Controller
The controller of your personal data is Vitaprint Sp. z o.o., pl. Jana Kilińskiego 2, 35-005 Rzeszów, Poland, Polish tax identification number (NIP) 5170375598. For any matters concerning personal data, write to us at info@vitasystem.pl.
Scope, purposes and legal bases
We process contact, address and billing details, order data and the files you submit. We need them to conclude and perform the contract, process payment, produce and deliver the goods, handle complaints, keep accounts and protect legal claims. Marketing and analytics are based on consent where consent is required.
The legal bases are performance of the contract (Art. 6(1)(b) GDPR), compliance with our legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR), our legitimate interest in protecting claims and in the security of the shop (Art. 6(1)(f) GDPR) and your consent (Art. 6(1)(a) GDPR).
Recipients and retention period
We may share data with parties necessary to provide the service: hosting and IT system providers, accounting, the bank and payment service, carriers and production subcontractors. We keep the data for the duration of the contract, for as long as tax and accounting obligations require and until any claims become time-barred.
Production files
We use designs and artwork solely to prepare the product, process the order, repeat the order with the customer’s consent and handle complaints. Only the people and parties involved in fulfilling the order have access to them.
Your rights
You may request access to your data, its rectification, erasure, restriction of processing or portability, object to processing and withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, or with the Polish supervisory authority competent for us, the President of the Personal Data Protection Office (UODO).
Website behaviour analytics
With your consent, we use Microsoft Clarity to analyse clicks, scrolling, heatmaps and session recordings in order to make shopping and the configurators easier to use. Forms, the basket, the account and design areas are masked. We do not pass file contents, file names or contact details to our own analytics events. Information on how Microsoft processes data can be found in the Microsoft privacy statement.
Meta advertising (Facebook and Instagram)
If you consent to advertising cookies, we use the Meta Pixel and the Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. They allow us to measure the effectiveness of our advertising on Facebook and Instagram, optimise how it is delivered and reach people who are likely to be interested in our offer. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR). Without this consent we do not send any data to Meta.
The pixel in your browser sends Meta information about the pages you visit, the products you view (identifier and price), adding a product to the basket, starting and placing an order and submitting the contact form, as well as your IP address, browser data and the identifiers stored in the _fbp and _fbc cookies. After an order is placed or a form is submitted, our server sends Meta the same events together with the order or enquiry number, value, currency and product list. It attaches your e-mail address, phone number, first name, surname, town, postcode and country, but only as SHA-256 hashes, never in plain text. Meta uses them to match the event to an account on its services.
We are jointly responsible with Meta, as joint controllers, for collecting and transmitting this data. Further processing, including the transfer of data to Meta Platforms, Inc. in the USA under the EU-U.S. Data Privacy Framework, takes place under the rules described in the Meta privacy policy. After an event has been transmitted, we delete the IP address and matching data from our systems. The _fbp and _fbc cookies expire after 90 days. You can withdraw your consent at any time using the “Cookie settings” button at the bottom of the page. From that moment we no longer send any data to Meta and we remove Meta’s cookies from your browser.
Google Analytics and Google Ads
We use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We activate Google Analytics 4 after you consent to analytics cookies and use it for traffic statistics and to improve the shop. We activate Google Ads after you consent to advertising cookies and use it to measure the effectiveness of our advertising in Google Search and Google’s networks and to tailor that advertising. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR).
The Google script is loaded from Google’s servers in Consent Mode, in which consent to analytics and advertising cookies is denied by default. Until you give it, we do not start any measurement and no Google cookies are stored. Once you have given consent, Google receives information about the pages you visit, the products you view, adding a product to the basket, starting and placing an order (order number, value, currency and product list) and submitting the contact form (enquiry number). It also receives your IP address, browser data and the identifiers stored in Google cookies such as _ga and _gcl_au. We do not pass your e-mail address, phone number or any other contact details to Google.
If you come to us from a Google ad and consent to advertising cookies, we store the click identifier (gclid, gbraid or wbraid) and the campaign parameters (UTM) together with the submitted form. This tells us which ad generated the enquiry. If you have consented to analytics cookies, we also add the Google Analytics client identifier. Google may transfer data to Google LLC in the USA under the EU-U.S. Data Privacy Framework. Details are set out in the Google privacy policy and on the page explaining how Google uses information from sites that use its services. You can withdraw your consent at any time using the “Cookie settings” button at the bottom of the page.
Product reviews
A few days after your order has been dispatched, we e-mail every customer asking them to review the products they bought. We do this on the basis of our legitimate interest in learning what customers think of the products we sell (Art. 6(1)(f) GDPR). We send one request and at most one reminder. You can opt out of further requests with a single click in the message or on the review page.
Only a person who has bought the product can submit a review. We verify the purchase against the order: via a signed link from the e-mail or using the order number and e-mail address. With each review we publish the rating, text, any photos added, the date and a signature consisting of your first name and the initial of your surname — or no signature, if you prefer. We do not publish your e-mail address or order number. Publication is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw by asking us to delete the review. We pass published reviews to Google Merchant Center so that product ratings can appear in Google results and ads.
If, after your purchase, you agree to it in the Google window (Google Customer Reviews), Google receives the order number, e-mail address, country and estimated delivery date so that it can send you its own survey about the purchase. We only display this window if you have consented to advertising cookies. This data is processed by Google Ireland Limited in accordance with the Google privacy policy.
OpenAI advertising (ChatGPT)
If you consent to advertising cookies, we use the OpenAI Ads measurement pixel provided by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. It allows us to check whether our ads in ChatGPT lead to enquiries and orders. The legal basis for this processing is your consent (Art. 6(1)(a) GDPR). Without this consent, the OpenAI script is not loaded and we do not send any data to OpenAI.
Once you have given consent, the pixel sends OpenAI information about the submission of the contact form (enquiry number) and about an order being placed (order number, gross value and currency), as well as the page address, IP address and browser data. It also stores the cookies __oppref (ad click identifier, 30 days) and __obref (random browser identifier, 365 days). We ourselves do not pass on the content of enquiries or contact details. However, the pixel has an automatic matching feature: it can detect an e-mail address or phone number entered in a form on the page and pass it to OpenAI solely as a SHA-256 hash, never in plain text, in order to match the event to the ad click. Data may be transferred to OpenAI, L.L.C. in the USA under the rules described in the OpenAI privacy policy. You can withdraw your consent at any time using the “Cookie settings” button in the footer of the page. We will then switch off the measurement and delete OpenAI’s cookies from your browser.
