Privacy policy
PRIVACY & COOKIES POLICY (B2B STORE)
§ 1. GENERAL INFORMATION
1. The controller of personal data collected through the online store available at shop.portmanlights.com (hereinafter: the "Store") is PORTMAN LIGHTS Sp. z o.o., with its registered office in Gdynia, ul. Chwaszczyńska 190D, 81-571 Gdynia, Poland, NIP: 5862310706, REGON: 365588200 (hereinafter: the "Controller" or "Portman Lights").
2. Contact with the Controller regarding personal data protection is possible via email at: office@portmanlights.com or by traditional mail to the Controller’s registered address.
3. As the Store is dedicated exclusively to business entities (B2B), the Controller primarily processes personal data of sole proprietors and data of employees, legal representatives, and contact persons designated by institutional Customers.
4. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR").
§ 2. PURPOSES, LEGAL BASES, AND DATA RETENTION PERIODS
The Controller processes personal data for the following purposes:
1. Account registration and business entity verification (including VIES validation):
• Legal basis: Art. 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate business interest – contractor verification).
• Retention period: Until the account is deleted by the Customer or verification is completed.
2. Execution of orders and sales contracts (including DAP delivery and payment processing):
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Retention period: For the period necessary to fulfill the order and deliver the goods.
3. Compliance with legal, tax, and accounting obligations (e.g., EU VAT invoicing):
• Legal basis: Art. 6(1)(c) GDPR in conjunction with applicable tax legislation.
• Retention period: For the mandatory period required by law to retain accounting documentation (generally 5 years from the end of the calendar year in which the tax obligation arose).
4. Service requests and warranty claims (RMA procedure via support.portmanlights.com):
• Legal basis: Art. 6(1)(b) GDPR (performance of contract/warranty terms).
• Retention period: Until the expiration of rights under the 2-year Manufacturer’s Warranty.
5. Establishment, exercise, or defense of legal claims:
• Legal basis: Art. 6(1)(f) GDPR (legitimate business interest in protecting the company’s legal rights).
• Retention period: Until the statutory limitation period for claims arising from commercial contracts expires.
§ 3. DATA RECIPIENTS AND INTERNATIONAL TRANSFERS (SHOPIFY)
1. For the proper operation of the Store, personal data may be transferred to trusted third-party service providers, including: electronic payment operators, courier and freight forwarders executing DAP deliveries, as well as IT and accounting software providers.
2. The primary provider of the Store’s technical infrastructure is Shopify (Shopify International Limited based in Ireland and Shopify Inc. based in Canada). Shopify processes data on behalf of Portman Lights as a data processor based on an executed Data Processing Addendum (DPA).
3. Due to the use of Shopify’s cloud infrastructure, personal data may be transferred outside the European Economic Area (EEA)—including to Canada (based on the European Commission's adequacy decision) and to the USA (based on Standard Contractual Clauses approved by the European Commission, incorporated into Shopify’s DPA).
§ 4. RIGHTS OF DATA SUBJECTS
Every data subject has the right to:
1. Access their personal data and receive a copy thereof.
2. Rectify (correct) their personal data.
3. Erasure of data ("right to be forgotten")—provided there are no overriding legal obligations preventing erasure (e.g., statutory tax document retention).
4. Restrict data processing.
5. Data portability.
6. Object to data processing (where processing is based on the Controller's legitimate business interest).
7. Lodge a complaint with the supervisory authority (in Poland: President of the Personal Data Protection Office - PUODO), if they consider that the processing of their personal data violates GDPR regulations.
§ 5. COOKIES AND TRACKING TECHNOLOGIES
1. The Store uses cookies and similar technologies to ensure proper functionality of the shopping platform, maintain user login sessions, and for statistical and analytical purposes.
2. In accordance with EU law, analytical or marketing cookies are blocked and will not be activated until the Customer grants voluntary and explicit consent via the privacy management banner (Cookie Preferences).
3. The Customer may change or withdraw their cookie settings at any time directly in their web browser or via the Cookie Pre
ferences tool available on the Store’s website.