Privacy Policy

Privacy Policy of the Amber Wave Online Store

1. Data Controller and General Information The controller of personal data of individuals visiting the website of the online store www.amberwave.pl is Amber Wave, Ul. Przetoczna 66, 80-720 Gdańsk, NIP: 5851368458 (hereinafter: "we"). We process the personal data of Customers in accordance with legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR"). This Privacy Policy aims to inform Customers about the rules governing the processing of their personal data, data security methods, and the tools enabling Customers to exercise their rights under the law.

2. Contact Us Inquiries or requests regarding the processing of personal data may be sent to the following addresses: Address: Amber Wave, Ul. Przetoczna 66, 80-720 Gdańsk E-mail: joanna@amberwave.pl

3. Purposes and Legal Bases for Processing Personal Data

  • Sales Fulfillment – We process your personal data because it is necessary to perform the sales contract, including receiving payments, delivering goods, issuing sales documents, and settling sales. The legal basis is the contract concluded with the Controller (Art. 6(1)(b) GDPR) and the fulfillment of our legal obligations, including tax regulations (Art. 6(1)(c) GDPR).

  • Customer Account Management – We process your personal data as it is necessary for the performance of the customer account management contract. The legal basis is the contract for the provision of electronic services (Art. 6(1)(b) GDPR).

  • Complaints Processing – The legal basis for processing Customer data is the fulfillment of the Controller's legal obligation resulting from legal provisions on liability for non-conformity of goods with the contract (Art. 6(1)(c) GDPR) and contract performance in the case of warranties (Art. 6(1)(b) GDPR).

  • Marketing – The Controller may occasionally send information about the Online Store's offer or commercial partners' offers to the delivery address provided by the Customer. The legal basis is the Controller’s or its partners' legitimate interest in marketing the goods (Art. 6(1)(f) GDPR).

  • Marketing Communication – If the Customer grants separate consent, the Controller will send commercial information via e-mail or SMS/phone. The legal basis is the Customer's consent, which is voluntary and can be revoked at any time (Art. 6(1)(a) GDPR).

  • Claims Handling & Fraud Prevention – The legal basis for processing data in this case is the legitimate interest of the Controller, consisting of protecting its rights and interests (Art. 6(1)(f) GDPR).

  • Customer Care & Contact – You can contact us, and we will respond. The legal basis is our legitimate interest in providing you with a positive experience with our Online Store (Art. 6(1)(f) GDPR).

4. Voluntarily Provided Personal Data We collect your personal data primarily from you. Providing data is voluntary, but necessary to complete specific actions (e.g., order fulfillment). Refusal to provide data required for service fulfillment will result in the inability to perform the service or conclude the contract. Consenting to marketing communications is entirely optional. Our Online Store allows logging in/creating an account and paying via external services (from which we receive payment status and e-mail address). We use cookies as detailed in our Cookie Policy.

5. Data Recipients We disclose data to third parties when necessary to fulfill ordered services or improve our operations, including:

  • Courier/shipping companies;

  • Payment service providers;

  • IT service providers;

  • Marketing agencies.

6. Data Retention Period Customer data will be processed for the following periods:

  • Account data: Until you delete your customer account;

  • Marketing consents: Until consent is withdrawn;

  • Marketing database: Until an objection is raised, but no longer than 5 years from the last purchase;

  • Correspondence: Until all necessary explanations are provided. After these periods, data may be retained as required by law (e.g., tax/accounting rules) or to establish, pursue, or defend claims.

7. Your Rights You have the right to access, rectify, erase, restrict processing, and transfer your personal data. Requests can be submitted via the contact details in Section 2. We respond without delay and no later than one month after receipt.

8. Right to Object You have the right to object at any time to the processing of your data based on legitimate interests. If you object to direct marketing, we will immediately stop processing your data for that purpose without requiring any justification.

9. Withdrawal of Consent You can withdraw your marketing consent at any time via contact details in Section 2 or using the unsubscribe link in our marketing emails.

10. Complaint to the Supervisory Authority You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).

11. International Data Transfers (Outside EAE/EEA) If data is transferred outside the European Economic Area (e.g., using Google tools), it will occur strictly under legal frameworks (adequacy decisions or Standard Contractual Clauses).

12. Profiling Personal data will not be processed in an automated manner, including profiling, that produces legal effects or significantly affects you.