Privacy policy

PRIVACY AND COOKIE POLICY

shop.prodrone.pl

Effective from: 29 August 2026

We make antennas. To ship your order, issue an invoice and answer your message, we need a few pieces of information about you. This document says plainly which ones, what for, how long we keep them — and what you can tell us to do with them.

If anything here is unclear, write to bartek@prodrone.pl. A person answers, not a form.

1. Who is responsible for your data

The controller — the party deciding what happens to your data — is:

Bartłomiej Wawrzynkiewicz, trading as Prodrone.pl Bartłomiej Wawrzynkiewicz ul. Budowlana 55/10, 41-808 Zabrze, Poland VAT ID: PL6482281212, REGON: 363370951

Contact for data protection matters:

e-mail: bartek@prodrone.pl
phone: +48 725 908 725 (also WhatsApp)
post: address as above

We have not appointed a Data Protection Officer, because at our scale and type of activity the law does not require one (Art. 37(1) GDPR). You deal with us directly on everything.

We process data under the GDPR — Regulation (EU) 2016/679 — and under the Polish Personal Data Protection Act, the Act on Providing Services by Electronic Means, and the Telecommunications Law as regards cookies.

2. What data we hold about you

It depends on what you do here. If you only browse, essentially nothing beyond technical data. If you place an order, exactly what is needed for the parcel to reach you.

What	Specifically
Who you are	full name or company name
How to reach you	e-mail address, phone number
Where to ship	delivery address, billing address
Financial	VAT ID, bank account number (when we refund you), transaction history
Your order	what you ordered, the antenna parameters you specified, your order notes, our correspondence
Store account	username, e-mail, password (stored only as a cryptographic hash — we neither know it nor can read it)
Product review	the review text and, if you choose to give one, a name or other label
Technical	IP address, cookie identifiers, browser and device type, date and time of visit

We never see or store your card number. Card payments go entirely through PayPal or PayU — all we receive is whether the payment succeeded.

Providing data is voluntary, but without the fields marked as required we cannot fulfil the order, issue an invoice or handle a complaint. That is not a formality — without an address the parcel genuinely cannot be sent.

3. Why we need it, and on what legal basis

The GDPR requires every processing operation to have a legal basis. Here they are, spelled out.

What for	Legal basis
To fulfil your order and ship the goods	Art. 6(1)(b) GDPR — performance of a contract
To run your store account	Art. 6(1)(b) GDPR — performance of a contract
To handle a complaint, return or withdrawal from contract	Art. 6(1)(b) and (c) GDPR — contract and legal obligation
To issue an invoice and keep accounting records	Art. 6(1)(c) GDPR — tax and accounting obligations
To publish and moderate your product review	Art. 6(1)(a) GDPR (consent, given by submitting the review) and Art. 6(1)(f) GDPR
To handle a report of illegal content	Art. 6(1)(c) GDPR — Digital Services Act
To meet product safety obligations	Art. 6(1)(c) GDPR — GPSR Regulation
To answer your e-mail, phone call or WhatsApp message	Art. 6(1)(f) GDPR — our interest in communicating with you
To pursue or defend against legal claims	Art. 6(1)(f) GDPR
To protect the store against abuse and fraud	Art. 6(1)(f) GDPR
To see how the store is used (statistics)	Art. 6(1)(a) GDPR — your consent to analytics cookies
To show you our ads and measure how they perform	Art. 6(1)(a) GDPR — your consent to marketing cookies
To complete customs formalities for shipments outside the EU	Art. 6(1)(c) GDPR — customs rules

We do not run a newsletter. We do not send you marketing e-mails or text messages.

4. How long we keep it

Not "forever, just in case". Every category has its own deadline.

What	How long
Invoices and accounting records	5 years from the end of the calendar year in which the tax payment deadline fell — required by law, we cannot shorten it
Data needed in the event of a dispute	until claims become time-barred: as a rule 6 years, or 3 years for claims connected with business activity
Your account	until you delete it
Product review	until the review is removed or you withdraw consent
Correspondence	3 years from the last contact
Data from cookies you consented to	until you withdraw consent, and no longer than the cookie's lifetime
Server logs	up to 12 months

After that we delete the data or anonymise it so it can no longer be linked to you.

5. Who else sees your data

Nobody who does not need to. We do not sell data and we do not pass it to anyone for marketing purposes.

Your data reaches:

Shoper S.A. (Kraków, Poland) — the provider of the platform the store runs on, and our host. Acts on our instructions.
The operator of zwroty-shoper.pl — runs the withdrawal-from-contract function.
PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and PayU S.A. (Poznań, Poland) — if you pay online. They are separate controllers with their own privacy policies.
ING Bank Śląski S.A. — if you pay by transfer.
Carriers: InPost, Poczta Polska, DHL, FedEx, UPS, DPD, GLS, Orlen Paczka, Nova Post — they receive what they need to deliver. They are separate controllers.
Our accounting office — for invoice data.
IT and e-mail providers — acting on our instructions.
Analytics and marketing tool providers — Google, Meta, Pinterest, if you consented to the relevant cookies. Details in Annex 1.
Public authorities — where the law obliges us: tax authorities, customs, law enforcement, the Polish DPA.

6. Does data leave Europe

Sometimes, yes. We ship worldwide, and some web tools belong to US companies. This happens in three situations:

1. Shipping outside the European Economic Area. Your address details go to the carrier and to the customs authority of the destination country. Otherwise the parcel will not clear customs. Basis: Art. 49(1)(b) GDPR — transfer necessary to perform the contract you concluded with us.

2. US tools (Google, Meta, Pinterest). These companies are certified under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). That decision is in force, but an appeal is pending before the Court of Justice of the EU. If it were annulled, we would move these transfers onto Standard Contractual Clauses or stop using the tool. We only activate these tools with your consent.

3. WhatsApp. If you message us on WhatsApp, your data is processed by WhatsApp Ireland Ltd. on its own terms. This channel is entirely optional — you can e-mail or call instead.

Want to see a copy of the safeguards we apply to transfers? Ask and we will send them.

7. Do we make decisions automatically

No. No decision about you is made automatically here — we have no algorithm rejecting orders or scoring customers. Product reviews are read and approved by hand.

The one exception is advertising profiling: if you consent to marketing cookies, the providers of those tools may use them to select the advertising content shown to you. This has no legal effect on you, and you can switch it off with one click in the cookie settings panel.

8. What you can tell us to do

You have specific rights against us. Exercising them costs nothing — an e-mail to bartek@prodrone.pl is enough.

Find out what we hold about you and get a copy (Art. 15 GDPR).
Correct anything that is wrong (Art. 16 GDPR).
Delete your data, if we no longer need it and have no other basis to keep it (Art. 17 GDPR).
Restrict what we do with it (Art. 18 GDPR).
Move it to another provider (Art. 20 GDPR).
Object to processing based on our legitimate interest (Art. 21 GDPR).
Withdraw consent at any time. It does not undo what we did earlier on that basis, but from that moment we stop (Art. 7(3) GDPR).
Complain to the President of the Polish Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl — if you believe we are processing your data unlawfully. If you live in another EU/EEA country, you can also go to your local supervisory authority.

We respond without undue delay, at the latest within one month. If the matter is complex we may extend that by two months — but we will tell you, and explain why.

Two limits worth knowing in advance: we will not delete an invoice, because we are required to keep it for 5 years, and we will not delete data needed to defend against a claim until that claim expires. That is not our discretion — it follows from Art. 17(3) GDPR.

9. How we protect the data

The connection to the store is encrypted (TLS). Passwords are stored only as cryptographic hashes. Access is limited to authorised people bound by confidentiality. We take regular backups.

10. Cookies

What they are. A cookie is a small text file the site stores on your device. It holds information about how you use the site.

Our rule is simple: without your consent, only strictly necessary cookies run. Functional, analytics and marketing cookies start only once you click "I agree". You can change or withdraw consent at any time in the cookie settings panel in the store footer.

Type	What for	Consent needed
Strictly necessary	basket, session, login, form protection, remembering your cookie choices	no — without them the store simply will not work
Functional	remembering language and currency, the review module, recently viewed products	yes
Analytics	traffic measurement, usage statistics	yes
Marketing and social	social network plugins, remarketing, ad performance measurement	yes

How long they stay. Session cookies disappear when you close the browser. Persistent ones remain until they expire or until you delete them yourself in your browser settings.

Third-party cookies are governed by those companies' own privacy policies — links are in Annex 1.

You can also change cookie settings in the browser itself. Fair warning: blocking everything will break the basket and login.

11. Changes to this policy

The law changes and so do tools. If we update this policy, we will publish the new version in the store together with the date it takes effect. No change will limit the rights the GDPR gives you.

This Policy replaces the store's previous privacy policy.

ANNEX 1 — TOOLS THAT USE COOKIES

Analytics — your consent required

Google Analytics Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. What for: so we know how many people visit the store, which pages they view, where they come from and what they look for. Data collected includes the number and dates of visits, pages viewed, visit duration, referral source, browser and device type, approximate location, a truncated IP address, and an identifier assigned by Google. What we see: only aggregate reports about traffic in our own store. We do not see that it was specifically you. Privacy policy: https://policies.google.com/privacy

Shoper analytics tools Provider: Shoper S.A., Kraków, Poland — owner of the platform the store runs on. What for: aggregate analysis of how customers use stores on the platform (pages opened, time spent, products viewed, clicks, conversion rates). Shoper turns this into reports for merchants.
https://www.shoper.pl/polityka-prywatnosci-dla-osob-odwiedzajacych-sklepy-internetowe

Functional — your consent required

They enable extra store features: the product review and rating module, display of recently viewed products, remembering preferences. A full list is in the cookie settings panel.

Marketing and social — your consent required

Social network plugins and buttons Providers: Meta Platforms Ireland Ltd. (Facebook), Pinterest Europe Ltd. What happens if you enable them: the provider learns that your browser displayed our page — even if you are not logged in there and have no account. If you were logged in before visiting us, it can link that visit to your profile. Without your consent the plugins do not load. You can withdraw consent in the cookie settings panel. Privacy policies: https://www.facebook.com/privacy/policy , https://policy.pinterest.com/privacy-policy

Strictly necessary — always on

Session, login and basket handling, form protection, and remembering your choices in the consent panel. The store does not work without them, so they cannot be switched off.

Currency