This page explains what we do with your data when you buy at spawlab.pl, write to us, sign up for the newsletter or simply browse the shop. Without legal jargon wherever we can manage without it.
Who is the controller
The controller of your data is Spawlab Jarosław Kołaski, a business entered in the Polish business register (CEIDG), ul. Akacjowa 15, 63-700 Krotoszyn, Poland, NIP 6211721099, REGON 302440337.
Contact about data: e-mail kontakt@spawlab.pl, telephone +48 669 162 833, or by post to the address above. We have not appointed a data protection officer, because the scale of processing does not require one.
Why and on what basis we process data
| Purpose | Legal basis | How long |
|---|---|---|
| Order, delivery, handling the contract | Article 6(1)(b) GDPR, performance of the contract | until the end of the contract, then until claims become time-barred |
| Customer account, if you create one at checkout | Article 6(1)(b) GDPR, contract for running the account | until the account is deleted |
| Invoices and accounting | Article 6(1)(c) GDPR, legal obligation | 5 years from the end of the tax year |
| Complaints, returns, service package | Article 6(1)(c) and (f) GDPR | until the matter is closed and claims become time-barred |
| Answering a question from a form, phone call or e-mail, buy-back valuation | Article 6(1)(f) GDPR, contact with the person asking | up to 12 months from the last message |
| Newsletter | Article 6(1)(a) GDPR, your consent confirmed by clicking the link in an e-mail | until you withdraw consent or unsubscribe |
| Visit statistics | Article 6(1)(a) GDPR, your consent | until consent is withdrawn, data kept in the tool for up to 14 months |
| Advertising and measuring advertising performance | Article 6(1)(a) GDPR, your consent | until consent is withdrawn |
| Website security, server logs | Article 6(1)(f) GDPR | usually up to 12 months |
Giving your data for an order is voluntary, but without it we cannot ship the goods or issue an invoice. You do not have to consent to the newsletter, statistics or advertising; the shop works the same way.
Who we pass data to
- Hosting company running the shop server and e-mail: LH.pl Sp. z o.o., based in Poznań, Poland.
- Payment operator PayU S.A., based in Poznań, when you pay online. PayU is a separate controller of your payment data.
- Financing institutions, when you choose eRaty instalments (Santander Consumer Bank S.A.) or LeaseLink leasing. You apply with them; we pass on the order details.
- Carriers: DPD Polska sp. z o.o. for courier parcels, Raben Logistics Polska sp. z o.o. for pallet transport, and GlobKurier.pl and the carriers it selects for shipping abroad. They receive your name or company name, address and telephone number.
- Mailjet SAS (France, Sinch group), when you sign up for the newsletter. It receives your e-mail address and the date of your consent.
- Google Ireland Limited, when you consent to statistics or advertising: Google Analytics, Google Tag Manager and Google Ads.
- Meta Platforms Ireland Limited (Facebook, Instagram), when you consent to advertising: the Meta pixel measures which ads lead to a purchase.
- Accounting office and advisers serving our business, and public authorities where the law requires it.
We do not sell data and do not pass it on to other companies for their marketing.
Transfers outside the European Economic Area
Google and Meta tools may transfer data to the United States. Google Ireland Limited and Meta Platforms Ireland Limited are recipients in the EU, and the transfer to the USA is based on the European Commission's adequacy decision under the Data Privacy Framework and standard contractual clauses. This transfer only happens if you consent to statistics or advertising.
Your rights
- access to your data and a copy of it,
- rectification if the data are wrong,
- erasure if we have no basis for further processing,
- restriction of processing,
- transfer of the data to another controller,
- objection to processing based on legitimate interest,
- withdrawal of consent at any time, without affecting what we did before,
- a complaint to the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or to the supervisory authority in your country.
To exercise a right, write to kontakt@spawlab.pl. We reply within one month. You can also unsubscribe from the newsletter with one click in any message. We cannot delete invoice data before the period set by tax law expires, because the law does not allow it.
Cookies and browser storage
A cookie is a small file that a website saves in your browser. It lets the cart remember your goods and lets us see which pages are used. We divide them into three groups.
Essential
They are always on; without them the cart, checkout and login do not work, so they do not require consent.
| Name | Purpose | How long |
|---|---|---|
| sl_consent | your choice in the consent banner | 12 months |
| sl_lang | language version of the site (Polish, English, German) | 30 days |
| wp_woocommerce_session_* | cart and order session | up to 2 days |
| woocommerce_cart_hash, woocommerce_items_in_cart | cart status | until the browser is closed |
| wordpress_logged_in_*, wordpress_sec_* | login to the customer account | until the browser is closed, or 14 days with "remember me" |
In browser storage (localStorage) we also keep your list of watched and compared products, your choice of net or gross prices and recently viewed products. These data stay in your browser and are not sent to us.
Statistics
Google Analytics loaded through Google Tag Manager. It counts visits and shows where you come from and which pages you view. Files: _ga and _ga_* (up to 2 years). We only store them with your consent.
Advertising
Google Ads measures which ads lead to an order and shows our ads to people who have viewed products in the shop (file _gcl_au, 90 days). The Meta pixel does the same for ads on Facebook and Instagram (file _fbp, 90 days). Both only work with your consent to advertising.
How you manage consent
On your first visit you see the consent banner. You can accept everything, reject everything except essential cookies, or choose by category. You can change your decision at any time with the Cookie settings link in the footer of every page.
You can also delete stored cookies in your browser settings. After you clear the site data, the banner appears again.
The Google Tag Manager script loads on every visit, but until you consent, Google tools run in a limited mode: they do not store cookies or use identifiers in your browser and only send signals without cookies. The Meta pixel loads only after you consent to advertising.
Profiling and automated decisions
We do not make decisions about you by purely automated means and do not profile you with our own tools. The only profiling takes place in Google and Meta tools, after you consent to advertising, and consists of showing ads to people who have visited the shop. It has no effect on prices, access to goods or purchase terms.
Security
The site runs over an encrypted HTTPS connection. Only people who need it for their work have access to the shop admin, each with a separate account. We make regular backups. We never see your payment card data; the payment operator handles it.
Changes to this policy
We change the policy when we add a tool, change a provider or the law changes. The current version is always on this page. Last change: 29 September 2026.
The rules for purchases are set out in the Terms and Conditions.