PRIVACY POLICY

// last updated: 08.10.2026

1. Data Controller

The data controller is HACKERS COFFEE SP. Z O.O., ul. Pulawska 246/9, 02-684 Warsaw, Poland, KRS: 0001127628, NIP: 5214086102, REGON: 529667306.

Contact: [email protected]

2. Data Collected

We collect the following personal data for order processing:

full name,
email address,
phone number,
selected InPost Parcel Locker or delivery address,
billing address (street, postal code, city),
company name and tax ID (NIP) - only when you ask for a company invoice or send a B2B inquiry.

We do not collect any data beyond what is necessary for order fulfillment and legal compliance. We do not process sensitive personal data (e.g. health, biometric, or political data).

3. Purpose and Scope of Processing

fulfilling orders placed in the online store (name, email, phone, delivery/billing address),
processing payments via PayU (payment data is handled directly by PayU S.A. - we do not store card numbers or bank credentials),
organizing delivery via InPost (name, phone, selected locker or courier address),
sending transactional emails - order confirmations, a reminder about an unpaid order, shipping and delivery updates (with a link that puts the same products back into your cart), invoices and digital receipts (email address),
answering B2B inquiries sent through the form on our website (company name, full name, email, phone, message),
handling complaints, returns, and customer support inquiries,
fulfilling legal obligations (e.g. tax documentation, accounting records),
conversion tracking and advertising performance measurement via Google Ads (only with your explicit consent).

4. Legal Basis for Processing

Art. 6(1)(b) GDPR - processing necessary for the performance of a contract (order fulfillment, delivery, customer support) or to take steps at your request prior to entering into a contract (answering a B2B inquiry),
Art. 6(1)(c) GDPR - processing necessary for compliance with a legal obligation (tax and accounting records),
Art. 6(1)(f) GDPR - processing necessary for the purposes of legitimate interests pursued by the controller (claim enforcement, fraud prevention),
Art. 6(1)(a) GDPR - consent (marketing cookies and advertising conversion tracking - you may withdraw consent at any time).

5. Data Retention Periods

Order data: retained as long as needed for order fulfillment and after-sales service (returns, warranty),
Tax and accounting records: retained for 5 years from the end of the tax year in which the transaction occurred, as required by Polish tax law,
Data related to potential legal claims: retained until the statute of limitations expires (typically 6 years for contractual claims under Polish law),
B2B inquiries: until the correspondence ends, no longer than 12 months after the last contact, unless a contract is concluded,
Consent records (cookie preferences): retained for the duration of the consent or until withdrawal,
Data processed based on consent: deleted promptly upon withdrawal of consent.

6. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access (Art. 15 GDPR) - you can request a copy of the personal data we hold about you,
Right to rectification (Art. 16 GDPR) - you can request correction of inaccurate or incomplete data,
Right to erasure (Art. 17 GDPR) - you can request deletion of your data where there is no legal basis for continued processing,
Right to restriction of processing (Art. 18 GDPR) - you can request that we limit how we use your data,
Right to data portability (Art. 20 GDPR) - you can request your data in a structured, machine-readable format,
Right to object (Art. 21 GDPR) - you can object to processing based on legitimate interests,
Right to withdraw consent (Art. 7(3) GDPR) - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at: [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the supervisory authority: Prezes Urzedu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

7. Data Recipients and Third-Party Processors

Your personal data may be shared with the following categories of recipients, solely for the purposes described above:

PayU S.A. (ul. Grunwaldzka 186, 60-166 Poznan, Poland) - payment processing. PayU acts as an independent data controller for payment data. See PayU's privacy policy,
InPost SP. Z O.O. (ul. Wielicka 28, 30-552 Krakow, Poland) - parcel delivery and logistics,
Resend, Inc. (USA) - transactional email delivery (order confirmations, shipping notifications),
Cloudflare, Inc. (USA) - website security (DDoS protection), content delivery network (CDN), and DNS,
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) - advertising conversion tracking (only with your explicit consent via cookie banner).

8. International Data Transfers

Some of our third-party processors (Resend, Cloudflare) are based in the United States. These transfers are safeguarded by:

the EU-US Data Privacy Framework (where the recipient is certified), or
Standard Contractual Clauses (SCCs) adopted by the European Commission.

We ensure that all international transfers provide an adequate level of data protection in compliance with Chapter V of the GDPR.

9. Cookies and Tracking Technologies

Necessary cookies (always active):

Cart storage - remembers products you've added during your session,
Cookie preference - stores your cookie consent choice,
Theme preference - remembers your light/dark mode selection,
Last chosen InPost Parcel Locker - so you do not have to find it on the map again next time (stored only in your browser, sent to our server only when you place an order).

Marketing cookies (with consent only):

Google Ads conversion tracking - measures advertising effectiveness. These cookies are only set if you click "Accept all" in the cookie banner.

Choosing "Essential only" prevents any marketing cookies from being set. You can change your preference at any time by clearing your browser cookies and revisiting the site.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

11. Children's Data

Our store is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Third-Party Links

Our website may contain links to third-party websites (e.g. PayU payment gateway, InPost tracking). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

HTTPS encryption for all data in transit,
Cloudflare DDoS protection and WAF (Web Application Firewall),
restricted access to personal data on a need-to-know basis,
regular security reviews of our systems and processes.

14. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last updated" date. For significant changes, we may notify you via email. We encourage you to review this policy periodically.