Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

2. Data We Collect

We collect only the personal data necessary to process your order and provide our services:

• Name — to address your order and delivery.
• Email address — for order confirmation, shipping updates, and customer support.
• Shipping address — to deliver your order.
• Phone number — required by carriers for delivery coordination.
• Payment information — processed exclusively by PayU. We never see, store, or have access to your card details.

3. Purpose and Legal Basis

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b) GDPR) — processing your order, arranging delivery, handling returns and complaints.
• Legal obligation (Art. 6(1)(c) GDPR) — tax and accounting records as required by Polish law.
• Legitimate interest (Art. 6(1)(f) GDPR) — fraud prevention and securing our services.
• Consent (Art. 6(1)(a) GDPR) — marketing communications, if you opt in. You may withdraw consent at any time.

4. Payment Processing

All payment transactions are handled by PayU SA, a licensed payment institution with its registered office in Poznań, Poland. Your card data is entered directly on PayU's secure platform — we never receive, process, or store your payment card details. As a Polish payment institution, PayU processes all data within the EU. For PayU's privacy practices, see PayU's Privacy Policy.

5. Data Storage

Your order and account data is stored in Supabase (hosted in the EU region). We use industry-standard encryption and access controls to protect your data.

6. Data Sharing

We share personal data only with the following processors, strictly as necessary for order fulfilment:

• PayU SA — payment processing (EU-based).
• DPD / shipping carriers — delivery of your order.
• Supabase — database hosting (EU region).

We do not sell, rent, or trade your personal data to any third party.

7. Cookies and Local Storage

We use minimal cookies and browser local storage for essential functionality:

• fw-cart (localStorage) — stores your shopping cart contents. Functional; no personal data.
• fw-theme (localStorage) — remembers your dark/light mode preference. Functional; no personal data.
• PayU cookies (third-party) — set during checkout for payment processing and fraud prevention. Session-based.

For full details, see our Cookie Policy.

8. Data Retention

• Order data — retained for 5 years from the date of the transaction, as required by Polish tax law.
• Account data — retained until you request deletion.
• Marketing consent records — retained for as long as you remain subscribed, plus 1 year after withdrawal for accountability.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data (subject to legal retention obligations).
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest.
• Right to restrict processing — request limitation of processing in certain circumstances.

To exercise any of these rights, contact us at contact@flavourwhip.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Polish data protection authority (Urząd Ochrony Danych Osobowych — UODO) or the supervisory authority of your country of residence.

10. International Transfers

Your data is primarily processed within the EU/EEA. Our payment processor PayU SA is based in Poland, so payment data remains within the EU. Where any data is processed outside the EEA by our service providers, such transfers are protected by Standard Contractual Clauses or adequacy decisions in accordance with Art. 46 GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

12. Contact

For any questions or concerns about this Privacy Policy or our data practices, please contact us at contact@flavourwhip.com.