Privacy policy

Version dated October 12, 2026 The WIT Store Privacy Policy explains what data we process in connection with the website artykuly-poligraficzne.pl, the WIT store, communications, and our newsletter. Providing data for an order does not constitute consent to receive advertising.

1. Controller and contact information

The data controller is Radosław Witan, conducting business under the name Przedsiębiorstwo Handlowe WIT Radosław Witan, Konwaliowa 7, 03-194 Warsaw, Tax ID (NIP) 5222797421. For matters concerning personal data, please contact us: [email protected], by phone +48 22 882 44 88 or in writing at the address provided.

GDPR regulations protect the data of natural persons — including sole traders, as well as employees, representatives, and contact persons of companies.

2. Where data comes from and what data we collect

• From you: Data provided during a purchase, account registration, communication, filing a complaint, exercising a right of withdrawal, or subscribing to our newsletter. This includes your first name, last name, email address, phone number, billing and delivery addresses, company name and tax identification number (NIP), order details, chosen carrier and pickup point, the content of correspondence, and any attachments you choose to provide.
• From the fulfillment of a purchase: Products, quantities, prices, order number, pro-forma invoice and sales document numbers, payment status and method, payment confirmation, shipment tracking number, and information required for processing refunds. We do not offer card payments and do not collect card numbers or CVV codes.
• From your device: IP address, date and time of connection, requested page URL, basic information about your browser and operating system, as well as records of errors or security breaches stored in logs. Cookies are described in section 6.
• From other individuals or entities: If a customer designates a different recipient, or if a company provides a contact person, we receive that individual’s identification and contact details, as well as the delivery address. From your bank or the payment service provider used, we receive payment confirmation and an identifier necessary for reconciliation; from the carrier, we receive the delivery status. Company details may be verified against public registers if necessary for proper accounting or to establish eligibility.

We do not require a PESEL number, a scan of your national ID card, or health-related data for standard purchases. Please do not send such information in your messages unless it is strictly necessary for a specific matter. If there is any doubt regarding your identity when you exercise your rights, we may request only the proportionate information needed to confirm it.

Data marked as “required” is necessary to carry out the selected action. Failure to provide this data may prevent you from placing or fulfilling an order, creating an account, or receiving a response. Providing optional data, creating an account, or subscribing to the newsletter is entirely voluntary. You may also make purchases as a guest.

3. Purposes and legal bases for processing

• Orders and sales contracts: Accepting an offer, communicating regarding order fulfillment, preparing goods, delivery, and processing payments — based on Article 6(1)(b) of the GDPR (i.e., taking steps at your request prior to entering into a contract, and the performance of that contract). If you are acting solely as a representative of a company that is a party to the contract, the legal basis is Article 6(1)(f) of the GDPR: our legitimate interest in communicating with a business partner and fulfilling their order.
• Customer account: Registration, logging in, setting a password, and accessing your data and order history — based on Article 6(1)(b) of the GDPR. Having an account is not a prerequisite for making a purchase.
• Sales documents, taxes, and accounting: Issuance and storage of documents, as well as required accounting/tax settlements — Article 6(1)(c) of the GDPR, in conjunction with applicable tax and accounting regulations.
• Complaints, withdrawals, and returns: Fulfillment of obligations arising from the contract and the law — Article 6(1)(b) and (c) of the GDPR, respectively. Retention of documentation to evidence the handling of a case, and the pursuit or defense of legal claims — Article 6(1)(f) of the GDPR (our legitimate interest in legal protection).
• Contact: Responding to inquiries regarding a purchase at your request — Article 6(1)(b) of the GDPR. Other correspondence and communication with company representatives — Article 6(1)(f) of the GDPR (our legitimate interest in providing responses and handling matters).
• Newsletter and voluntary marketing: Article 6(1)(a) of the GDPR (your consent), as well as prior consent to receive commercial communications in accordance with Article 398 of the Electronic Communications Law. Neither the act of making a purchase nor the acceptance of the terms and conditions constitutes such consent.
• Security, proper website functionality, and prevention of abuse: Essential logs, access control, form protection, error diagnosis, and backups — Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring data security and service continuity. We use essential cookies in accordance with the exemption provided for in Article 399, paragraph 3 of the Electronic Communications Law.

We apply legal bases specific to each given purpose; we do not substitute a withdrawn consent with another legal basis in order to continue the same marketing activities. Communications regarding order fulfillment, payments, complaints, or withdrawals from a contract do not constitute a subscription to a newsletter.

Data related to product reviews

Submitting a review is voluntary. We process your account identifier, display name, email address, purchase confirmation information, the content of the review, the rating, the date, and the moderation status. We cross-reference your email address or account identifier with orders containing the product being reviewed. The author’s display name, the content of the review, the rating, and the date are made public; the email address and order details remain private. You may use a custom public display name instead of your full legal name by updating your account details before submission.

The processing and publication of reviews at your request are based on Article 6(1)(b) of the GDPR—the provision of a review service. Moderation, authenticity verification, spam prevention, and the handling of reports are based on Article 6(1)(f) of the GDPR: our legitimate interest in ensuring the credibility of reviews and protecting our users. The system also records necessary technical information, including your IP address and browser data, to protect against misuse. The form’s security mechanism does not utilize an external CAPTCHA service.

We retain the review and the author’s data for as long as the review remains published or while a report concerning it is being processed. Once a review is removed, we retain only the documentation necessary to conclude the matter and protect against potential legal claims, for the duration of the applicable statute of limitations. You may submit a request for deletion or exercise other rights as described in Section 8. Order data may be stored separately in accordance with the terms set out in Section 7. Rules for the verification and moderation of reviews are specified in the Terms and Conditions.

4. Who we share data with

Data is shared only with entities that require it for the stated purpose, and only to the extent necessary:

• providers of hosting, email, website maintenance, backup services, and IT support — for the operation and security of our systems;
• the accountant or accounting firm serving WIT — data necessary for documentation and financial settlements; as well as legal advisors and authorized public authorities, where required;
• InPost for courier and parcel locker (Paczkomat) shipments, as well as the selected pallet carrier — the recipient’s full name or company name, address or collection point, contact details, and shipment information (including the amount due, in the case of cash-on-delivery shipments);
• banks handling transfers and settlements; and, for online payments (once this method is enabled and selected) — Krajowy Integrator Płatności S.A. (Tpay), — to the extent necessary to process the transaction and provide confirmation;

Service providers acting on our behalf process data based on appropriate data processing agreements and instructions. Banks, payment service providers, carriers, or public authorities may also act as independent data controllers with respect to their own statutory obligations and services; their respective privacy notices apply to such processing. We do not sell customer data. We do not transfer our entire customer database to newsletter services or advertising platforms simply because a purchase has been made.

5. Newsletter and local subscriber database

The newsletter contains information from WIT regarding products, offers, and materials related to the printing industry. To subscribe, we require an email address and your voluntary consent. Subscription requires confirmation of the email address via a link sent in an email. We also retain data necessary to demonstrate that a subscription and consent were provided—such as the date, the content or version of the consent, and confirmation details. The system may also record the IP address associated with the subscription, to the extent necessary for security purposes and to document the subscription process.

We maintain our subscriber database within our WordPress installation using “The Newsletter Plugin.” Newsletters are sent via the email service associated with our website. The data remains within the WIT database and is accessible to our hosting and email service providers only to the extent necessary for the provision of these services, as described in Section 4. Currently, we do not transfer subscriber data to GetResponse or any advertising platforms. Should we implement an external system in the future, we will update the information regarding recipients and data transfers before any such data is shared.

You may withdraw your consent and unsubscribe at any time by using the unsubscribe link provided in our emails or by contacting us at [email protected]. Withdrawal is free of charge and does not affect the lawfulness of processing based on consent before its withdrawal, nor does it impact the handling of purchases. Simply providing an email address in an order or contact form does not constitute a subscription.

Tracking of newsletter opens and clicks is disabled. Should we implement such tracking for a specific recipient, we will disclose its scope and obtain the necessary consents beforehand. Consent to receive the newsletter does not constitute blanket consent for tracking, advertising on other websites, or sharing data with Google or Meta.

Links to other websites lead to pages managed by their respective owners. Once you navigate to these external sites, their own privacy policies apply.

6. Cookies and analytical tools

Cookies are small pieces of information stored in your browser. Similar functions may utilize local or session storage. We use essential technologies to provide requested services—primarily for maintaining your shopping cart, managing sessions, handling logins, and ensuring security. These technologies do not, in themselves, constitute consent for advertising.

• woocommerce_cart_hash i woocommerce_items_in_cart — information regarding the contents of or changes to the shopping cart; typically lasts for the duration of the session.
• wp_woocommerce_session_* — a session identifier used to retrieve shopping cart data within the store; typically lasts up to 2 days.
• wordpress_logged_in_* i wordpress_sec_* — identification of a logged-in user and secure authentication; duration depends on the session and the user’s choice to remain logged in.
• wordpress_test_cookie — verification of cookie support during login; lasts for the duration of the session. wp-settings-* i wp-settings-time-* These may store interface preferences for a logged-in user, typically for up to one year.

Not every user receives all of the listed cookies; this depends on the features used—for example, accessing the shopping cart or logging in. Session cookies generally expire when the browser session ends, while persistent cookies remain until a specified time has elapsed or they are deleted.

Status as of the date of this version: Google Analytics, Google Ads tags, and the Meta pixel are not active in the store. Tracking of traffic sources and campaigns via WooCommerce order attribution is disabled. Sales statistics—generated based on order data—remain available in the dashboard; this does not constitute consent for browser-based tracking.

Implementing planned analytics and advertising features will require an update to this information, as well as a mechanism that allows users to separately accept or reject optional technologies and subsequently change their preferences. At that time, we will provide details regarding providers, purposes, the scope of data collected, retention periods, and data transfer policies. Optional tags may not be activated without the necessary consent. Refusing consent must not prevent users from completing purchases. We do not consider continued browsing, clicking on a link, or accepting the terms and conditions as consent for such tracking.

You can review, delete, or restrict cookies through your browser settings. Blocking essential cookies may interfere with the functionality of the shopping cart or your user account. Deleting cookies does not remove order-related documents stored on the WIT side. Browser settings do not exempt us from the obligation to obtain the required consent for the use of optional technologies.

7. How long we store data

We do not store data indefinitely simply because the system allows for it. The retention period depends on the purpose and applicable legal requirements; once this period expires, we either delete or anonymize the data, while retaining any necessary documentation.

• Contracts and orders: For the duration of the fulfillment process, and subsequently for as long as required to meet statutory obligations or until the relevant limitation periods for claims have expired. These periods may vary depending on the specific claim; we apply the appropriate period for each case rather than a uniform retention period for all data.
• Tax documentation: Generally, for 5 years from the end of the year in which the tax payment deadline occurred; specific regulations concerning accounting records or documents may prescribe a different method for calculating this period. This duration may be extended, for example, in the event of a suspension or interruption of the limitation period, or due to ongoing legal proceedings.
• Account: For the duration of the account’s existence. Once the service is terminated, we delete any data that is not required for other legitimate purposes. Sales documents and data necessary for potential claims may be retained independently of the account.
• Contact, complaints, and withdrawals: until the matter is concluded, and subsequently only to the extent necessary to document the course of the matter, legal obligations, or claims, until the expiration of the relevant time limits.
• Newsletter: until you opt out, withdraw your consent, or the service is terminated. We may retain minimal evidence of your consent and its withdrawal, as well as information to prevent further communications, when necessary to demonstrate compliance or defend against legal claims—based on a legal obligation or our legitimate interests—for an appropriate period.
• Logs and backups: for the time necessary for security, diagnostics, and system recovery, taking into account the rotation cycle of the specific system. Logs related to a specific incident may be retained until the incident is resolved and any associated claims are settled. Backups are not used for remarketing or for the routine processing of data that has already been removed from the active system.
• Cookies: for the duration of the session or the specific period for each cookie as described above; users may delete them at any time.

8. Your rights

Within the limits set out in the GDPR, you have the right to:

• access your data and receive a copy thereof;
• rectify or complete your data;
• erase your data—when there is no longer a legal basis for its retention; this right does not apply to documents that we are legally required to retain;
• restrict the processing of your data;
• data portability for information processed automatically based on your consent or a contract, to the extent provided by law;
• to object to processing based on Article 6(1)(f) of the GDPR on grounds relating to your particular situation. In such a case, we will cease such processing unless we can demonstrate compelling legitimate grounds or grounds related to legal claims;
• to object to direct marketing, including any related profiling — at any time, without the need to provide a justification;; once you have objected, we will no longer use your data for such marketing purposes;
• to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Please send your request to [email protected] or in writing to the address of WIT. We will respond without undue delay, generally within one month. In cases provided for by law, we may extend this period by an additional 2 months, in which case we will inform you of the reasons for the extension within the first month. In principle, the exercise of these rights is free of charge; exceptions for requests that are manifestly unfounded or excessive are set out in the GDPR.

You may lodge a complaint with the President of the Personal Data Protection Office. Up-to-date contact details and information on how to lodge a complaint can be found at uodo.gov.pl. You are not required to obtain our prior consent or to exhaust the store’s internal complaint procedure.

9. Automation and Security

We do not make decisions concerning our clients that are based solely on automated processing—including profiling—which produce legal effects or similarly significantly affect an individual. Automated processes such as calculating the contents of a shopping cart, sending pro forma invoices, issuing payment reminders, or confirming the status of an order do not constitute such decisions. Any planned use of automated processing for the purpose of tailoring advertising communications requires separate notification and an appropriate legal basis before implementation.

We employ encrypted HTTPS connections, access controls, and system protection tools. Account passwords are not stored in plain text. Access to data is restricted to authorized personnel and entities necessary for service provision. No system can provide an absolute guarantee of security; please do not share your password and report any suspected unauthorized access.

10. Scope and Policy Updates

This policy covers data processing carried out by WIT for the purposes described herein. It does not replace the terms and conditions or privacy notices provided by independent data controllers whose websites you may visit via links from our platform. Any changes to the tools, purposes, recipients, or legal bases for processing require that this information be updated accordingly before such new processing begins. Please note that updating this page does not, in itself, constitute consent where such consent is required.

Terms of sale are described in Terms and conditions, while the policy for returns and complaints can be found on the Returns and Complaints page.