Privacy Policy

1. Data Controller

The controller of personal data is URSON Sp. z o.o. with its registered office at ul. Lazurowa 56, 32-642 Włosienica, NIP: 5492444253, KRS: 0000612887 (hereinafter: the "Controller").

The Controller has not appointed a Data Protection Officer. For all matters relating to the processing of personal data, you may contact the Controller directly at the e-mail address: sklep@motofarma.pl or by phone: +48 506 971 987.

2. Sources of Personal Data

In most cases, we process personal data provided directly by you (during registration, placing an order, or contacting us). In addition, we may obtain data from the following sources:

GUS / CEIDG / KRS – verification of company data (NIP, registered address) for the purpose of correctly issuing a VAT invoice.
Sales platforms – in the case of orders placed through external platforms, the data necessary to fulfil the order (first name, surname, address, e-mail) are provided by the platform operator.

3. Purposes and Legal Bases for Data Processing

Personal data are processed for the following purposes:

Fulfilment of orders and sales contracts (Art. 6(1)(b) GDPR) – processing is necessary for the performance of a contract.
Maintaining a customer account in the Store (Art. 6(1)(b) GDPR).
Handling complaints and returns (Art. 6(1)(b) GDPR).
Fulfilment of tax and accounting obligations (Art. 6(1)(c) GDPR).
Direct marketing of our own products and services (Art. 6(1)(f) GDPR – legitimate interest of the Controller).
Sending newsletters and commercial information with the user's consent (Art. 6(1)(a) GDPR).
Conducting statistical analyses and improving service quality using Google Analytics (Art. 6(1)(a) GDPR – consent given by accepting analytical cookies).
Handling product availability notifications – sending e-mail messages informing about product restocking (Art. 6(1)(a) GDPR – consent).
Managing shopping lists (wishlists) – saving products selected by a logged-in user (Art. 6(1)(b) GDPR – performance of a contract for the provision of electronic services).
Identity verification and bot protection using reCAPTCHA v3 (Art. 6(1)(f) GDPR – legitimate interest of the Controller in protecting the website against abuse).
Handling product reviews and ratings (Art. 6(1)(a) GDPR – consent).
Issuing discount coupons linked to an e-mail address (Art. 6(1)(b) GDPR – performance of a contract).
Pursuing and defending against claims (Art. 6(1)(f) GDPR – legitimate interest).

4. Data Recipients

Personal data may be disclosed to the following categories of recipients:

Courier and logistics companies – InPost Sp. z o.o., DPD Polska Sp. z o.o., DHL Express (Poland) Sp. z o.o., UPS Polska Sp. z o.o., Geodis – for the purpose of delivering ordered products.
Payment operator – PayPro SA (Przelewy24), ul. Pastelowa 8, 60-198 Poznań – for the purpose of processing electronic payments.
Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – provider of Google Analytics (website traffic analytics), Google Ads (advertising campaigns), and reCAPTCHA v3 (form protection against bots). Data may be transferred to the USA under the EU-US Data Privacy Framework.
BaseLinker Sp. z o.o. – order management and stock synchronisation platform, to the extent necessary for order fulfilment.
Accounting and legal service providers – to the extent necessary for maintaining accounting records and providing legal services.
IT and hosting service providers – to the extent necessary for maintaining the technical infrastructure of the Store.

5. Data Retention Period

Personal data are retained for the following periods:

Order data – for the duration of the contract, and subsequently for 6 years from the end of the calendar year in which the contract was performed (limitation period for civil claims).
Tax and accounting data (invoices, invoicing data) – 5 years from the end of the calendar year in which the tax payment deadline expired.
User account data – until the account is deleted by the user or upon a request for data deletion.
Data processed on the basis of consent (newsletter, availability notifications) – until consent is withdrawn.
Data processed for direct marketing purposes – until an effective objection is raised.
Reviews and ratings – for the period of publication on the Store website, until removal at the author's request.
Cookie consents – 12 months from the date of consent, after which renewed consent is required.
Access and security logs – a maximum of 90 days.

6. User Rights

Under the GDPR, you are entitled to the following rights:

Right of access – the right to obtain information about the personal data being processed (Art. 15 GDPR).
Right to rectification – the right to correct inaccurate data or to supplement incomplete data (Art. 16 GDPR).
Right to erasure – the right to request the deletion of data, also known as the "right to be forgotten" (Art. 17 GDPR).
Right to restriction of processing – the right to request the restriction of data processing in certain cases (Art. 18 GDPR).
Right to data portability – the right to receive data in a structured format (Art. 20 GDPR).
Right to object – the right to object to the processing of data based on legitimate interest (Art. 21 GDPR).
Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out prior to the withdrawal (Art. 7(3) GDPR).
Right to lodge a complaint – the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, tel. +48 22 531 03 00, e-mail: kancelaria@uodo.gov.pl, website: https://uodo.gov.pl.

7. Requirement to Provide Personal Data

The provision of personal data is voluntary; however:

Data necessary for order fulfilment (first name, surname, delivery address, e-mail, phone number) – failure to provide them prevents placing and fulfilling an order.
Data for a VAT invoice (NIP, company name, address) – their provision is a statutory requirement under tax regulations if the Customer requests an invoice.
Data for account creation (first name, e-mail, password) – failure to provide them prevents creating an account in the Store.
Data for availability notifications (e-mail) – provision is voluntary; failure to provide it prevents sending the notification.

8. Transfer of Data to Third Countries

In connection with the use of Google LLC services (Google Analytics, Google Ads, reCAPTCHA v3), personal data may be transferred to the United States of America. This transfer is carried out on the basis of:

the implementing decision of the European Commission of 10 July 2023 establishing an adequate level of personal data protection under the EU-US Data Privacy Framework (DPF) – Google LLC is certified under the DPF;
standard contractual clauses approved by the European Commission (as an additional safeguard).

Other data recipients (courier companies, Przelewy24, BaseLinker) process data exclusively within the European Economic Area (EEA).

9. Automated Decision-Making and Profiling

The Controller does not make automated decisions regarding you, including decisions based on profiling, that produce legal effects or similarly significantly affect you (Art. 22 GDPR).

At the same time, we inform you that if you consent to marketing cookies, advertising partners (Google Ads) may create an interest profile based on your activity on the website in order to display personalised advertisements on other websites. This profiling does not produce legal effects and is based solely on the user's voluntary consent, which may be withdrawn at any time in the cookie settings.

10. Data Security

The Controller implements appropriate technical and organisational measures to ensure the protection of processed personal data, including in particular: encryption of sensitive data in the database, SSL certificate, access control, and regular security updates.

11. Cookies

Detailed information about the cookies used on the motofarma.pl website can be found in the Cookie Policy.

12. Contact

For matters relating to the protection of personal data, please contact us:

E-mail: sklep@motofarma.pl
Post: URSON Sp. z o.o., ul. Lazurowa 56, 32-642 Włosienica
Phone: +48 506 971 987

13. Legal Basis

This privacy policy has been prepared on the basis of:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
The Polish Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2018, item 1000, as amended);
The Polish Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws 2002, No. 144, item 1204, as amended);
The Polish Act of 16 July 2004 – Telecommunications Law (Journal of Laws 2004, No. 171, item 1800, as amended) – with regard to cookies.

Last updated: March 2026