Privacy Policy

1 Data controller and contact

The controller of personal data processed in connection with the use of the online store biowell-labs.pl is:

For all matters related to data processing you may contact the Controller directly using the details above.

2 Scope of processed data

Depending on how you use the Store, the Controller may process the following categories of data:

• identification and contact data, in particular first name, last name, company name, NIP, address, e‑mail and phone number;
• data related to the Account, Order history, returns, complaints and correspondence;
• transactional data, including Order number, amount, currency, transfer status and information necessary for settlement;
• delivery data, including recipient address, chosen delivery method and shipment number;
• technical data, such as IP address, cookie identifiers, device type, browser, operating system, logs and information about activity in the Store;
• data voluntarily provided in the contact form, newsletter, review or message to Customer Service.

The Controller does not require special categories of personal data, such as health information. Please do not provide such data unless it is necessary to resolve a specific matter.

3 Purposes and legal bases for processing

Providing data required during the Order process is voluntary but necessary to conclude and perform the contract. Providing data for the newsletter or contact form is voluntary, but without it a given service may not be possible to provide.

4 Recipients of data

Data may be disclosed only to the extent necessary for the purpose to the following categories of recipients:

• hosting companies, server administrators, software providers, e‑mail, backup and security service providers;
• carriers, logistics operators and entities handling deliveries;
• banks and institutions involved in settlement of traditional bank transfers;
• accounting firms, tax advisors, law firms and auditors;
• newsletter system and communication tool providers, if the Customer uses those services;
• providers of analytics, marketing tools or social media — only after consent to optional cookies has been given;
• public authorities, if the obligation to disclose data arises from law.

Processors acting on behalf of the Controller operate under contracts and only according to documented instructions from the Controller.

5 Transfers outside the European Economic Area

1. Core sales processes are organized using providers operating within the European Economic Area where possible.
2. Some IT, newsletter, analytics or marketing service providers may process data outside the EEA.
3. If such a transfer occurs, the Controller applies an appropriate GDPR legal basis, in particular an EU Commission decision finding an adequate level of protection or standard contractual clauses, and additional safeguards where necessary.
4. Information on safeguards for a specific transfer can be obtained by contacting the Controller.

6 Data retention periods

• Orders and contracts: for the duration of contract performance, and thereafter for the statute of limitations periods for claims.
• Accounting and tax documents: for the period required by tax law, generally 5 years counted from the end of the year in which the tax payment deadline expired.
• Customer Account: until it is deleted, and thereafter to the extent necessary for settlements, defense of claims and compliance with legal obligations.
• Complaints and returns: for the duration of the case and until the limitation period for related claims expires.
• Correspondence: for the time necessary to resolve the matter, and then for the period needed to demonstrate the course of contact or defend claims.
• Newsletter: until consent is withdrawn, an objection is raised or the service ends, with the possibility of retaining minimal data on a suppression list to respect objections.
• Cookies and analytics data: until consent is withdrawn or the cookie’s lifespan expires; details are available in the cookie settings.
• Security logs: for the period necessary to ensure security, detect abuse and investigate incidents.

7 Rights of data subjects

Under the GDPR, the data subject may have the right to:

• access the data and receive a copy;
• rectify or complete the data;
• erase the data;
• restrict processing;
• data portability for data processed based on consent or contract in an automated manner;
• object to processing based on legitimate interest;
• withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal;
• lodge a complaint with the President of the Personal Data Protection Office.

Requests can be submitted to info@biowell-labs.com.pl or by post to Karpiny, ul. Łąkowa 4, 82-522 Sadlinki. The Controller may ask for additional information necessary to confirm the identity of the requester.

The Controller will respond without undue delay, as a rule within one month. In cases provided by the GDPR the deadline may be extended by a further two months, about which the person will be informed with reasons.

8 Cookies and similar technologies

1. The Store uses cookies and similar technologies, i.e. small pieces of information stored or read on the User’s device.
2. Essential cookies enable the Store to function, logging in, maintaining the Cart, security, language selection and Order processing. They may be used without consent when necessary to provide a service requested by the User.
3. Functional, analytics and marketing cookies are activated only after consent is given, when consent is required by law.
4. The User may accept, reject or change consent settings in the cookie settings panel available on the site. Withdrawing consent is as easy as giving it.
5. Cookie settings can also be changed in the browser. Restricting essential cookies may cause some Store features, including the Cart or login, to not function correctly.
6. A detailed list of cookies used, providers, purposes and retention periods is presented in the consent management tool, if such a tool is active.
7. The Store may contain links to external services. When you visit such a service, the privacy rules of its operator apply.

9 Data security

1. The Controller implements technical and organizational measures appropriate to the risk, including HTTPS encrypted connection, access control, software updates, backups and mechanisms limiting unauthorized actions.
2. Account passwords are stored in a form secured by the WordPress/WooCommerce system and are not sent to the User in plain text.
3. The User should use a unique, strong password, protect their device and not share login data with third parties.
4. The Controller never asks for an Account password by e‑mail or telephone.

10 Changes to the Privacy Policy

1. The Policy may be updated particularly in connection with changes in law, Store functionality, used tools or the Controller’s data.
2. The current version is published in the Store with the effective date. Significant changes may also be communicated to Users appropriately.
3. Matters not regulated herein are governed by the GDPR, the Personal Data Protection Act and applicable privacy and electronic communications rules.
4. This Privacy Policy is effective from 28 July 2026.