Privacy policy

1. Controller

The controller of your personal data is MOISS sp. z o.o., registered office in Wrocław, ul. Stanisława Leszczyńskiego 4/25, 50-078 Wrocław, KRS 0001254975, NIP 8971976015, REGON 545269929 ("we"). For anything concerning personal data, write to us at contact@velmois.com or to our registered office.

We have not appointed a data protection officer, because the law does not require us to.

2. In short

• We collect only the data the Website, Accounts and orders need.
• We use no external analytics tools or advertising cookies and do not sell data. We count the shop's statistics ourselves, on our server, without cookies and without recording who looked at what.
• The Website runs on a server in Poland that we manage ourselves, with no external hosting. Emails are sent through Scaleway from servers in France, and encrypted backups of the database are kept with Scaleway in Warsaw.
• Account data is kept until the Account is deleted, and order data for as long as tax law and the limitation of claims require. Technical data is deleted automatically after the periods in section 3.

3. Purposes, legal bases and retention

Purpose	Data	Legal basis	How long
Registering with an email address, until the Account is activated	email address, full name, password hash, language, accepted Terms version, time of registration	GDPR Art. 6(1)(b): steps taken at your request before entering into a contract	until the Account is activated, at most 24 hours after the last activation link was sent; deleted within an hour after that
Running the Account	email address, full name, password hash (we never know the password itself), language, Google account identifier (if you sign in with Google), Terms version accepted and time of acceptance	GDPR Art. 6(1)(b): performance of the Account contract	until the Account is deleted
Address book in the Account	first and last name, company name (optional), phone number, address	GDPR Art. 6(1)(b)	until the address or the Account is deleted
Account emails: activation link, setting a new password, changing the email address, notices of a changed password or email address	email address, language	GDPR Art. 6(1)(b)	links are single-use and expire after 1 hour (new password) or 24 hours (activation, email change); deleted within an hour of expiry; we keep an email's content only until it is sent, and delete the record that it was sent (the address, the kind of email, the time) after 30 days
Notice of an attempt to register an address that already has an Account	email address	GDPR Art. 6(1)(f): our legitimate interest in protecting the Account holder	the record that it was sent (the address, the kind of email, the time) is deleted after 30 days
Keeping you signed in	session identifier (only its hash is stored), browser and operating system name (user agent), session expiry	GDPR Art. 6(1)(b); for the browser name, Art. 6(1)(f) (Account security)	until you sign out, change or reset your password, or the session expires, at most 30 days after it was last used; deleted within an hour of expiry
The bag	the bag's contents and the discount code entered; without an Account, the bag identifier from its cookie (only its hash is stored), with an Account, the Account identifier; time of the last change	GDPR Art. 6(1)(b): performance of the contract for the bag	a bag without an Account: 30 days after its last change, deleted within an hour after that or as soon as you sign in (its contents move to the Account's bag); an Account's bag: until you order or remove the items or the Account is deleted
Concluding and performing the contract of sale: the order, payment, delivery and the order page	email address, phone number, full name, address, company name and NIP (if you want an invoice), Paczkomat code and address, the products ordered, their prices and discounts (with the discount code used; a code's limit per customer is checked by the orders' email address), delivery and payment method, the tracking number and the parcel's status with InPost, the version of the Terms of sale accepted, time of the order, Account identifier (if you order while signed in), the progress of the order, refunds and our staff's notes, the emails about the order (the confirmation with the Terms of sale and the withdrawal form, dispatch, cancellation, refund) and the record of their sending; the order's details also reach our own mailbox in our notices (a new order, a payment problem)	GDPR Art. 6(1)(b): steps before entering into the contract and its performance	an order not paid in time: deleted 7 days after the payment deadline; a paid order: 6 years from the end of the year in which it was completed (the limitation period for claims, Article 118 of the Polish Civil Code; GDPR Art. 6(1)(f)), then anonymised
Delivering a parcel to someone else, when you name them as the recipient of a courier parcel	the recipient's full name, phone number and address	GDPR Art. 6(1)(f): our and the buyer's legitimate interest in delivering the order to the person named	as long as the data of the order they belong to
Receipts, invoices and accounting records	the order data a document needs: full name or company name, address, NIP, products and amounts	GDPR Art. 6(1)(c): obligations under the Polish VAT and Accounting Acts	5 years from the end of the year in which the tax fell due
Blocking addresses we no longer write to	email address, Scaleway's report that the mailbox does not exist, its time	GDPR Art. 6(1)(f): our legitimate interest in not sending emails that will not arrive, and in keeping our emails deliverable	until the address is unblocked (for example at your request), at most 3 years from the report
Withdrawals and complaints	order data, the request and our answer	GDPR Art. 6(1)(c): obligations under the Polish Consumer Rights Act and Civil Code	as long as a paid order's data
Preventing abuse (limits on attempts to sign in, register, set a password and change Account details, and on the number of searches, bags created and orders placed)	IP address, email address entered in the form, Account identifier, number of attempts	GDPR Art. 6(1)(f): security of the Website and Accounts	up to 25 hours
Backups of the database	all personal data kept in the Website's database, listed above, as an encrypted copy	GDPR Art. 6(1)(f): our legitimate interest in protecting the data against loss and restoring the Website after a failure; this is also a security measure required by GDPR Art. 32	30 days from the backup; Scaleway deletes it within the following 2 days
Server logs	IP address, date and time, page address, response code and size, referring page, browser and operating system name	GDPR Art. 6(1)(f): security of the Website, detecting attacks and fixing errors	30 days
The shop's statistics: how many times on a given day each product and each collection was viewed, a product was added to the bag, an order was placed and a button on the home page was clicked, and which terms were typed into the search (how many times and whether they found anything); the most frequent terms whose every word found products (at least 3 times within 30 days) are shown to other visitors in the search as "Often searched"	daily totals only, with no IP address, cookie or identifier of any kind, so we do not know who looked at what or who typed a term; a term is stored in lower case as you type it, so do not type your personal data into the search; the browser name and the address of the previous page are checked only so as not to count robots or the same page shown again, and are not stored; admins' visits and orders are not counted	GDPR Art. 6(1)(f), our legitimate interest: improving our offer and the Website	25 months from the day they concern; we delete them within an hour after that
Correspondence with us	email address, the message and any data you include in it	GDPR Art. 6(1)(f): replying to you; where it concerns your Account, Art. 6(1)(b)	3 years after the matter is closed, or until the dispute ends if a related claim is raised in that time
Establishing, exercising or defending legal claims	data needed for the dispute	GDPR Art. 6(1)(f)	until the dispute ends

Deleting an Account immediately deletes all data stored in it: sessions, addresses, the bag, unused links and the link to a Google account. Orders placed are not deleted with the Account: we keep them for the periods above, no longer linked to the deleted Account. The deleted Account's data remains in the encrypted backups of the database until those are deleted (within 32 days at most, section 3); should we have to restore the database from a backup in that time, we delete it again.

4. Do you have to provide data?

An email address, full name and password (or Google sign-in) and accepting the Terms are required to create an Account; without them we cannot create one. Saving addresses is optional. The data in the order form is needed to conclude and perform the contract of sale and to issue a receipt; without it we cannot accept the order. You give a company name and NIP only if you want an invoice. InPost needs a Polish phone number for its delivery notices, including the code for collecting a parcel from a Paczkomat. Your IP address and browser details reach us automatically, because a page cannot be displayed without them.

If you send an order to someone else, we receive their details from you rather than from them. Give only the name, phone number and address needed for delivery, and tell the recipient that this policy describes how we use them. The recipient has the rights described in section 8, including the right to object.

5. Data from Google

If you sign in with Google, Google gives us your Google account identifier, verified email address and full name. It also sends the address of your profile photo, which we do not store. We never receive your Google password or access to any other data in your Google account.

6. Who receives data

1. Scaleway SAS (Paris) sends the Website's emails on our behalf from servers in France (Scaleway Transactional Email). It processes the email address and the message only to deliver it. It deletes the message's content once it is delivered, and keeps the record of the sending (recipient, subject, time and status) for as long as our sending domain is active with it. Addresses whose mailbox does not exist or is full it keeps on a blocklist, so that nothing is sent to them: for a week the first time, a month the second, and without a time limit from the third. It reports a mailbox that does not exist to us, so that we stop writing to it too (section 3). It also keeps our backups of the database in Warsaw (Scaleway Object Storage, section 3); we encrypt them on our server with a key Scaleway does not have, so it cannot read them.
2. Google Ireland Limited (Ireland):
   1. runs our mailbox (Google Workspace), so it processes your correspondence with us on our behalf;
   2. for Google sign-in, acts as a separate controller of your Google account data. When you click "Continue with Google" on the sign-in or registration page, we redirect you to Google's sign-in page, and once you have signed in Google sends you back to the Website. On its page Google receives your IP address and browser details and uses its own cookies. We load no Google scripts on the Website's pages. Google's processing is described in Google's privacy policy.
3. PayPro S.A. (Poznań), operator of Przelewy24, handles payments for orders. It receives the email address, full name, order number and amount, the address of the order page you return to after paying, and the data the chosen payment method needs, and for PayPo also the address. As a payment institution it processes them as a separate controller, as described in Przelewy24's privacy policy. For PayPo these data also go to PayPo sp. z o.o. (Warsaw), and for instalments you give your data to the lender you choose; both process them as separate controllers, to conclude and perform their contract with you, as described in their privacy policies.
4. InPost sp. z o.o. (Kraków):
   1. delivers parcels. It receives the recipient's full name and phone number (yours, or those of the person you name), your email address, the delivery address or Paczkomat code, the order number and the parcel's declared value. As a postal operator it processes them as a separate controller, as described in InPost's privacy policy;
   2. provides the map of Paczkomaty at checkout. When you open it, your browser loads the map's script from InPost's servers, and the map itself runs in a separate InPost frame we have no access to. InPost then receives your IP address, browser details and what you search for on the map, and, if you click the location button and allow it in your browser, your location. It processes them as a separate controller and passes us only the code of the point you choose.
5. Legal and accounting advisers, when needed. They are bound by professional secrecy or a processing agreement.
6. Public authorities, only where the law requires it, including tax authorities.

We use no external hosting, external fonts, external analytics tools or advertising networks. The only external script on the Website is InPost's map of Paczkomaty at checkout (section 6(4)(2)).

7. Transfers outside the European Economic Area

Google belongs to a group based in the United States, so although the data is stored in the EU, access from the US (for example for technical support) cannot be ruled out. Such transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, in which Google participates, and otherwise on standard contractual clauses approved by the European Commission. On request we will give you information about these safeguards.

8. Your rights

You have the right to:

1. access your data and receive a copy;
2. have your data corrected; you can change your name, email address and saved addresses yourself in your Account;
3. have your data erased;
4. restrict processing;
5. data portability for data we process to perform a contract;
6. object, on grounds relating to your particular situation, to processing based on our legitimate interest;
7. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl).

To exercise your rights, write to contact@velmois.com, preferably from your Account's email address. We reply within one month. If we cannot be sure the request comes from you, we will ask you to confirm your identity.

We do not process data on the basis of consent. We do not profile you or make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Temporarily blocking further sign-in attempts after a limit is exceeded (section 3) is a security measure, not such a decision.

9. Security

Connections to the Website are encrypted (HTTPS). Passwords are stored only as hashes (Argon2id), and session and bag identifiers and links sent by email as SHA-256 hashes. Links are single-use and short-lived. The link to an order page contains a random string of 43 characters that cannot be guessed; the order number alone does not open it. The database cannot be reached from the Internet, and only authorised people have access to the server.

10. Cookies

Cookies are small text files a website stores in your browser. The Website sets only cookies of its own, all strictly necessary for the service:

Name	Purpose	Set when	Lifetime
__Host-session	keeps you signed in to your Account	you sign in	30 days, renewed while you use the Website; deleted when you sign out
locale	remembers the Website's language	you change the language or open a page in a language other than your browser's	1 year
__Host-cart	points to your bag while you are not signed in (holds a random identifier)	you add a product to the bag without signing in	30 days from the bag's last change; deleted when you sign in
__Host-google-signin	secures Google sign-in (we check the random code it holds when you return from Google) and remembers which page of the Website to return to, in which language, and whether the Terms were accepted	you click "Continue with Google"	10 minutes; deleted when you return from Google

They serve only to provide the service you ask for, so under Article 399(3) of the Polish Electronic Communications Law they need no consent. We use no analytics, advertising or social media cookies, which is why the Website shows no consent banner. The shop's statistics (section 3) use no cookies or browser storage: our server counts them from the requests your browser sends anyway to show a page. If we ever start using them, we will ask for your consent first and update this policy.

On its sign-in page Google uses its own cookies (section 6(2)). They are described in Google's cookie policy.

InPost's map of Paczkomaty at checkout (section 6(4)(2)) stores the language chosen on the map (geo-lang) in your browser's storage, under InPost's domain. It serves only to show the map you ask for, so it needs no consent.

You can view and delete cookies in your browser settings. If you block the __Host-session cookie, you cannot sign in, and if you block __Host-cart, you cannot add products to the bag without signing in.

11. Changes to this policy

Each version of this policy states the date from which it applies. We email Account holders about significant changes before they take effect.