, providing a requested offer and conducting correspondence in order to handle a matter, on the basis of consent and the Controller's legitimate interest, which is fulfilling users' requests (Article 6(1)(a) and (f) GDPR);
setting up and using an account in the online shop, on the basis of a contract for the provision of electronic services concluded with the user as the service recipient (Article 6(1)(b) GDPR);
making purchases in the online shop, on the basis of a distance contract (Article 6(1)(b) GDPR);
handling complaints, on the basis of the seller's legitimate interest (Article 6(1)(f) GDPR);
promoting goods and services or providing an offer, on the basis of the user's consent (Article 6(1)(a) GDPR).
Right to withdraw consent
Where consent is the basis for processing data, it may be withdrawn at any time using the contact details available in the Service. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
Obligation or voluntariness of providing data
Providing data is voluntary but necessary. Failure to provide it will prevent, respectively:
fulfilling an order;
setting up an account in the online shop;
handling a complaint;
receiving an offer or requested marketing materials;
receiving an answer to a question asked.
Providing the data necessary for statistical analysis of Service users is voluntary. You may use what is known as incognito mode to browse the site without sharing information about your visit with the Controller. Using incognito mode, and therefore not providing data, does not affect your ability to use the Service.
Rights under the GDPR regarding processed data
Every Service user has the right to:
request access to their data from the Controller, as well as to obtain a copy of it (Article 15 GDPR);
request that the Controller rectify or correct the data (Article 16 GDPR) — as regards a rectification request, when they notice that the data is incorrect or incomplete;
request that the Controller erase the data (Article 17 GDPR);
request that the Controller restrict processing (Article 18 GDPR) — e.g. when they notice that the data is incorrect, they may request restriction of the processing of their data for a period allowing us to verify the accuracy of that data;
The user has the right to withdraw consent at any time, if the processing is based on consent.
At any time, you have the right to lodge a complaint with the President of the Personal Data Protection Office (www.uodo.gov.pl) regarding the processing carried out by the Controller.
Recipients of personal data
The recipients of personal data may only be entities authorised to receive it under the law (e.g. the Police or a court, in connection with ongoing proceedings). In addition, the data may be made available to couriers, postal operators, the hosting provider and the mail server provider.
Recipients of the data may be entities providing IT services to the Controller and the provider of the Google Analytics tools — Google Ireland Ltd.
Data retention period
Personal data will be stored:
in the case of setting up an online account, for the period of use, and after it is closed the Controller will store billing data for 5 years following the year in which the tax obligation related to the order arose;
relating to settlements, for 5 years following the year in which the tax obligation related to the order arose;
until consent is withdrawn or until the matter is resolved, and then until the limitation period for the parties' claims related to its performance expires;
in the case of complaints, until any potential claims become time-barred;
data related to network traffic analysis collected through cookies and similar technologies may be stored until the cookie expires. Some cookies never expire, therefore the data retention period will be equivalent to the time necessary for the Controller to achieve the purposes related to data collection, such as ensuring security and analysing historical data related to site traffic.
Transfer of data to a third country or international organisation
Users' data may be transferred outside the European Economic Area (EEA), in particular to Google LLC, based in the USA.
Google LLC participates in the EU-US Data Privacy Framework, which the European Commission has recognised as ensuring an adequate level of personal data protection (European Commission decision of 10 July 2023).
In situations where data would be transferred to third countries not covered by a European Commission adequacy decision, the Controller applies appropriate safeguards, such as standard contractual clauses (in accordance with Article 46 GDPR).
A user may obtain a copy of the safeguards relating to the transfer of data outside the EEA by sending a request to the Controller's address.
Final provisions
This Policy is effective from 1 October 2025.
The Controller reserves the right to make changes to the Privacy Policy in connection with technological developments, changes in the law, or the expansion of the Service's functionality.
The user will be informed of any change to the Policy by its re-publication in the Service and an appropriate notice.