Rules for processing the personal data of Pure Water customers and website users.

1. Scope of data

We may process: your first and last name, company name and tax ID, delivery and billing addresses, email address, telephone number, customer account details, order and payment information, correspondence, and technical data such as your IP address, cookie identifiers, device type and browser. We do not store full payment card details; these are processed by the payment operator.

2. Purposes and legal bases

• concluding and performing the contract, managing accounts and orders — Article 6(1)(b) GDPR;
• settlements, invoices, tax and accounting obligations — Article 6(1)(c) GDPR;
• complaints, returns, pursuing or defending claims, security and preventing misuse — Article 6(1)(c) and (f) GDPR;
• electronic marketing and optional cookies — consent, Article 6(1)(a) GDPR.

3. Data recipients

Data may be received by parties that help us operate the shop: hosting and IT providers, WooCommerce/WordPress, logistics and courier companies, accountants, legal advisers, banks and payment operator Autopay S.A., together with banks and card organisations involved in processing payments. We provide data to public authorities only where required by law.

4. Online payments

To process a payment, we provide Autopay S.A. with the data needed to identify the transaction, in particular the order number and value and the payer's contact details. Autopay processes data according to its own legal obligations and privacy policy.

5. Retention period

We retain order data and accounting documents for the period required by tax and accounting law; data needed for claims until the applicable limitation period expires; account data until the account is deleted, except for data required by law; and consent-based data until consent is withdrawn or the purpose ends.

6. Your rights

You have the right to access, rectify and erase your data, restrict processing, data portability, object to processing based on legitimate interests and withdraw consent. You may also lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl.

7. Providing data voluntarily

Providing information marked as required is voluntary but necessary to create an account, place and fulfil an order or handle a complaint. The Seller does not use data to make decisions about the customer with legal effects solely through automated processing. The payment operator may use automated fraud-prevention mechanisms.

8. Cookies and transfers outside the EEA

Cookie details are described in the Cookie policy. If a technical provider processes data outside the European Economic Area, a basis provided for by the GDPR is used, in particular an adequacy decision or standard contractual clauses.

Effective from 25 August 2026.