Privacy policy

Version effective from 1 November 2025

§1. Data Controller

1. The controller of personal data collected through the website www.vespoint.eu (hereinafter referred to as the “Website” or “Shop”) is Mariana Kozova, conducting business under the name VES Mariana Kozova, NIP (Tax ID): 9482633115, REGON: 521637027, registered address: ul. Andrzeja Struga 18, 26-600 Radom, Poland, e-mail: info@vespoint.eu.

2. The Controller has not appointed a Data Protection Officer (DPO). For all personal data matters, Users may contact the Controller directly via the e-mail address indicated above.

3. Rules regarding cookies are set out in the separate Cookie Policy.

§2. Legal basis and purposes of data processing

1. The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) and applicable national law.

2. The Controller processes Users’ personal data for the following purposes and based on the following legal grounds:

1. Order fulfilment – Article 6(1)(b) GDPR (performance of a contract or steps prior to its conclusion);
2. Issuing invoices or accounting documents – Article 6(1)(c) GDPR (legal obligation);
3. Responding to inquiries via forms, e-mail or phone – Article 6(1)(f) GDPR (legitimate interest of the Controller);
4. User account registration – Article 6(1)(b) GDPR (performance of a contract);
5. Submitting product reviews – Article 6(1)(a) GDPR (consent), in accordance with the Review Policy;
6. Newsletter delivery – Article 6(1)(a) GDPR (consent);
7. Direct marketing and remarketing – Article 6(1)(f) GDPR (legitimate interest of the Controller);
8. Tax and accounting obligations – Article 6(1)(c) GDPR (legal obligation);
9. Establishing or defending legal claims – Article 6(1)(f) GDPR (legitimate interest).

§3. Scope of processed data

The Controller processes only the personal data necessary for the stated purposes, including:

• Order details: name, surname, address, phone number, e-mail address, company data (if applicable: VAT number, business name);
• Account data: name, surname, e-mail address, password, login;
• Contact data: name, e-mail address, phone number, message content;
• Invoice data: name/surname or company name, address, VAT number, billing information;
• Marketing data: e-mail address (newsletter), cookies and online identifiers used by analytical tools.

§4. Data collection methods

Personal data is collected directly from Users when they:

• complete an order form, contact form or newsletter subscription form,
• create a user account in the Shop,
• contact the Controller via e-mail, telephone, or social media (Messenger, Instagram Direct, TikTok).

§5. Data recipients and international transfers

1. Personal data may be shared with trusted data processors acting on behalf of the Controller, such as:

• Payment operators: PayPal;
• Shipping providers: DPD, GLS;
• Hosting provider: Alwyzon.com;
• IT and technical support providers (including automated backups);
• External accounting services;
• Analytics and marketing service providers: Google, Meta, TikTok, Microsoft, Plausible, and Cookiebot.

2. Data may be transferred outside the European Economic Area (EEA), in particular to the United States, due to the use of services provided by some partners (e.g., Google, Meta, TikTok, Microsoft). Such transfers are carried out in compliance with Article 46 GDPR based on standard contractual clauses and appropriate safeguards.

§6. Profiling

The Controller may process Users’ personal data in an automated manner (profiling) for marketing purposes, including remarketing through tools such as Meta Pixel, TikTok Pixel, and Google Ads. Profiling does not produce any legal effects on the User nor significantly affect them.

§7. Data retention period

• Data related to contract performance – for the duration of the contract and the limitation period for claims (up to 6 years);
• Accounting and tax data – for 5 years from the end of the tax year;
• Newsletter and marketing data – until consent is withdrawn;
• Account data – until the User deletes their account or requests removal;
• Contact data – until correspondence is concluded.

§8. User rights

Under GDPR, each User has the right to:

• access their data, and request rectification or deletion,
• request restriction of processing,
• data portability (where processing is based on consent or contract),
• object to processing for marketing purposes,
• withdraw consent at any time – withdrawal does not affect the lawfulness of processing carried out before the withdrawal,
• lodge a complaint with the supervisory authority – President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

§9. Data security

The Controller applies appropriate technical and organisational measures to protect personal data, including SSL encryption, restricted database access, automatic backups, and certified EU-based hosting. These measures ensure confidentiality, integrity, and availability of the processed data.

§10. Cookies

Details on the use of cookies are set out in the Cookie Policy. Consent for cookies can be reviewed or modified at any time via the “Cookie settings” link in the website footer.

§11. Final provisions

1. The Controller reserves the right to amend this Privacy Policy, particularly in the event of introducing new Website functionalities or changes in applicable law.

2. The new version of this Policy takes effect on the date of publication on the Website. The effective date is indicated in the header of this document.

Last update: 1 November 2025