privacy policy

Online store privacy policy – ​​comprehensive support in the field
data protection

A privacy policy is a key document for every online store. It defines the rules for processing user personal data and ensures compliance with applicable regulations, including the General Data Protection Regulation (GDPR). A properly drafted privacy policy helps avoid legal penalties and build customer trust.

I. Why is a privacy policy so important?

Privacy policies play a key role in the functioning of businesses, especially those operating online, as they define the rules for processing the personal data of customers, users, and contractors. They are not only a legal requirement but also a foundation of trust and security in the relationship between the business and its service users.

Why is a privacy policy necessary?

1. Compliance with legal regulations

Any entity that collects, stores, or processes personal data must operate in accordance with applicable legal regulations. The primary legal act in this regard is:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) –
  it imposes on data controllers the obligation to transparently inform users about how their data is processed and to provide them with appropriate rights, such as the right to access, rectify or delete data,
• national regulations on personal data protection – in Poland, these are the Personal Data Protection Act of 10 May 2018 and industry regulations governing the principles of data processing in specific sectors (e.g. banking or medicine),
• Act on the provision of electronic services – regulates the principles of data processing in the context of Internet activities.

The absence or inappropriate privacy policy of an online store may result in a violation of the above regulations, which in turn leads to serious legal and financial consequences.

2. Protection against sanctions and legal consequences

Failure to comply with applicable regulations may result in significant financial penalties and legal liability. For example:

• The GDPR provides for fines of up to €20 million or 4% of the company's annual worldwide turnover, whichever is higher.
• In addition to financial penalties, companies may face claims from customers or contractors if their privacy rights are violated.
• In extreme cases, entrepreneurs may be held criminally liable for gross violations of data protection regulations.

A well-prepared privacy policy minimizes the risk of sanctions and allows entrepreneurs to avoid costly lawsuits.

3. Credibility and transparency in relations with users

A privacy policy is not only a legal obligation but also a tool for building trust among customers and users. More and more people are paying attention to how their data is processed and who has access to it. Transparency in this regard:

• increases the loyalty of customers who are more willing to use the services of companies that care about their privacy,
• strengthens the brand's reputation, which can translate into a competitive advantage in the market,
• minimizes the number of inquiries and notifications regarding data processing, because users know what rights they have and how they can manage their data.

The lack of clear data protection rules can lead to a loss of trust, which negatively affects the company's image.

4. Protection against leaks and unauthorized access to data

The privacy policy also outlines the organizational and technical measures the company uses to protect personal data from breaches. These include:

• principles of data storage and processing – specifying how long data is stored and in what cases it can be deleted,
• security measures – e.g. data encryption, password policies, access control to IT systems,
• incident response procedures – actions a company takes in the event of a data leak or cyberattack.

Lack of proper procedures can lead to serious security incidents, such as customer identity theft or sensitive data leaks, resulting not only in legal penalties but also reputational damage.

II. Scope of the privacy policy

An online store's privacy policy should include:

1. Information about the data controller

The data controller is the entity that determines the purposes and methods of processing the personal data of our store users. As part of our privacy policy, we provide:

• full name and registration details of the administrator.
• contact details enabling users to contact us in matters relating to the protection of their personal data (e.g. e-mail address, telephone number, details of the data protection officer, if appointed).
• information about the scope of the administrator's responsibility for data processing and protection.

This allows users to know who is responsible for their data and how they can obtain information about its processing.

2. Purpose of data processing

The privacy policy specifies:

• What personal data do we collect ? This may include your name, email address, phone number, shipping address, bank account number, and billing information.
• Data processing purposes – for example:
  • fulfillment of orders and delivery of purchased products,
  • payment processing and accounting,
  • maintaining a user account in the store,
  • sending commercial and marketing information (e.g. newsletters), provided that the user has consented to it,
  • providing technical support and handling complaints,
  • statistical analysis and optimization of online store operations.

Clearly defining the scope and purpose of processing allows users to understand why their data is collected and how it is used.

3. Legal basis for processing

All operations involving personal data must have a legal basis under applicable law. The privacy policy includes references to:

• Article 6 of the GDPR, which specifies the permissible grounds for data processing, e.g.:
  • the necessity to perform the contract (e.g. data processing for the purpose of order fulfillment),
  • legal obligations of the administrator (e.g. storing invoices in accordance with tax regulations),
  • user consent (e.g. to send a newsletter),
  • the legitimate interest of the administrator (e.g. monitoring traffic in the online store for analytical purposes).
• Other national laws that regulate data protection in the context of e-commerce, telecommunications and marketing.

Providing legal bases provides users with greater awareness of the processing of their data.

4. Recipients of personal data

In some cases, user data may be shared with other entities. The privacy policy provides information about who may receive the data and for what purpose. Typical recipients include:

• courier and postal companies – to deliver the ordered products,
• payment service providers – enabling online transactions,
• hosting companies and IT infrastructure providers – storing data in the cloud or on the administrator's servers,
• entities providing marketing services – if the user has agreed to receive commercial information,
• public administration bodies – if required by law (e.g. tax offices, law enforcement agencies).

The Administrator ensures that data is transferred only to the extent necessary to achieve specific purposes and in accordance with applicable legal regulations.

5. User rights

Every user whose data is processed has a number of rights under the GDPR. The privacy policy explains what rights they have and how they can exercise them. The most important include:

• the right to access data – the user may request information about the processing of his or her data and receive a copy thereof,
• the right to rectify data – if the data is incorrect or outdated, the user has the right to correct it,
• the right to delete data ("the right to be forgotten") – in certain cases, the user may request the deletion of his or her data,
• the right to restrict processing – e.g. in the event of questioning the accuracy of the data being processed,
• the right to data portability – the user may request the transfer of his or her data to another entity,
• the right to object to processing – e.g. in the case of data processing for marketing purposes,
• the right to withdraw consent – ​​if data processing is based on consent, the user may withdraw it at any time.

The privacy policy should also indicate how the user can exercise these rights – e.g. by contacting the administrator.

6. Cookie Policy

Cookies are small files stored on user devices that enable the website to function properly and be optimized. The privacy policy includes information on:

• types of cookies used (e.g. mandatory session cookies and optional analytical and marketing cookies),
• the purposes of their use, e.g. content personalization, website traffic analysis, functionality improvement,
• how to manage cookies – how the user can disable them or configure their preferences.

According to the regulations, users must be able to consciously consent to the use of cookies and configure them.

Why is it worth using the help of our team?

We offer professional support in the following areas:

✔ creating a privacy policy from scratch – adapting the document to the specifics of your store.

✔ updating the existing policy – ​​adapting to new legal and technological requirements.

✔ advice on personal data protection – legal support in the event of audits or user complaints.

Ensure secure data processing in your online store and avoid legal risks. Contact us for professional assistance.