DabLab

Legal document

Privacy Policy

Privacy Policy of the dablab.pl Online Store

Last updated: November 21, 2025

1. General provisions

1.1. This Privacy Policy sets out the rules for the processing of personal data in the online store dablab.pl (hereinafter: “Store”).

1.2. The policy has been developed in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)
Act of May 10, 2018 on the protection of personal data
Act of July 18, 2002 on the provision of electronic services
Act of May 30, 2014 on consumer rights

1.3. By using the Store, you agree to this Privacy Policy.

2. Data controller

GreenGlowMall Patryk Domagała

Address: ul. Dzieci Polskich 15/30, 97-200 Tomaszów Mazowiecki
NIP: 7732506731
E-mail: kontakt@dablab.pl
Phone: +48 507 182 027

3. Purposes and grounds for data processing

3.1. Order fulfillment (Article 6(1)(b) of the GDPR)

Purpose: Execution of the sales agreement, delivery of products, issuance of invoices, payment processing.

Scope: First and last name, delivery address, email, phone number, billing information (company name/first and last name, address, tax ID number – if required).

Consequences of not providing the information: The order cannot be fulfilled.

3.2. Legal obligations (Article 6(1)(c) of the GDPR)

Purpose: Accounting, issuing and storing invoices, fulfilling tax obligations.

Period: 5 years from the end of the tax year (in accordance with the Tax Ordinance).

3.3. Direct marketing (Article 6(1)(f) of the GDPR)

Purpose: Informing existing customers about our own product offers, analyzing behavior, optimizing the Store, pursuing claims, ensuring security.

Right to object: You may object at any time.

3.4. Marketing with your consent (Article 6(1)(a) of the GDPR)

Purpose: Newsletter, telephone/SMS contact for marketing purposes, profiling, marketing and analytical cookies.

Withdrawal of consent: At any time via the link in the email, the account panel, or by contacting the Administrator.

3.5. User account (Article 6(1)(b) of the GDPR)

Purpose: Account management, order management, service personalization.

Voluntary: Creating an account is voluntary; purchases can also be made as a guest.

3.6. Complaints and returns (Article 6(1)(b) and (c) of the GDPR)

Purpose: Consideration of complaints, exercise of the right to withdraw from the contract in accordance with the Consumer Rights Act.

Period: During the review period and the warranty/guarantee period (up to 6 years).

4. Scope of data collected

4.1. Data provided by the User

When placing an order:

First and last name
Delivery address (street, house/apartment number, postal code, city)
Email
Phone
Invoice details (optional): company name/first name and last name, address, tax identification number (NIP)

User account:

Data as above + password (encrypted)
Order history
Saved addresses

Newsletter:

Email
First name (optional)

4.2. Data collected automatically

IP address
Browser type and operating system
Visit duration and subpages visited
Input source
Behavior in the Store (viewed products, shopping cart)

Purpose: Traffic analysis, store optimization, security, remarketing.

5. Data recipients

Personal data may be transferred:

5.1. Entities processing on behalf of the Controller

Hosting and IT – maintenance of the Store’s infrastructure
Payment operators – PayU, Przelewy24, PayPal, Stripe, Tpay (full payment card details are processed only by operators in accordance with the PCI DSS standard)
Courier companies – InPost, DPD, DHL, GLS, Poczta Polska (first name, last name, address, telephone number)
Email marketing systems – Mailchimp, GetResponse, Freshmail
Analytical tools – Google Analytics, Facebook Pixel, Hotjar
Accounting offices and law firms

5.2. Entities authorized by law

State authorities (courts, police, tax office, Social Insurance Institution)

5.3. Transfer of data outside the EEA

Some data may be transferred to the US in connection with the services:

Google LLC (Analytics, Ads) – EU-U.S. Data Privacy Framework adequacy decision
Meta Platforms (Facebook Pixel) – standard contractual clauses
Stripe, PayPal – standard contractual clauses

All entities ensure an adequate level of protection in accordance with the GDPR.

6. Data retention period

Invoices and accounting documents: 5 years from the end of the tax year
Data in the sales contract: For fulfillment + warranty period (2 years) + limitation period for claims (up to 6 years)
User account: To be deleted by the User or 3 years after the last login (with prior notification)
Newsletter (consent): Until consent is withdrawn or 3 years after last activity
Marketing (legitimate interest): 3 years from the last purchase or until objection is raised
Inquiries: Until the case is closed, max. 3 years
Server logs: Up to 12 months
Analytical data: Up to 26 months (Google Analytics)
Cookies: From the end of the session to 24 months

7. Rights of data subjects

In accordance with the GDPR, you have the following rights:

7.1. Right of access (Article 15)

You can obtain confirmation as to whether we process your data and a copy of that data.

7.2. Right to rectification (Article 16)

You may request that incorrect data be corrected or incomplete data be supplemented.

7.3. Right to erasure (Article 17)

You may request the deletion of your data when:

They are no longer necessary.
You have withdrawn your consent.
You have filed an objection
They are processed unlawfully

Exception: We cannot delete data when we are required to retain it (e.g., invoices for 5 years).

7.4. Right to restriction of processing (Article 18)

You may request restriction when you contest the accuracy of the data or the processing is unlawful.

7.5. Right to data portability (Article 20)

You can receive your data in a format that allows it to be transferred to another controller (CSV, JSON, XML).

7.6. Right to object (Article 21)

Marketing: You can object to direct marketing at any time – we will immediately stop processing your data for this purpose.

Legitimate interest: You may object on grounds relating to your particular situation.

7.7. Right to withdraw consent

You may withdraw your consent at any time:

Newsletter (link “unsubscribe” in the email)
Phone call/text message
Marketing and analytics cookies

7.8. Right to complain

You may lodge a complaint with the President of the Personal Data Protection Office (PUODO):

Address: ul. Stawki 2, 00-193 Warsaw
Phone: +48 22 531 03 00
Email: kancelaria@uodo.gov.pl
Web: https://uodo.gov.pl

Exercising your rights: Contact us at: kontakt@dablab.pl (subject: “GDPR”) or +48 507 182 027. We will respond within one month.

8. Data security

We use technical and organizational measures to ensure data security:

8.1. Technical measures

SSL/TLS encryption – secure HTTPS connection
Password encryption – stored in encrypted form (hash)
Firewall – protection against unauthorized access
Regular backups – daily, in secure locations
Updates – regular updates to systems and software
Security monitoring – detecting suspicious activity
Payment tokenization – we do not store full card details
PCI DSS – payment operators meet security standards

8.2. Organizational measures

Restricted access – authorized persons only
Entrustment agreements with processors
Employee training on GDPR and security
Confidentiality obligations
Incident response procedures

8.3. Data breaches

In the event of a data breach:

We will report the incident to PUODO within 72 hours
We will notify you if the breach poses a high risk to your rights

9. Cookies

9.1. What are cookies?

Small text files stored on your device when you use the Store.

9.2. Types of cookies

Essential (no consent required):

Shopping cart support
Logging into your account
Security measures

Functional (require consent):

Remembering preferences (language, currency)
Personalization

Analytical (require consent):

Google Analytics – traffic analysis
Hotjar – heat maps

Marketing (requires consent):

Google Ads, Facebook Pixel – remarketing
Ad personalization

9.3. Cookie management

Banner cookies: During your first visit, you can choose which cookies you accept.

Browser: You can manage cookies in your browser settings:

Chrome: Settings → Privacy → Cookies
Firefox: Settings → Privacy → Cookies
Edge: Settings → Cookies
Safari: Preferences → Privacy

Consequences of disabling: Your shopping cart and login may not work.

9.4. External tools

Google Analytics, Google Ads
Facebook Pixel
Hotjar

Details in their privacy policies.

10. Contact

10.1. Contact details

GreenGlowMall Patryk Domagała

Email: kontakt@dablab.pl (subject: “GDPR”)
Phone: +48 507 182 027 (Mon-Fri, 9:00 a.m.-5:00 p.m.)
Address: ul. Dzieci Polskich 15/30, 97-200 Tomaszów Mazowiecki
Contact form in the Store (subject: “Personal data protection”)

10.2. Response time

We respond without undue delay, no later than within one month. In justified cases, the deadline may be extended by another two months with notification.

10.3. Identity verification

For security reasons, we may ask you to confirm your identity (e.g., order number, email address used for registration).

Additional information

Profiling

We use profiling for marketing purposes (personalization of offers, product recommendations) based on your purchase history and behavior in the Store. We do not make automated decisions that have legal consequences. You can object to profiling.

Children’s data

The store is intended for adults. We do not knowingly collect data from children under the age of 16 without the consent of a parent/guardian.

By subscribing to the newsletter, you agree to receive marketing information. You can unsubscribe at any time (link in the email footer). We use double opt-in confirmation.

Marketing for existing customers

We may send offers for our own products to the email addresses of existing customers without separate consent (Article 10(2) of the Act on the provision of electronic services). You may object at any time.

Changes to the Policy

We will inform you about any significant changes via a notice on our website and by email (at least 14 days before they come into effect). The current version is always available at: dablab.pl/polityka-prywatnosci

By using the dablab.pl Store, you accept this Privacy Policy.

GreenGlowMall Patryk Domagała
ul. Dzieci Polskich 15/30, 97-200 Tomaszów Mazowiecki
NIP: 7732506731 | Email: kontakt@dablab.pl | Phone: +48 507 182 027