SMARTBEST.PL PRIVACY AND COOKIE POLICY

Effective August 13, 2026

1. Data Controller

The controller of personal data is SMARTBEST, a limited liability company with its registered office in Pasłęk, ul. Dworcowa 28/22, 14-400 Pasłęk, KRS 0001008490, NIP 5783158641, REGON 523933304, share capital 10,000.00 PLN (“Controller”).

For matters concerning personal data, please contact us at sklep@smartbest.pl or by mail at the address above. The Controller has not appointed a Data Protection Officer.

2. Scope and Sources of Data

We process data provided by you when using the Store, creating an account, placing and fulfilling an order, contacting us, filing a complaint, making a return, or subscribing to the newsletter. This may include, in particular: first and last name, company name, tax ID number, address, email address, phone number, order details, payment information, and correspondence.

While using the website, technical data may also be processed, such as IP address, online identifiers, device and browser information, the address of the page visited, the source of the visit, and actions performed in the Store. The scope depends on cookie settings and the consents granted.

3. Purposes, Legal Bases, and Retention Period

Purpose Legal basis Retention period
Creating and maintaining an account, managing the shopping cart, concluding and performing the contract, and communicating regarding the order Article 6(1)(b) of the GDPR for the duration of the contract or account maintenance, and then until the expiration of the statute of limitations for claims
Settlements, accounting and tax documentation Article 6(1)(c) of the GDPR in connection with tax and accounting regulations for the period required by applicable regulations
Complaints, returns, pursuing and defending against claims, and preventing fraud Article 6(1)(b), (c), or (f) of the GDPR; the legitimate interest is the handling of claims and the protection of the Store until the matter is resolved and the applicable statute of limitations expires
Response to a non-contractual inquiry Article 6(1)(f) of the GDPR; the legitimate interest is to conduct correspondence until the correspondence is concluded, and thereafter for the period necessary to demonstrate its course or to defend against claims
Newsletter and direct marketing via email Article 6(1)(a) of the GDPR – consent; where applicable,
Article
6(
1)
(f
)
of
the GDPR
until consent is withdrawn or an objection is raised, and thereafter only to the extent necessary to demonstrate the lawfulness of the processing
Analytics regarding the use of the Store Article 6(1)(a) of the GDPR – consent to analytical cookies until consent is withdrawn or for the duration of the relevant identifier, in accordance with the provider’s settings
Ad effectiveness measurement, remarketing, and ad personalization Article 6(1)(a) of the GDPR – consent to advertising cookies until consent is withdrawn or for the duration of the respective identifier, in accordance with the provider’s settings

Providing the data required in the order form is voluntary but necessary for the conclusion and performance of the contract. Providing data for the newsletter and consent to non-essential cookies are voluntary and do not affect the ability to make a purchase.

4. Recipients of the Data

Data may be transferred only to the extent necessary to achieve a specific purpose:

  • hosting, email, and online store software providers, as well as technical support and security service
  • providers
  • ;
  • payment processors, in particular PayU and InPost Pay, banks, and card issuers;
  • carriers and pickup point operators, in particular InPost, DPD, GLS, and ORLEN Paczka—in accordance with the method selected by the Customer;
  • entities providing accounting, legal, debt collection, or auditing services;
  • public authorities, if the obligation to disclose arises from the law;
  • Google Ireland Limited and entities within the Google group—exclusively in connection with Google Analytics, Google Ads, Google Tag Manager, and Consent Mode, and in accordance with the consent provided.

The Data Controller does not sell personal data.

5. Transfer of Data Outside the European Economic Area

Certain technology providers, in particular entities within the Google group, may also process data outside the European Economic Area. In such cases, the transfer is based on a mechanism permitted by the GDPR, specifically a European Commission decision confirming an adequate level of protection, the recipient’s participation in the EU–US Data Privacy Framework, or standard contractual clauses accompanied by appropriate safeguards. Information about the current mechanism can be obtained by contacting the Data Controller.

6. Rights of the Data Subject

Under the terms of the GDPR, you have the right to:

  • access their data and receive a copy thereof;
  • rectify their data;
  • erase their data;
  • restrict processing;
  • data portability;
  • object to processing based on a legitimate interest, and to direct marketing at any time;
  • withdraw consent at any time, without affecting the lawfulness of prior processing;
  • lodge a complaint with the President of the Personal Data Protection Office.

To exercise these rights, please contact the Data Controller. If necessary to protect your data, the Data Controller may ask you to confirm your identity.

7. Automated Decision-Making and Profiling

The Controller does not make decisions regarding the user based solely on automated processing that would produce legal effects or similarly significantly affect the user. Once consent is given, activity data may be used to create audience groups, measure the effectiveness of ads, and tailor ad content. You may withdraw your consent at any time in the cookie settings.

8. Cookies and Similar Technologies

Cookies are small files stored on the user’s device. The store uses the following categories:

  • Essential – required for the website to function, to secure the session, shopping cart, login, language selection, and to remember consent decisions. They do not require consent.
  • Analytical – help measure traffic and how the Store is used, particularly through Google Analytics. They are activated after consent is given.
  • Advertising – used to measure campaigns, remarketing, and ad personalization, particularly using Google Ads. They are activated after consent is given.

The Store uses Google Consent Mode. Until the user makes a decision, consent for storing analytical and advertising data is rejected by default. Rejecting non-essential cookies does not block purchases.

You can grant, reject, or customize your consent in the banner displayed on your first visit. You can also change your settings at any time via the “Cookie Settings” link in the “My Account” column in the footer. Withdrawing your consent is just as easy as granting it.

You can also delete or block cookies in your browser settings. Blocking essential cookies may cause the shopping cart, login, or other basic functions to malfunction.

9. Security

The administrator implements appropriate technical and organizational measures tailored to the risk, including connection encryption, access control, software updates, and backup copies. Access to data is granted only to individuals and entities for whom it is necessary.

10. Policy Changes

This policy may be updated in the event of changes to the law, the Store’s features, or the service providers used. The current version is always available on this page, along with the effective date.