PRIVACY POLICY
version effective as of June 29, 2026
the previous version of the Privacy Policy is available here
WHAT IS THE PRIVACY POLICY?
We would like to introduce you to the details of how we process your personal data to provide you with full knowledge and comfort while using our website.
As we operate in the internet industry ourselves, we know how important the protection of your personal data is. Therefore, we make special efforts to protect your privacy and the information you provide to us.
We carefully select and apply appropriate technical measures, in particular those of a programming and organizational nature, ensuring the protection of the processed personal data. Our website uses encrypted data transmission (SSL), which ensures the protection of data identifying you.
In our Privacy Policy, you will find all the most important information regarding our processing of your personal data. We ask you to read it and promise that it will not take more than a few minutes.
Who is the administrator of the www.bhp-ex.com website?
The administrator of the website is BHP-EX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Gniezno, at ul. Franklina Roosevelta 89/A, 62-200 Gniezno, registered by the District Court Poznań - Nowe Miasto i Wilda in Poznań, IX Commercial Division of the National Court Register, KRS 0001084696, NIP 7842539430, REGON 52758283, with a share capital of: 100,000.00 PLN, BDO 00015228 (i.e.: us).
PERSONAL DATA
Which legal act regulates the processing of your personal data?
Your personal data is collected and processed by us in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), commonly known as: GDPR. To the extent not regulated by the GDPR, the processing of personal data is regulated by the Personal Data Protection Act of May 10, 2018.
Who is the administrator of your personal data?
The administrator of your personal data is BHP-EX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Gniezno, at ul. Franklina Roosevelta 89/A, 62-200 Gniezno, registered by the District Court Poznań - Nowe Miasto i Wilda in Poznań, IX Commercial Division of the National Court Register, KRS 0001084696, NIP 7842539430, REGON 52758283, with a share capital of: 100,000.00 PLN, BDO 00015228, email: [PLEASE INDICATE], phone: +48 732 228 500.
Regarding your personal data, you can contact us via:
e-mail: kontakt@bhp-ex.com,
traditional mail: ul. Franklina Roosevelta 89/A, 62-200 Gniezno,
contact phone number: +48 732 228 500.
HOW DO WE PROCESS THE PERSONAL DATA YOU PROVIDE TO US?
What personal data do we process and for what purposes?
On our website, we offer many different services, for which we process various personal data based on different legal grounds.
| Purpose | Personal Data | Legal basis for processing | Data retention period |
|---|---|---|---|
| conclusion and performance of the contract | first name, last name, correspondence address, NIP (Tax ID), e-mail address, phone number, delivery address, company name, registered company address | Art. 6(1)(b) GDPR, i.e. processing to take steps at your request prior to entering into a contract and processing necessary for the performance of a contract to which you are a party | until the expiration of the statute of limitations for claims regarding the performance of the contract |
| creating and maintaining an account | first name, last name, e-mail address, phone number, correspondence address, delivery address, company name, registered company address | Art. 6(1)(b) GDPR, i.e. processing to take steps at your request prior to entering into a contract and processing necessary for the performance of a contract to which you are a party | until the expiration of the statute of limitations for claims regarding the performance of the contract |
| contact form | first name, last name, e-mail address, phone number | Art. 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in maintaining continuity of communication and enabling contact with us in matters of business activity | until an objection is raised against the processing of personal data |
| newsletter | e-mail address, first name, phone number | Art. 6(1)(a) GDPR, i.e. processing based on your consent to the processing of your personal data | until the consent for personal data processing is withdrawn |
| interactive chat | first name, data provided during the conversation, phone number | Art. 6(1)(a) GDPR, i.e. processing based on your consent to the processing of your personal data | until the consent for personal data processing is withdrawn |
| "ask about a product" form | e-mail address | Art. 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in maintaining continuity of communication and enabling contact with us in matters of business activity | until an objection is raised against the processing of personal data |
| "notify of availability" form | e-mail address | Art. 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in maintaining continuity of communication and enabling contact with us in matters of business activity | until an objection is raised against the processing of personal data |
| website traffic analysis | location address, IP address, browser data | Art. 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in analyzing customer traffic on the store's website | until an objection is raised against the processing of personal data |
| direct marketing of own goods and services, including remarketing | browser data, first name, IP address, e-mail address | Art. 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in direct marketing of our own services, including remarketing | until an objection is raised against the processing of personal data |
| establishment, exercise, and enforcement of claims and defense against claims in proceedings before courts and other state authorities | first name, last name, residential address, PESEL number, NIP, REGON, e-mail address, phone number, IP number, bank account number, payment card number | Art. 6(1)(f) GDPR, i.e. processing for the purpose of our legitimate interest in the establishment, exercise, and enforcement of claims and defense against claims in proceedings before courts and other state authorities | until the expiration of the statute of limitations for claims regarding the performance of the contract |
| compliance with legal obligations arising from legal regulations, in particular tax and accounting regulations | first name, last name, company, PESEL number, NIP or REGON, e-mail address, phone number, correspondence address, payment card number | Art. 6(1)(c) GDPR, i.e. processing is necessary to fulfill legal obligations incumbent on us, arising from legal regulations, in particular tax and accounting regulations | until the expiration of the legal obligations incumbent on the Administrator that justified the processing of personal data |
Voluntary nature of providing personal data
Providing the required personal data is voluntary but constitutes a condition for us to provide services to you (e.g., sending a newsletter or creating an account).
Recipients of personal data
The current list of entities to which we disclose your personal data can be found here.
Automated decision-making (including profiling)
We use tools to direct personalized advertisements to you. Based on the actions you have taken in the Store, in particular the selection of viewed content and the time spent on the Store's subpages, we adjust and display marketing content tailored to you. Thanks to such profiling, we can direct marketing messages that are more desirable to you, which is a benefit for both us and you, because in this way we limit marketing messages regarding goods and services that are not in your area of interest.
Will we transfer your personal data outside the EEA or to an international organization?
To use Google, Facebook, Microsoft, and WhatsApp tools, your personal data may be transferred to the United States, where the servers of Google LLC, Meta Platforms Inc, Microsoft Corporation, and WhatsApp LLC are located, respectively.
Google LLC, Meta Platforms Inc, Microsoft Corporation, and WhatsApp LLC are listed in the registry of entities participating in the Data Privacy Framework program (link: https://www.dataprivacyframework.gov/s/participant-search), therefore the protection of personal data is adequate in relation to the regulations in force in the European Union, in accordance with the Commission Implementing Decision (EU) C(2023) 4745 of July 10, 2023, on the adequate level of protection of personal data according to the EU-USA Data Privacy Framework (link: https://eur-lex.europa.eu/legal-content/PL/TXT/PDF/?uri=CELEX:32023D1795&qid=1710923455391).
To use TikTok tools, your personal data may be transferred to the United States and Singapore, where the servers of TikTok Technology Limited are located.
TikTok Technology Limited, when transferring user information outside the EEA, the UK, or Switzerland, ensures an adequate level of data protection by relying on:
adequacy decisions or
standard contractual clauses. The European Commission has approved, under Art. 46 of the GDPR, contractual clauses that allow EEA companies to transfer data outside the EEA.
HOW DO WE PROCESS YOUR PERSONAL DATA THAT WE RECEIVE FROM OTHER DATA CONTROLLERS (E.G., FACEBOOK)?
Our online store allows for:
logging into the account in the store using your Facebook profile,
logging into the account in the store using your Google account.
In such cases, we receive your personal data not directly from you, but from the services providing these functionalities, i.e.: Facebook, Google. To allow you full control over your data, below we provide information on our processing of your personal data.
Categories of relevant personal data
We process the following categories of relevant personal data:
identification data (i.e. personal data that you have published in your profile on Facebook or Google, primarily first name, last name, nickname, e-mail address, and image).
Source of personal data
Your personal data comes from the service:
Facebook, whose administrator is Meta Platforms Ireland Limited,
Google, whose administrator is Google Ireland Ltd.
Purposes and legal bases for personal data processing
Your personal data that we have obtained will be processed for the following purposes:
| Purpose | Personal Data | Legal basis for processing | Data retention period |
|---|---|---|---|
| logging into the account in the store using a Facebook profile | first name, last name, image | Art. 6(1)(f) GDPR, i.e. processing for the purpose of the Administrator's legitimate interest in enabling you to log in to your account in the online store using your profile on Facebook | until the account in the store is deleted |
| logging into the account in the store using a Google account | first name, last name, image | Art. 6(1)(f) GDPR, i.e. processing for the purpose of the Administrator's legitimate interest in enabling you to log in to your account in the online store using your profile on Google | until the account in the store is deleted |
WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH OUR PROCESSING OF YOUR PERSONAL DATA?
Based on the GDPR, you have the right to:
request access to your personal data,
request rectification of your personal data,
request erasure of your personal data,
request restriction of personal data processing,
object to the processing of personal data,
request personal data portability.
If any of the above-mentioned requests are reported to us without undue delay – and in any case within one month of receiving the request – we will provide you with information on the actions taken in connection with your request.
If necessary, we can extend the one-month period by another two months due to the complex nature of the request or the number of requests.
In any case, we will inform you within one month of receiving the request about the extension of the deadline and provide you with the reasons for the delay.
Right of access to personal data (Art. 15 GDPR)
You have the right to obtain information as to whether we process your personal data. If we process your personal data, you have the right to:
access the personal data,
obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of this data, the planned storage period of your data or the criteria for determining this period, about the rights you have under the GDPR and about the right to lodge a complaint with the President of the Personal Data Protection Office, about the source of this data, about automated decision-making, including profiling, and about the safeguards used in connection with the transfer of this data outside the European Union;
obtain a copy of your personal data.
If you want to request access to your personal data, submit your request to the following address: kontakt@bhp-ex.com.
Right to rectification of personal data (Art. 16 GDPR)
If your personal data is incorrect, you have the right to request immediate rectification of your personal data from us. You also have the right to request that we supplement your personal data. If you want to request rectification or supplementation of your personal data, submit your request to the following address: kontakt@bhp-ex.com.
Right to erasure of personal data, the so-called "right to be forgotten" (Art. 17 GDPR)
You have the right to request the deletion of your personal data when:
your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
you have withdrawn a specific consent, to the extent that the personal data was processed based on your consent;
your personal data was processed unlawfully;
you have objected to the processing of your personal data for direct marketing purposes, including profiling, to the extent that the processing is related to direct marketing;
you have objected to the processing of your personal data in connection with the processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of legitimate interests pursued by us or a third party.
Despite the request for deletion of personal data, we may process your data further for the purpose of establishing, exercising, or defending claims, about which you will be informed.
If you want to request the deletion of your personal data, submit your request to the following address: kontakt@bhp-ex.com.
Right to request restriction of personal data processing (Art. 18 GDPR)
You have the right to request the restriction of the processing of your personal data when:
you question the correctness of your personal data – in this case, we will restrict the processing of your personal data for a period allowing us to check the correctness of this data;
the processing of your data is unlawful, and instead of deleting personal data, you request the restriction of the processing of your personal data;
your personal data is no longer needed for processing purposes, but it is needed to establish, exercise, or defend your claims;
you have objected to the processing of your personal data – until it is determined whether our legitimate interests override the grounds indicated in your objection.
If you want to request the restriction of the processing of your personal data, submit your request to the following address: kontakt@bhp-ex.com.
Right to object to the processing of personal data (Art. 21 GDPR)
You have the right to object at any time to the processing of your personal data, including profiling, in connection with:
processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of legitimate interests pursued by the personal data Administrator or a third party;
processing for direct marketing purposes.
If you want to object to the processing of your personal data, submit your request to the following address: kontakt@bhp-ex.com.
Right to request personal data portability (Art. 20 GDPR)
You have the right to receive your personal data from us in a structured, commonly used, machine-readable format and to send it to another personal data administrator.
By default, we will provide you with your personal data in CSV format. If you prefer the data to be provided in a different format, please indicate the preferred format in your request. Whenever possible, we will try to provide you with the data in your preferred format.
You can also request that we send your personal data directly to another administrator (if technically possible).
If you want to request personal data portability, submit your request to the following address: kontakt@bhp-ex.com.
Can you withdraw your consent to personal data processing?
You can withdraw your consent to the processing of your personal data at any time. Withdrawal of consent to the processing of personal data does not affect the lawfulness of the processing carried out by us based on your consent before its withdrawal.
If you want to withdraw your consent to the processing of your personal data, submit your request to the following address: kontakt@bhp-ex.com.
In case you want to withdraw consent to personal data processing for the purpose of providing the "Newsletter" service, you can unsubscribe from it here.
Complaint to the supervisory authority
If you believe that the processing of your personal data violates personal data protection regulations, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office, who replaced the GIODO on May 25, 2018.
More information can be found here.