Privacy policy
1. Controller and contact
The data controller is NORTH spółka z ograniczoną odpowiedzialnością, ul. Jarzębinowa 3, 84-110 Sobieńczyce, Poland, NIP 5871746099, KRS 0001101156. For personal-data matters, contact kontakt@northpure.pl or write to the controller’s address. We have not appointed a data protection officer; the controller handles data-protection matters using the contact details above. This policy covers the store at https://www.northpure.pl, accounts, orders, subscriptions, correspondence, forms and newsletters.
2. Data we receive and its sources
You provide contact and address details, order information and the content of enquiries, and, for invoices, company name, tax identification number and address. B2B forms collect company and contact-person information, with an optional expected order volume. If you represent a company, data may also be provided by that company. To the extent required for settlement, we receive payment statuses and identifiers from payment providers and delivery information from the carrier.
The platform records technical data, such as IP address, browser, security events and store usage. Additional analytics and marketing data depend on the services enabled and your consent. We do not ask for health information or other special-category data in contact forms. Please do not include it unless necessary to resolve your enquiry.
3. Purposes, legal bases and retention
| Purpose | GDPR legal basis | Period or criterion |
|---|---|---|
| Orders, delivery, payments, subscriptions and account management | Article 6(1)(b) — contract or pre-contractual steps | For performance of the contract and operation of the account/subscription; thereafter only for separate statutory purposes or claims |
| Tax, accounting and consumer-law obligations | Article 6(1)(c) — legal obligation | Under the relevant provisions; tax records generally until the tax liability becomes time-barred, usually five years from the end of the year in which tax was due, taking account of suspension or interruption; accounting documents under the applicable archiving rules |
| Establishing, exercising and defending claims | Article 6(1)(f) — legitimate interest in protecting rights | Until the relevant limitation period expires: generally six years, or three years for business-related claims, taking account of special provisions and events affecting the period; for disputes, until final resolution and settlement |
| Responding to pre-purchase enquiries | Article 6(1)(b) | Until the matter is resolved, then where necessary for claims |
| Other correspondence and contact with company representatives | Article 6(1)(f) — interest in correspondence and business relationships | Until correspondence ends, then as necessary to document arrangements; where it evidences a contract or claim, until the applicable claim becomes time-barred under the rules above. A simple enquiry with no further arrangements does not justify retention for the entire limitation period. |
| Consumer and B2B newsletters | Article 6(1)(a) — consent; communications consent as required by Polish electronic communications law | Until consent is withdrawn or the service ends. Limited evidence of consent and withdrawal may be retained until related claims become time-barred; data needed to respect an unsubscribe request are kept as long as necessary to prevent further sending. They are not used for further marketing. |
| Security and prevention of misuse | Article 6(1)(f) — interest in protecting the store and customers | As needed to detect and investigate incidents, considering log rotation in the service used. Data preserved for a specific incident are retained until it is resolved and the relevant claims become time-barred, without retaining all ordinary logs for that reason. Ask the controller for the period applicable to a particular record. |
| Optional cookies and related analytics/marketing | Article 6(1)(a) and required consent for device access/storage | According to the cookie policy and settings of the service concerned; earlier withdrawal stops further consent-based operations |
These bases concern different processing operations; they do not mean all data are always retained for the longest possible period. Deleting an account or withdrawing marketing consent does not delete records we must retain under another legal basis.
4. Recipients of data
- Shopify and providers supporting the platform, accounts, forms, messaging and subscriptions, to the extent their features are used. Roles and processing arrangements are described in Shopify’s DPA; its subprocessor list is available at Shopify subprocessors.
- Payment providers and institutions involved in settlement, according to the chosen method; to the relevant extent, they also act as independent controllers.
- DPD, for delivery and, where applicable, collecting cash-on-delivery payments.
- Appfleece, the Payflow provider, for data required by payment and delivery rules and enabled features. Provider policy: https://appfleece.com/privacy.
- Email and communications infrastructure providers, as necessary to handle correspondence.
- Authorised authorities and legal advisers where there is a legal basis and a need to disclose data.
We do not currently use additional external Google or Meta advertising or analytics systems.
5. Shopify and international transfers
Using Shopify’s infrastructure and its providers may involve processing outside the EEA. The relevant contracting entity, countries and transfer mechanisms follow Shopify’s current terms and DPA. Transfers rely, as appropriate, on adequacy decisions or standard contractual clauses and required safeguards. Contact the controller for information about the mechanisms used and how to obtain a copy of the safeguards.
The store runs on Shopify and uses Shopify Network Intelligence. Shopify also processes data through enhanced services for personalised experiences, tailored advertising and analysis of store interactions. For certain features, Shopify also acts as a separate controller under its policy and DPA. Required consent for optional operations is managed through the privacy settings. Shopify’s customer information is available at https://www.shopify.com/legal/privacy and https://privacy.shopify.com/.
6. Voluntary provision and your rights
Data necessary for ordering and delivery are required to complete a purchase; without them we cannot perform the contract. Mandatory tax information is required by law. Newsletters, optional cookies and expected order volume in the B2B form are voluntary. Failure to provide contact details may prevent us from responding.
Subject to GDPR conditions, you have the right to access and receive a copy of your data, rectify or erase it, restrict processing, and receive data portability where the conditions are met. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time without giving a reason.
You can withdraw consent as easily as you gave it: through the newsletter unsubscribe link, cookie privacy settings or by contacting us. Withdrawal does not affect the lawfulness of earlier processing. You may complain to the President of the Polish Personal Data Protection Office; current information is available at https://uodo.gov.pl/.
We verify requests proportionately without collecting excessive data. We generally respond within one month; in cases permitted by the GDPR, this period may be extended after informing you.
7. Automation and cookies
The system automatically handles subscription renewals and payment and delivery rules based on the selected conditions. We do not equate this with decision-making under Article 22 GDPR. Purchase events and technical information may be analysed for statistics, personalisation and fraud prevention within the Shopify features used; optional purposes require appropriate consent. Payment providers may carry out their own risk assessments under their policies, including for deferred-payment services. For decisions covered by Article 22 GDPR, the safeguards in that provision apply, including, where applicable, human intervention, expressing your point of view and contesting the decision.
Essential technologies support the cart, sign-in, security and saving consent choices, among other functions. You select other categories in the banner and can change them through “Privacy settings”. The separate cookie policy provides details. Cookie consent and newsletter consent are independent of one another.
Last updated: 1 November 2026. We will provide notice of material changes appropriate to their scope; a new policy does not retrospectively legitimise new processing purposes.