Skip to main content

Privacy Policy of DriftZone.pl

1. General information

This Privacy Policy explains how we process personal data of people who visit the DriftZone.pl website (hereinafter: “Website”) and of people who contact our store or place orders with it. We describe the purposes and legal bases of processing, who we share data with, how long we keep it and what rights you have. We do so in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Polish Electronic Communications Law (Prawo komunikacji elektronicznej), the Polish Act on Providing Electronic Services and other applicable regulations.

The Website is informational. It does not allow orders to be placed or sales contracts to be concluded, and the contact form is used only to send enquiries to the store. We handle orders and purchases in the physical store and after contact by phone or e-mail.

Last updated: November 2026.

2. Data controller

The data controller is:

DriftZone.pl Patrycja Pawłowska-Szlage, ul. Koskowicka 44, 59-220 Legnica

  • Tax ID (NIP): 6912075976
  • Business Registry Number (REGON): 363965087

(hereinafter: “Controller”)

Contact with the Controller:

The Controller has not appointed a data protection officer.

4. Scope of data and whether providing it is voluntary

Depending on how you contact us, we process in particular:

  • data provided in the contact form: name, e-mail address, selected topic, message content and data provided voluntarily (e.g. part details, order number, technical details, company name)
  • technical data of the contact form: date and time of submission, result (accepted or rejected), selected topic and language and a hash of the IP address (not the address itself), without the content of the message
  • data from e-mail correspondence and phone calls: contact details and the content of the enquiry
  • data necessary to conclude and perform a sales contract: first and last name, phone number, e-mail address, delivery address, invoice details (if applicable) and information about the goods ordered
  • technical data recorded in server logs: IP address, date and time of the request, address of the page visited, browser and system type
  • data from analytics cookies (only with your consent): identifiers, information about pages visited and time of visit, device type and approximate location
  • data of authors of reviews displayed on the Website: name or nickname, rating, content and date of the review
  • data sent to Google when the map is displayed: IP address and technical data of the request

The contact form requires your name, e-mail address, topic and message. Without them we cannot reply to your enquiry. The other fields are optional. Providing the data needed to conclude and perform a sales contract is necessary for it to be carried out. Consent to analytics cookies is voluntary and does not affect access to the Website’s content.

5. Data recipients

Personal data may be shared with the following categories of recipients, only to the extent necessary for the stated purposes:

  • hosting, IT and e-mail service providers who maintain the Website and our mailbox
  • the accounting firm and legal and tax advisers
  • courier and postal companies, if we send ordered goods by parcel
  • Google (Google Analytics after consent, Google Maps and Google reviews), on the terms described in sections 6, 9 and 10
  • public authorities and other entities entitled under the law

We do not sell personal data.

6. Transfers of data outside the EEA

As a rule, we do not transfer personal data outside the European Economic Area. The exception is the use of Google services (Google Analytics after consent, and Google Maps), which may involve transferring data to the United States.

The transfer takes place on the basis of the European Commission implementing decision of 10 July 2023 finding an adequate level of data protection under the EU-U.S. Data Privacy Framework, provided that the recipient participates in that framework. In other cases, standard contractual clauses approved by the European Commission apply. You can obtain a copy of the safeguards by contacting us.

7. Data retention period

We keep data for the period necessary for the given purpose, and then for the time required by law or needed to protect claims:

  • enquiries from the form, e-mails and phone calls: until the enquiry has been dealt with, and then for up to 12 months to clarify any disputes
  • technical log of the contact form (IP address hash, date, result): up to 30 days
  • data from orders and sales contracts: until the contract is performed, and then until the limitation periods for claims expire (as a rule 3 or 6 years, counted to the end of the calendar year)
  • accounting and tax documents, including invoices: for the period required by law, as a rule 5 years counted from the end of the calendar year in which the tax obligation arose
  • complaints, statutory warranty, returns and exchanges: until the limitation periods for claims expire
  • server logs: up to 12 months
  • Google Analytics analytics cookies: up to 2 years or until you withdraw consent or delete the cookies
  • information about your cookie choices: until it is deleted from your browser or you change your choice
  • Google reviews: as long as they are visible on Google and on the Website

After these periods, we delete or anonymise the data, unless the law requires us to keep it longer.

8. Rights of data subjects

You have the right to:

  • access your data and obtain a copy of it
  • rectify your data
  • erase your data (“right to be forgotten”)
  • restrict processing
  • data portability, where we process data on the basis of consent or a contract and by automated means
  • object to processing based on our legitimate interest, on grounds relating to your particular situation
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
  • lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw)

To exercise these rights, write to rodo@driftzone.pl or contact us in another way indicated in section 2. We will reply without undue delay and no later than one month after receiving the request. If we have doubts about the identity of the person making the request, we may ask for additional information to confirm their identity.

We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

9. Cookies and similar technologies

The Website stores information on your device and reads it (cookies and the browser’s local storage). We store information necessary to remember your choices without consent, and analytics information (Google Analytics) only after you give consent. The list of files, their validity periods and how to manage your consent are described in the Cookie Policy.

You can change or withdraw your consent at any time using the consent tool available on the Website (, also in the footer). Withdrawing consent is as easy as giving it and does not affect the lawfulness of earlier processing. Not consenting to analytics cookies does not limit access to the Website’s content.

10. Third-party content and services

  • Google Maps: on the Contact page and in the Contact section of the home page, the Google map loads automatically, without a separate consent, to show the store’s location and help you get there. Your browser then connects directly to Google servers, which receive, among other things, your IP address and technical data of the request. No Google cookies or other data stored by the map in the browser were detected in our technical test, but we do not guarantee that Google never uses them. Google’s processing of data is described in Google’s privacy policy.
  • Google reviews: we display public reviews of the store taken from Google (name or nickname of the author, rating, content and date). Google is the source of this data. We process it to present the reviews (Art. 6(1)(f) GDPR) and do not send visitors’ data to Google.
  • Social media: the Website contains links to our profiles on Facebook, Instagram and X. The links themselves do not transmit data to those services, but when you click them you go to their pages, where their own data processing rules apply.

11. Data security

We apply appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access or disclosure.

12. Changes to this Privacy Policy

We may change this Policy, for example when the tools used on the Website or the law change. The current version is always available on the Website, and we inform you of significant changes to the purposes of processing before they take effect.