Privacy Policy

Last updated: 11 September 2026. This is a translation of the Polish version; in case of doubt, the Polish version prevails.

1. Who is the controller of your data

The controller of your personal data is BerryBoat Albert Pietrasik, ul. Żarnowcowa 12, 91-479 Łódź, Poland, NIP (tax ID) 7272637040, REGON 101004630.

Contact in personal data matters: shop@berryboat.eu.

We have not appointed a data protection officer, as we are not required to do so. In any matter concerning your data, simply write to the address above.

2. What this policy covers

This policy covers the processing of data in connection with:

• the berryboat.eu online shop in all language versions (Polish, English, German, Italian and Spanish),
• the sale of goods to businesses — for resale or for the purposes of their business activity,
• contact forms and lead forms on Meta services (Facebook, Instagram),
• business correspondence and order handling.

3. Whose data we process

Data of a sole proprietorship are personal data, even though they come from a public register. Data of companies are not — but data of the persons representing them are.

4. What data we collect

When creating an account and placing an order: first name and surname, e-mail address, phone number, company, address, NIP (tax ID) or EU VAT number, delivery address, order history.

When paying: data necessary to settle the transaction. We do not store payment card details — they go directly to the payment operator.

When submitting a form on Meta services: first name and surname, e-mail address, phone number, company name, NIP (tax ID) or EU VAT number, country, type of point of sale, and the content of the consents given together with a timestamp.

Automatically while using the website: IP address, cookie identifiers, browser and device type, traffic source, pages viewed, activity on the website. The scope depends on the consents given in the cookie banner.

5. Why and on what legal basis we process data

Providing data is voluntary, but without the data marked as required we cannot create an account or fulfil an order. Providing an EU VAT number is a condition of purchasing at the 0% VAT rate for an intra-Community supply.

Marketing consent is never a condition of purchase or of access to the wholesale price list. You can withdraw it at any time — via the link in the footer of every message or by e-mail. Withdrawal does not affect the lawfulness of what we did before.

6. Who we share data with

Recipients of data (including processors acting on our behalf):

Running the shop

• Dreamcommerce S.A. (Shoper) — provider and host of the shop platform.
• Provider of the contact widget used on the website.

Payments

• Payment operators (Stripe, PayU, Autopay, Przelewy24, PayPal, banks) — payment processing.

Delivery

• Furgonetka, Apaczka — parcel dispatch platforms.
• Carriers delivering the order — they receive the data needed to deliver the parcel.

Accounting

• An external accounting office keeping our books.

Marketing, statistics and measurement

Activated only after the relevant consent has been given in the cookie banner:

• Meta Platforms (Facebook, Instagram) — lead forms, pixel, measuring advertising effectiveness.
• Google (Google Ads, Google Analytics, Google Tag Manager) — statistics and advertising measurement.
• Hotjar — analysing how the website is used.
• TikTok — measuring advertising effectiveness.
• GetResponse — newsletter and e-mail marketing.

Handling requests

• Providers of tools for automating the handling of requests and correspondence, which we use when creating accounts and preparing messages.

Others

• Providers of legal, advisory and IT services — to the extent necessary.
• Public authorities — where required by law.
• Other providers of services necessary for customer service and order fulfilment.

7. Transfers of data outside the European Economic Area

Some providers of marketing and analytics tools are based in the United States. Data are transferred on the basis of:

• the European Commission's adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) — for providers certified under this framework, including Meta Platforms and Google,
• standard contractual clauses approved by the European Commission — in other cases and as a fallback basis.

You can obtain a copy of these safeguards by writing to shop@berryboat.eu.

8. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectify inaccurate data and complete incomplete data,
• erasure of your data when we no longer have a basis for processing it,
• restriction of processing,
• portability of data processed on the basis of consent or a contract,
• withdraw consent at any time, without affecting processing carried out before the withdrawal,
• object to processing based on our legitimate interest.

An objection to direct marketing is absolute — once you raise it, we stop processing your data for that purpose, without weighing anyone's interests.

Simply send your request to shop@berryboat.eu. We reply within one month.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl — or with the data protection supervisory authority of the EU country where you live or work.

9. Cookies

Necessary and functional cookies are always active — the shop cannot work without them. They handle the session, login, basket, security and remembering your choice in the consent banner. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) and Art. 399(3) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej), under which no consent is required for this category.

Analytics and marketing cookies are activated only after you give consent in the banner. You can change or withdraw your consent at any time in the cookie settings.

You can also manage cookies in your browser settings. Blocking necessary cookies will make it impossible to use the shop.

The retention periods given are those configured by the providers. Some cookies are renewed on every visit.

Necessary and functional

Analytics — only after consent

Marketing — only after consent

10. Automated decision-making

We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. We do not profile you in this sense.

Verification of the EU VAT number and registration data in a B2B relationship is a check in public registers, and the decision to activate the account is made by a human.

11. Security

Only authorised persons — those handling and packing orders — have access to customer data, on the basis of individual authorisations and to the extent necessary for their tasks. These persons are bound by confidentiality.

The connection to the shop is encrypted. Access to the admin panel requires an individual account protected by two-step verification.

12. Changes to this policy

We may change this policy — for example when we add a new tool or change a provider. We will announce material changes on the website and also notify newsletter subscribers by e-mail. The date of the last update is given at the top of this document.