Privacy policy

To keep the processing of personal data transparent, we set out below the data protection rules that apply on miboxer.eu, established under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).

I. Data controller

The controller, i.e. the entity that decides on the purposes and means of processing personal data, is:

EU VAT number: the NIP number above with the prefix PL.

In matters relating to the processing of personal data you can also contact us by e-mail: .

II. Collection of data and purposes of processing

In the course of our business we process personal data for various purposes and to various extents, including:

Newsletter

Purpose of processing:
– sending the newsletter, i.e. commercial information about our products and promotions, by e-mail;
– direct marketing of our own products and services.

Legal basis:
– Art. 6(1)(a) GDPR in conjunction with Art. 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) — your consent to receive commercial information by e-mail, given when subscribing. Consent is required for every subscriber, including businesses and their employees;
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller, which is direct marketing of its own products and services.

Your choices:
– you can withdraw consent at any time, e.g. by an e-mail to the address given in section I — we will then stop sending the newsletter; withdrawal does not affect the lawfulness of processing before it;
– independently of withdrawing consent, you can object at any time to the processing of your data for direct marketing (Art. 21(2) GDPR) — after an objection we no longer process your data for this purpose.

Retention period:
– until consent is withdrawn or an objection is raised;
– after that, only the e-mail address and the dates and content of the consent, its withdrawal or the objection are kept, to demonstrate compliance (Art. 5(2) and 7(1) GDPR) — until the limitation periods for related claims expire.

Business account application (VAT number and e-mail address) — prospective customers

Purpose of processing:
– contacting you about opening a business account in the online shop, after you submit the form on the website;
– running the business account.

Legal basis:
– Art. 6(1)(b) GDPR, i.e. processing necessary to take steps at your request before entering into a contract and to provide the service of running an account in the online shop — where the applicant or account holder is a natural person running a business;
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller in opening and running an account for the business you represent — where you apply or use the account as an employee or associate of that business (the contract is concluded with the business, so it concerns you only indirectly).

Retention period:
– until the account is closed (at your request or ours), and after that until the limitation periods for claims related to the account expire;
– an application that does not lead to opening an account is deleted from the website 1 year after it was submitted.

Orders — customers

Purpose of processing:
– performance of the contract with the customer;
– meeting accounting and tax obligations;
– establishing, pursuing and defending claims.

Legal basis:
– Art. 6(1)(b) GDPR, i.e. processing necessary for the performance of the contract — where the customer is a natural person running a business;
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller in performing the contract concluded with the business you represent — for employees and associates of customers (e.g. the person placing the order or receiving the delivery);
– Art. 6(1)(c) GDPR, i.e. the controller’s legal obligations in accounting and tax settlements;
– Art. 6(1)(f) GDPR, i.e. the legitimate interests of the controller in establishing, pursuing and defending claims.

Retention period:
– for the duration of the contract and, after it ends, until the limitation periods for claims arising from it expire, and for the periods required by tax and accounting law (in Poland, as a rule, 5 years from the end of the year in which the tax obligation arose).

Verification of the EU VAT number in VIES

Purpose of processing:
– checking whether the EU VAT number given in an order or a business account application is active, before an intra-Community supply is invoiced at the 0% VAT rate.

Legal basis:
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller in verifying the counterparty and correctly applying the VAT rate.

Categories of data and source (Art. 14 GDPR):
– we obtain from the VIES system (VAT Information Exchange System) run by the European Commission on the basis of data from the national tax administrations of the Member States only the status of the VAT number you have given — active or not active. Where the business is run by a natural person, this status is personal data;
– VIES is a publicly available source.

Retention period:
– the result of the check is kept by the shop for up to 24 hours (status “active”) or 1 hour (status “not active”); if VIES is unavailable, a note to check the number again is added to the order and kept with the order (see “Orders — customers”).

Complaints, claims and enquiries submitted by e-mail or via the website

Purpose of processing:
– handling complaints and claims under the contract (warranty);
– replying to requests and enquiries sent by e-mail or via the website.

Legal basis:
– Art. 6(1)(b) GDPR, i.e. processing necessary for the performance of the contract — complaints and claims of customers who are natural persons running a business;
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller in handling complaints and claims under contracts with the businesses you represent, in establishing, pursuing and defending claims, and in replying to enquiries related to its business.

Retention period:
– complaints and claims: as for orders — for the duration of the contract and, after it ends, until the limitation periods for claims arising from it expire;
– enquiries not related to a contract: 1 year after replying.

Negotiating and performing contracts with business partners (employees and associates of business partners, and business partners who are natural persons)

Purpose of processing:
– concluding and performing the contract with the business partner.

Legal basis:
– Art. 6(1)(b) GDPR, i.e. processing necessary for the performance of the contract — for business partners who are natural persons;
– Art. 6(1)(c) GDPR, i.e. the controller’s legal obligation in connection with the contract, in particular in accounting and tax settlements;
– Art. 6(1)(f) GDPR, i.e. the legitimate interests of the controller in enabling the conclusion and performance of the contract — for employees and associates of the business partner;
– Art. 6(1)(f) GDPR, i.e. the legitimate interests of the controller in establishing, pursuing and defending claims arising from the contract.

Retention period:
– until the limitation periods for claims arising from the contract expire;
– until the retention periods required by law expire;
– until an effective objection is raised (where processing is based on the controller’s legitimate interest).

Server logs

Purpose of processing:
– ensuring the operation and security of the website, detecting and diagnosing faults and abuse.

Scope:
– IP address, date and time of the request, requested address, response code, browser information (user agent).

Legal basis:
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller in the security and proper operation of the website.

Retention period:
– for the period necessary for these purposes, after which logs are deleted in regular rotation; longer only where a log is needed to establish, pursue or defend claims.

Essential cookies

Purpose of processing:
– running the shop: the shopping cart and logging in to the account (section VIII).

Legal basis:
– Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller in providing the service you request; storing these cookies does not require consent, as they are strictly necessary (Art. 399 of the Polish Electronic Communications Law).

Retention period:
– for the lifetime of the cookie: session cookies until the browser is closed, login until logging out or the session expires.

III. Recipients of data

In connection with its business, the controller will disclose your personal data to the following:

a) public authorities or other entities authorised by law — where necessary to meet legal obligations;
b) entities supporting our business on our behalf, in particular providers of IT systems and hosting, subcontractors, auditors, experts, carriers delivering orders, or entities cooperating with the controller in marketing campaigns — such entities process data under a contract with the controller and only on its instructions;
c) the European Commission’s VIES system — the EU VAT number is sent to it in order to check its status;
d) banks — where settlements are necessary;
e) providers of accounting or legal services — to the extent necessary to meet legal obligations or to establish, pursue and defend claims;
f) companies disposing of or archiving documents and other media — to the extent data is stored on paper or such media.

IV. Rights of data subjects

Every person whose data is processed by the controller has the right to:

a) access their personal data;
b) rectify their personal data;
c) erase their personal data;
d) restrict the processing of their personal data;
e) object to the processing of their personal data where it is based on the controller’s legitimate interest (Art. 21(1) GDPR), and — at any time and without giving reasons — object to processing for direct marketing (Art. 21(2) GDPR);
f) data portability;
g) where processing is based on consent — withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

In addition, a data subject has the right to lodge a complaint with a supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Poland) or the supervisory authority in the Member State of their habitual residence or place of work.

V. Do you have to provide your personal data?

Providing data is necessary to conclude and perform sales contracts and to settle the business, and for the controller to meet its legal obligations. This means that to use the offer presented on miboxer.eu you must provide your personal data.

Otherwise (in particular for marketing purposes) providing data is voluntary.

VI. Transfer of data to third countries or international organisations

Data is processed within the European Economic Area, i.e. as a rule we do not transfer data to third countries. A transfer may occur in the context of the IT infrastructure used by the controller. In such cases data is transferred only with the safeguards required by the GDPR.

VII. Automated processing of personal data

Personal data will not be processed in a way that leads to automated decision-making producing legal effects or otherwise significantly affecting the persons whose data we process.

VIII. Cookies

The shop uses only essential cookies needed for it to work: the shopping cart and logging in to the account. They do not require consent. We do not use analytics or advertising cookies.

You can also configure your web browser to delete or block cookies, or to warn you each time before they are stored.

IX. Changes to the privacy policy

The data controller reserves the right to amend this Privacy Policy, after prior notice of the changes and after setting an appropriate date from which the changes to this Privacy Policy will apply.