Privacy and Cookie Policy

Privacy and Cookie Policy

Version 3.3 · in force from 27 September 2026 · primegastro.pl online shop

This English version is a translation provided for information only. The Polish version is legally binding: Polish version.

1. Data controller

The controller of your personal data is Prime Gastro spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Kraków, ul. Longinusa Podbipięty 66, 31-589 Kraków, KRS 0001028623, Tax ID (NIP) 5170434964 (“we”). In matters concerning personal data, e-mail us at info@primegastro.pl or write to us at the address of our registered office.

This Policy applies to data processed in connection with the use of the primegastro.pl online shop (the “Shop”), orders and contact with us. Capitalised terms have the meanings given to them in the Shop Terms and Conditions.

2. Where we obtain data

  1. From you — data provided in an order, in the Customer Account, in forms, in correspondence, requests and reviews.
  2. Automatically — when you use the Shop (e.g. IP address, device and browser data, cookie identifiers, actions in the Shop), to the extent described in section 6.
  3. From other persons and entities:
    • from Customers — data of persons indicated in an order or request (recipient of the shipment, contact person, lessee where the purchase is financed and, in the case of deferred payment, a surety) and data of the installation, connection and commissioning contractor from the Commissioning Report or the proof of connection (name, company, address, Tax ID (NIP), telephone number, type and number of qualification certificate);
    • from payment operators, LeaseLink, carriers, and technicians and service partners — information about payment, financing, delivery and the service and, in the case of deferred payment or a trade credit limit for a B2B Customer, also from receivables insurers (information about the limit);
    • from Google and Meta (Facebook) — your e-mail address when you sign in to the Customer Account with your Google or Facebook account;
    • from public registers (CEIDG, KRS, VAT register) — company details and scope of business activity.

3. Purposes, legal bases and retention periods

Purpose of processingLegal basis (GDPR)Retention period
Conclusion and performance of the contract: order, payment and purchase financing (including the LeaseLink calculator at your request), delivery, personal collection, installation and commissioning, contact regarding the orderArticle 6(1)(b) (contract or steps taken at your request prior to entering into it); data of persons indicated by the Customer — point (f) (performance of the contract with the Customer)until the contract is performed and then until the limitation periods for claims expire
Determining the Customer's status (B2B or B2C), including verifying data in public registersArticle 6(1)(b) and (f) (correct determination of the rights and obligations of the parties)as for the contract
Assessing and securing deferred payment or a trade credit limit for a B2B Customer, including receivables insurance and security (e.g. a suretyship)Article 6(1)(b) and (f) (protection against the insolvency of the counterparty)as for the contract
Maintaining the Customer AccountArticle 6(1)(b)until the Account is deleted and then until the limitation periods for claims expire
Invoices (including in the National e-Invoicing System (KSeF)), accounting records and tax settlementsArticle 6(1)(c) (tax and accounting legislation)for the period required by that legislation
Complaints, guarantee, withdrawal from the contract, returns and technician visitsArticle 6(1)(b) and (c); documenting matters and data of the contractor from the Commissioning Report or the proof of connection — point (f) (dealing with the claim and defending against claims)until the matter is closed and then until the limitation periods for claims expire
Responding to enquiries (contact form, e-mail, telephone)Article 6(1)(f) (providing a response); an enquiry made before a contract is concluded — point (b)until the matter is closed and, if it may be relevant to claims — until the limitation periods for those claims expire
Product availability notification (“Notify me”)Article 6(1)(b) (a service provided at your request)until the notification is sent or you opt out
Request for a review of a purchased Product and publication of reviewsArticle 6(1)(f) (collecting and publishing reliable Product reviews)until a successful objection is made; a review — until it is deleted
Newsletter and other commercial information by e-mail, including measuring message opens and link clicksArticle 6(1)(a) (consent)until consent is withdrawn
Shop analytics (section 6)Article 6(1)(a) (consent given in the cookie settings)until consent is withdrawn; data collected earlier — for the period set in the tool concerned, in Google Analytics no longer than 14 months from collection
Advertising and measuring advertising effectiveness (section 6)Article 6(1)(a) (consent given in the cookie settings)until consent is withdrawn; data transferred to Google, Meta and OpenAI as independent controllers — for the period specified in their policies
Measuring profit from sales and advertising effectiveness on the basis of order data (ProfitMetrics — sections 4 and 6)Article 6(1)(f) (our legitimate interest: assessing the profitability of sales and advertising); storing and reading information on your device — consent given in the cookie settings (section 6)order data — as for the contract; information from your device — until consent is withdrawn, and data collected earlier — for the period set in that tool
Measuring advertising effectiveness and statistics without cookies where you have not given consent (Google consent mode, section 6(3))Article 6(1)(f) (our legitimate interest: statistical measurement of the effectiveness of the Shop's advertising); you may object (section 8)in Google Analytics no longer than 14 months from collection; data transferred to Google as an independent controller — for the period specified in its policies
Operation and security of the Shop, preventing fraud and abuseArticle 6(1)(f)for as long as necessary for that purpose and, in the event of abuse — until the limitation periods for claims expire
Establishment, exercise and defence of legal claims and demonstrating compliance with the law (e.g. a register of consents and requests)Article 6(1)(f)until the limitation periods for claims expire and proceedings are concluded
Free-of-charge collection of waste equipment (WEEE)Article 6(1)(c) (legislation on waste electrical and electronic equipment)for the period required by that legislation

We send order-related messages (confirmations, invoices, payment and delivery information) in performance of the contract; they are not commercial information.

4. Recipients of data

We disclose data, to the extent necessary for the purposes set out in section 3, to:

  1. entities providing services to us, in particular: Shopify International Limited (Ireland) — the Shop platform, checkout, Customer Account and sending e-mails, including the newsletter (Shopify Email); providers of Shop apps (among others Judge.me — reviews, CartBite — “Notify me” notifications, CookieFirst — recording consents, Elevar — forwarding events to Google, Meta and OpenAI tools, ProfitMetrics ApS (Denmark) — measuring profit from sales and advertising effectiveness on the basis of order data, including the ad click identifiers recorded with the order); providers of IT services, e-mail services and order handling systems; an accounting office and advisers;
  2. entities involved in the performance of the contract and in the recovery of amounts due: the payment operators PayU S.A. and PayPro S.A. (Przelewy24) and LeaseLink sp. z o.o. — as independent controllers; suppliers of Products and operators of shipping warehouses (also in other European Union countries), carriers, technicians and service partners, insurers (including insurers of shipments and receivables) and banks and insurers providing payment guarantees, law firms and debt collection agencies;
  3. analytics and advertising tools (section 6): Google Ireland Limited — Google Analytics and Google Ads (section 6(3)), Meta Platforms Ireland Limited — the Meta pixel, OpenAI Ireland Limited — a pixel measuring the effectiveness of advertisements displayed in OpenAI services (events are forwarded by Elevar). These entities may combine the data collected with other data and use it for their own purposes as independent controllers, in accordance with their privacy policies. Once you have consented to the “Advertising / tracking” category, the events forwarded (e.g. a purchase) may include the e-mail address and telephone number from the order in the form of a cryptographic hash;
  4. public authorities, including the National Revenue Administration (National e-Invoicing System), where this is required by law.

LeaseLink calculator. Using the financing calculator causes your browser to connect to the servers of LeaseLink sp. z o.o., which receives technical connection data (including your IP address and browser data) and data of the selected Product (name, price, quantity, page address) and processes them in accordance with its privacy policy.

Joint controllership with Meta. As regards the collection of data using the Meta pixel in the Shop and its transmission to Meta Platforms Ireland Limited (including via Elevar), we and Meta are joint controllers (Article 26 GDPR). Under the arrangement between us (www.facebook.com/legal/controller_addendum), we are responsible for informing you about this processing and for obtaining consent, while Meta is responsible for giving effect to your rights in respect of the data after its transmission. You may exercise your rights against us and against Meta. Further processing by Meta: www.facebook.com/privacy/policy.

5. Transfers of data outside the EEA

Some of the recipients referred to in section 4 (e.g. Shopify, Google, Meta, OpenAI and providers of Shop apps) may process data outside the European Economic Area, including in the United States and Canada. The basis is a European Commission decision finding an adequate level of protection (including the EU–US Data Privacy Framework) or standard contractual clauses adopted by the European Commission. You can obtain a copy of the safeguards by contacting us (section 1).

6. Cookies and similar technologies

  1. The Shop stores information on your device and reads it (cookies, browser storage, pixels). Categories:
    • Necessary — the operation of the Shop and of the features you use: cart, checkout, logging in, product comparison, language version, security, saving your cookie settings, and protecting forms against abuse. They do not require consent.
    • Functional — additional features, e.g. “Notify me” notifications (CartBite), recently viewed Products, the LeaseLink financing calculator (once you open it, it stores the calculator basket in your browser storage).
    • Performance (analytics) — Shop statistics, e.g. Shopify, Google Analytics; for Google tools — see para. 3.
    • Advertising / tracking — measuring advertising effectiveness and tailoring advertisements, e.g. Google Ads, the Meta pixel, the OpenAI pixel, Elevar, ProfitMetrics; for Google tools and the forwarding of events to them via Elevar — see para. 3.
  2. You give consent in the banner on your first visit and can change or withdraw it at any time in the cookie settings (the cookie settings button available on the Shop's pages). There you will find a list of cookies with their retention periods and information on who stores them. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. You can also delete and block cookies in your browser; blocking necessary cookies may make it impossible to place an order.
  3. Google consent mode: Google Analytics and Google Ads also load when you have not given consent — before you make a choice in the banner, after you refuse consent and after you withdraw it. Without consent, they do not store cookies on your device or read cookies or advertising identifiers from it. In that case, they send Google basic information about the visit and about events in the Shop (e.g. the address and type of the page, the type of event, the time, the consent status, technical browser data, the IP address) and the information about an ad click contained in the page address (e.g. the gclid parameter) — we carry this parameter over in the addresses of the subsequent Shop pages you visit instead of storing it in a cookie. Elevar may also forward events from the Shop (e.g. the placing of an order) to Google in the same mode. This information is used for the statistical measurement of the effectiveness of the Shop's advertising. Full statistical measurement takes place once you consent to the “Performance” category, and full measurement and tailoring of advertising — once you consent to the “Advertising / tracking” category.

7. Your rights

You have the right of access to your data and to obtain a copy of it, and the rights to rectification, erasure, restriction of processing and data portability (Articles 15–18 and 20 GDPR), to object (section 8) and to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. These rights apply to the extent and on the terms laid down in the GDPR. Send your request in the manner indicated in section 1; we may ask for information necessary to confirm your identity. You may also lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

8. Right to object

You may object at any time — on grounds relating to your particular situation — to the processing of your data based on our legitimate interest (Article 6(1)(f) GDPR). We will uphold the objection unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. We always uphold an objection to processing for direct marketing purposes. You may opt out of review requests at any time, including via the link in the message.

9. Profiling and automated decisions

We do not make decisions about you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. Analytics and advertising tools (section 6) may create profiles for statistics and ad tailoring.

10. Do you have to provide data?

Providing data is voluntary, but without it we will not conclude or perform the contract, create an Account, deal with a request or send a notification or the newsletter. Issuing an invoice requires the data required by tax legislation (for a company — including the Tax ID (NIP)). The declaration on the professional nature of the contract is voluntary and is not a condition for concluding it. Consent to cookies other than necessary cookies is not a condition of purchase.

11. Changes to the policy

The current version of the Privacy and Cookie Policy is available on this page.

Privacy and Cookie Policy of primegastro.pl · version 3.3 dated 27 September 2026 · Prime Gastro sp. z o.o., ul. Longinusa Podbipięty 66, 31-589 Kraków · KRS 0001028623 · Tax ID (NIP) 5170434964