Version dated 28 October 2026.
Data controller and contact
The controller is E-COMPLEX MAŁGORZATA PIASECKA, tax ID: 7991470330, REGON: 672768953, address: Bieszków Dolny 33A, 26-503 Bieszków Dolny, Polska. Contact us about personal data at minidropzone@gmail.com or +48 666 316 108. Correspondence address: MiniDropZone, ul. Kolejowa 31, 26-500 Szydłowiec, Polska. No data protection officer has been appointed; send privacy questions and requests directly to the email above.
Data, purposes and legal bases
- Orders and fulfilment: your name, email, phone, delivery address, products, variants and colours, notes and optional company and tax details — GDPR Article 6(1)(b), performance of a contract and pre-contractual steps.
- Accounting, tax records, complaints and withdrawal declarations — GDPR Article 6(1)(c), legal obligations. Online withdrawal declarations contain your name, contract reference, email, scope and receipt date. A submission identifier recognises repeated submission of the same declaration.
- Correspondence, establishing, exercising or defending legal claims, and technical operation and security — GDPR Article 6(1)(f). Our legitimate interests are answering enquiries, protecting our rights and securing the shop. Connection logs, IP addresses and technical browser data may be processed for these purposes.
- The cart, favourites and selected currency are stored to provide the functions you request — GDPR Article 6(1)(b). A random identifier in localStorage links the server-side cart and favourites to your browser.
Data comes from you and technical communication between your browser and the shop. Required details are necessary to handle an order; optional information is not a condition of purchase. Do not include sensitive or unnecessary information in order notes.
Recipients and protection
The controller and, where necessary, the following recipients or categories of recipients have access to data:
- OVHcloud — hosting, shop infrastructure and email services.
- The carrier handling your selected delivery, such as InPost, DPD or Pocztex/Poczta Polska — recipient and parcel details needed for delivery.
- The actual payment provider indicated in the cart — information needed to process a real payment, if you use one. A simulation marked as a test is not a transaction with a payment provider. The shop does not store your card number or security code.
- Banks and authorities entitled to receive data by law, as necessary for settlements or legal obligations.
We do not use an external accounting service or an additional email provider outside OVHcloud. Access to the admin panel and data is restricted to authorised people. Data is not sold or shared for other parties’ marketing.
If a selected service involves a transfer outside the European Economic Area, the transfer requires a basis under GDPR Chapter V, such as an adequacy decision or standard contractual clauses. Contact minidropzone@gmail.com for information about the recipient, country, safeguards and how to obtain a copy.
Retention
Order data is kept for contract performance and then the applicable limitation periods. These are generally six years, or three years for business-related claims, subject to exceptions and rules on when periods run. Tax records are generally kept for five years from the end of the year in which the tax payment was due, unless law requires longer.
Correspondence, complaints and withdrawal declarations are retained to handle the matter and subsequently as necessary for legal obligations and claims. Technical data and logs are retained according to their usefulness for running the shop and investigating incidents; records linked to a specific dispute may be needed until it is resolved. Backups serve data recovery and are subject to the same purpose and legal-basis restrictions as the original data. Data is deleted or anonymised when its legal basis ends.
Your rights
Under GDPR conditions, you may request access and a copy, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. Write to minidropzone@gmail.com. You may complain to the Polish supervisory authority, UODO. We do not use advertising profiling or solely automated decisions producing legal or similarly significant effects on you.
Cookies and browser storage
The cart and favourites identifier is stored exclusively in localStorage under minidropzone-cart-session until site data or the guest session is cleared. Their contents remain on the server. The old guest cookie is removed after the identifier is successfully transferred to localStorage. A necessary currency cookie stores only PLN or EUR for up to 30 days and does not identify the cart. The shop also uses an admin access cookie. The admin cookie is a session cookie whose storage is managed by the browser. Access does not automatically end because of inactivity. Logout removes the access cookie; changing the administrator’s authentication credentials invalidates previous access.
Address form values remain in the open tab’s memory until order submission. The only new localStorage entry is the cart/guest identifier. Address details, the admin token and the CSRF token are not stored in localStorage or sessionStorage. Admin working copies are stored on the server. A one-time transfer reads old browser cart and favourites data and removes it after successful transfer.
The shop does not run visitor analytics or advertising pixels and does not embed social media content. Instagram, Facebook and TikTok links open their external services only when clicked, where those services’ own policies apply. Necessary cookies serve the requested functions. You can delete or block site storage and cookies in your browser, which may prevent cart or admin use. Deleting the cart identifier or a cookie does not delete order records.
InPost parcel locker map
The map loads when you choose parcel locker delivery, where available. Your browser then connects to InPost and shares the IP address and technical information needed to display the map. You can also enter a point code. The selected point is verified with InPost and stored with the order separately from the buyer’s address details.
Updates
We update this policy when processing changes. Contact minidropzone@gmail.com with questions.