Privacy and cookie policy (GDPR) | Maxi Expo

Privacy Policy

Last updated: 14 August 2026

This Privacy Policy sets out the rules for processing personal data in connection with using the website www.maxiexpo.pl, the online shop operated by Maxi Expo Artur Kanecki, placing orders, sending enquiries and using the services offered by the Controller.

The Controller processes personal data in accordance with applicable law, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”),
• the Polish Personal Data Protection Act of 10 May 2018,
• the Polish Electronic Communications Law of 12 July 2024,
• other relevant provisions on personal data protection and the provision of electronic services.

1. Personal data controller

The controller of personal data is:

For matters relating to personal data protection and exercising your rights under the GDPR, you can contact the Controller using the email address above or by post.

---

2. What personal data may we process?

Depending on how you use the website and our services, we may process in particular:

• full name,
• company name,
• Tax ID (NIP) number,
• email address,
• phone number,
• delivery address,
• billing address,
• order data,
• purchase history,
• complaint and return data,
• information about the status and chosen payment method,
• data contained in forms and correspondence,
• IP address,
• online and device identifiers,
• information about the browser and operating system,
• data on user activity on the website,
• information stored using cookies and similar technologies.

As a rule, we do not require the provision of special categories of personal data referred to in Art. 9 GDPR.

---

3. Purposes and legal bases of processing

• fulfilling orders, preparing offers and performing agreements – Art. 6(1)(b) GDPR,
• maintaining the customer account – Art. 6(1)(b) GDPR,
• issuing invoices and fulfilling tax and accounting obligations – Art. 6(1)(c) GDPR,
• responding to enquiries and conducting correspondence – Art. 6(1)(b) or (f) GDPR, depending on the nature of the enquiry,
• handling complaints – Art. 6(1)(b), (c) or (f) GDPR,
• establishing, pursuing or defending claims – Art. 6(1)(f) GDPR,
• protecting the website, preventing abuse and ensuring the security of systems – Art. 6(1)(f) GDPR,
• keeping basic technical statistics – Art. 6(1)(f) GDPR to the extent not requiring consent,
• web analytics using optional cookies – after obtaining the user's required consent,
• marketing and measurement of advertising campaigns using optional technologies – after obtaining the required consent,
• sending newsletters and commercial information – after obtaining the required consent.

---

4. Legitimate interest of the Controller

The Controller's legitimate interest may include:

• protection against abuse and fraud,
• ensuring the security of the website and IT infrastructure,
• keeping necessary business statistics,
• serving customers and business partners,
• marketing its own products and services to the extent permitted by law,
• establishing, pursuing and defending claims.

---

5. Data of persons representing B2B customers and business partners

As part of our cooperation with businesses, we may process data of persons representing customers and business partners, their employees, associates and designated contact persons.

The data may come directly from the data subject, from the company they represent or from publicly available sources such as business registers or company websites.

The data usually include the full name, position or role, business email address, phone number and information necessary for the cooperation.

The legal basis for processing is the Controller's legitimate interest in communicating and conducting business cooperation – Art. 6(1)(f) GDPR.

---

6. Recipients of personal data

Data may be shared with entities that support the Controller in conducting its business, in particular:

• hosting and IT infrastructure providers,
• IT service providers,
• payment operators,
• banks,
• courier and transport companies,
• postal operators,
• accounting service providers,
• law firms and advisers,
• email service providers,
• analytics and marketing service providers,
• website security service providers,
• public authorities, where the obligation to share data arises from law.

---

7. Hosting – AZ.pl

The website may use hosting infrastructure provided by AZ.pl Sp. z o.o.

In connection with providing hosting services, the provider may process technical data necessary to maintain the website, email and server infrastructure, including in particular:

• IP address,
• data recorded in server logs,
• information about requests sent to the server,
• data stored as part of the website, databases or email.

The hosting provider processes data to the extent necessary to provide hosting services and ensure infrastructure security.

---

8. Cloudflare

The website uses the services of Cloudflare that support the security, availability and performance of the website.

Cloudflare may act as an intermediary in network traffic between the user's device and the Maxi Expo server. As part of providing its services, the following may be processed in particular:

• IP address,
• date and time of connection,
• address of the requested resource,
• information about the browser and device,
• technical data related to network traffic,
• information used to detect attacks, bots and abuse.

Cloudflare is used in particular to protect the website against attacks, increase its availability, provide CDN services, optimise traffic and improve website performance.

---

9. Google Tag Manager

The website may use Google Tag Manager, a tool for managing scripts and tags used on the website.

Google Tag Manager is used primarily for the technical management of integrations such as analytics or advertising tools.

Google Tag Manager itself is not used by Maxi Expo as a tool for profiling users. Individual tags launched through it are subject to the consent rules appropriate for each tool.

---

10. Google Analytics

After obtaining the required consent, the website may use Google Analytics to analyse how the website is used.

Google Analytics may process in particular:

• information about pages visited,
• time spent on the website,
• the source of the visit,
• approximate geographic information,
• device and browser data,
• online identifiers,
• information about user interactions with the website.

The data are used to prepare statistics, analyse traffic and improve the functioning of the website.

Google Analytics, which requires optional cookies, is launched according to the user's choice made in the consent management mechanism.

---

11. Google Ads

After obtaining the required consent, the website may use Google Ads tools for running and measuring advertising campaigns.

Google Ads tools may be used in particular to:

• measure the effectiveness of ads,
• conversion measurement,
• analyse actions taken after clicking an ad,
• run remarketing, if the user has given the appropriate consent,
• tailor advertising content according to the user's consent settings.

Optional advertising technologies are launched only in accordance with the user's decision regarding marketing cookies.

---

12. Google services and consent management

For Google services, the website uses a consent management mechanism that lets the user accept or reject optional analytics and marketing technologies.

Not consenting to optional cookies should not prevent the use of the shop's basic functions.

The user can change their previous choice at any time using the privacy settings available on the website.

---

13. PayU – electronic payments

If electronic payment is chosen, the data necessary to complete the transaction are shared with the payment operator PayU S.A.

The data shared with PayU may include in particular:

• full name,
• email address,
• order information,
• transaction amount,
• transaction ID,
• other data required to process and settle the payment.

PayU processes payment-related data in accordance with its own legal obligations and data protection rules.

Maxi Expo does not store customers' full payment card details. Data required to authorise card payments are processed by the payment operator.

---

14. Order delivery

To deliver your order, the data necessary to deliver the shipment may be shared with the courier and transport companies handling the order, including, depending on the chosen delivery method, DPD, FedEx or DHL.

The data may include:

• full name or company name,
• delivery address,
• phone number,
• email address,
• information necessary to identify and deliver the shipment.

---

15. Data retention period

Data are stored only for as long as necessary to achieve the purpose for which they were collected, and then for the period required by law or needed to secure claims.

In particular, data may be stored:

• for the duration of the agreement and order handling,
• for as long as the customer account is maintained,
• for the period required by tax and accounting regulations,
• until the relevant limitation period for claims expires,
• until an objection is effectively raised, if the legal basis is Art. 6(1)(f) GDPR,
• until consent is withdrawn, if the legal basis for processing is consent, unless further processing is permitted on another legal basis.

---

16. Rights of data subjects

Under the terms set out in the GDPR, the data subject may have the right to:

• access their data,
• obtain a copy of the data,
• rectify the data,
• request erasure of their data,
• restrict processing,
• data portability, if the conditions set out in the GDPR are met,
• object to processing based on Art. 6(1)(f) GDPR,
• withdraw consent at any time, if processing is based on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

---

17. Right to lodge a complaint

---

18. Voluntary provision of data

Providing personal data is generally voluntary, but some data are necessary to conclude and perform an agreement, fulfil an order, issue an invoice or respond to an enquiry.

Failure to provide the required data may prevent us from providing a particular service.

---

19. Profiling and automated decision-making

Data on the use of the website may be used – in accordance with the consents given – for statistical analysis, campaign measurement and ad targeting.

The Controller does not make decisions about users based solely on automated processing that would produce legal effects or similarly significantly affect the user within the meaning of Art. 22 GDPR.

---

20. Transfers of data outside the European Economic Area

Some technology service providers, in particular Google or Cloudflare and their subcontractors, may process data outside the European Economic Area.

When data are transferred to a third country, the mechanisms provided for by the GDPR are applied, depending on the specific case, in particular:

• European Commission decisions finding an adequate level of protection,
• Standard Contractual Clauses (SCC),
• other appropriate safeguards provided for by applicable law.

---

21. Data security

The Controller applies appropriate technical and organisational measures to protect data against:

• unauthorised access,
• disclosure,
• loss,
• destruction,
• unauthorised modification.

The connection to the website uses SSL/TLS encryption.

To increase the security and availability of the website, traffic filtering, attack protection and CDN mechanisms may also be used.

---

22. Cookies and similar technologies

On the website we distinguish the following categories:

Necessary cookies

They are required for the proper and secure functioning of the website and shop, including session handling, the cart, privacy settings and security.

Analytics cookies

They help measure traffic and how the website is used. They may be used by Google Analytics, among others, and are applied according to the user's consent decision.

Marketing cookies

They are used to measure the effectiveness of ads, conversions and marketing activities. They may be associated with Google Ads services, among others, and are applied according to the user's choice.

Optional technologies that require consent are launched only after consent is obtained.

The user can:

• accept all optional categories,
• keep only necessary cookies,
• choose categories individually,
• change or withdraw consent at any time.

Withdrawing consent should be as easy as giving it.

Detailed information on cookies can be found in the separate Cookie Policy.

---

23. Server logs

Using the website sends requests to the server. Information about these requests may be recorded in system logs.

Logs may include, among others:

• IP address,
• date and time of the request,
• address of the requested resource,
• information about the browser and device,
• server response code,
• information about errors and security.

Log data are used in particular to administer the website, ensure security, diagnose errors and prevent abuse.

---

24. Contact forms and correspondence

When you contact Maxi Expo via a form, email or phone, we process the data provided to the extent necessary to reply, prepare an offer, handle your enquiry or carry out our cooperation.

Please do not provide data that are not necessary to handle the matter.

---

25. Links to other websites

The website may contain links to websites of other entities. Once you go to an external website, the data processing rules are set by its owner or operator.

---

26. Changes to the Privacy Policy

The Controller may update this Privacy Policy, in particular in the event of:

• changes in the law,
• changes to how data is processed,
• introduction of new functionalities,
• changes to the services or technology providers used.

The current version of the Privacy Policy is published on the website together with the date of the last update.

---

27. Contact

To exercise your rights regarding personal data or obtain further information, please contact us:

Maxi Expo Artur Kanecki ul. Potocka 31, 01-619 Warsaw, Poland, email: info@maxiexpo.pl

The Controller responds to requests regarding personal data on the terms and within the time limits set by applicable law.