Privacy policy
Effective from 1 November 2026
This policy explains what personal data we collect on the wipcool.pl website, why we do so, to whom we disclose it and what rights you have. It applies together with the Website Terms and the Cookie Policy. We fulfil our information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
In brief
- The data controller is 4REF sp. z o.o. of Białystok, the distributor of the Wipcool brand in Poland and Europe.
- The website is a product catalogue. We do not sell through it and we do not create user accounts.
- On every visit we process only the technical data needed to operate and protect the website (e.g. IP address). You provide any other data yourself when you write to us, subscribe to the newsletter or submit a device for service.
- The website does not have its own personal data database: messages reach us by e-mail and service requests go to our service system.
- We enable our own anonymous statistics and Google Analytics 4 only after you consent to analytics cookies, and Google and Meta advertising tools (Meta Pixel) only after you consent to marketing cookies. All of them are disabled by default.
- You can exercise your rights at any time by writing to bok [at] wipcool.pl.
1. Data controller
The controller of your personal data is 4REF spółka z ograniczoną odpowiedzialnością, with its registered office in Białystok, ul. Gen. Władysława Andersa 38, 15-113 Białystok, entered in the Register of Entrepreneurs of the National Court Register by the District Court in Białystok, 12th Commercial Division of the National Court Register, under KRS number 0000645680, NIP (tax ID) 5423262230, REGON 365817646, share capital PLN 100,000.00 (hereinafter: ‘4REF’, ‘we’).
For matters concerning personal data you can write to bok [at] wipcool.pl, call +48 85 888 00 85 or write to our registered office address. We have not appointed a data protection officer, as the law does not require us to do so. We handle all data-related matters at the addresses given.
2. What data, why and on what legal basis
Below we describe each purpose separately. For each one we state the legal basis under Article 6(1) GDPR and the retention period. Once it expires, we delete the data or anonymise it so that no one can be identified any longer.
| Purpose | What data | Legal basis | How long |
|---|---|---|---|
| Providing the website and keeping it secure (protection against attacks, abuse and spam) | IP address, date and time of access, address of the page visited, browser and device information, technical signals needed for Cloudflare Turnstile verification | Article 6(1)(f) GDPR, i.e. our legitimate interest: secure and stable operation of the website | technical logs for up to 7 days; data used to limit the number of submissions from a single IP address for a few minutes |
| Replying to a message sent via the contact form, by e-mail or by telephone | first name and surname, e-mail address, company, country, subject, the product the enquiry concerns, message content and, for telephone calls, the telephone number and notes from the call | Article 6(1)(f) GDPR (replying to the enquiry and business contact); where the enquiry concerns the conclusion of a contract, also Article 6(1)(b) GDPR | for the duration of the correspondence and then for up to 3 years after it ends, in case of further questions or claims |
| Newsletter: sending information about new products, promotions and updates to Wipcool products | e-mail address, website language, date of subscription and confirmation, information on message opens and clicks, if collected by the mailing system | Article 6(1)(a) GDPR (your consent) and consent to direct marketing by electronic means under Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej); retention of proof of consent after unsubscribing: Article 6(1)(f) GDPR (demonstrating compliance with the law and defence against claims) | until you unsubscribe or withdraw consent; after that we keep only the address and the consent history for up to 3 years to demonstrate that the mailing was lawful |
| Receiving and handling a service request: processing a manufacturer warranty claim, warranty or post-warranty repair, arranging shipments, contact regarding the order | model, serial number, fault description, type of repair, date and place of purchase, first name and surname, company name, NIP or VAT number, e-mail address, telephone, address, country, parcel locker or return address, website language, contact person at the company | Article 6(1)(b) GDPR (performance of the manufacturer warranty and the repair contract, and steps taken at your request before entering into it); for data of a contact person at a company, Article 6(1)(f) GDPR | for the duration of handling the request and then until the limitation periods for claims expire (as a rule 6 years, and 3 years for claims related to business activity) |
| Decision on the cost of a post-warranty repair sent from the service request page | order identifier and number, choice (acceptance or withdrawal), quoted amount, time of sending | Article 6(1)(b) GDPR | as for service request data |
| Accounting and tax documents (e.g. invoice for a repair) | data from the document: first name and surname or company name, address, NIP, subject and amount of the service | Article 6(1)(c) GDPR (legal obligation arising from tax and accounting legislation) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Our own website statistics: which ‘Buy online’ and ‘Where to buy’ buttons, downloads and product selector groups are used and what is searched for in the search engine | type of click, shop, file or product, country selected on the website, language, search phrase with the number of results; without IP address and without identifiers - we discard phrases that look like an e-mail address or telephone number | your consent to analytics cookies (Article 399 of the Polish Electronic Communications Law and, to the extent that this would be personal data, Article 6(1)(a) GDPR) | the statistics are anonymous; we keep aggregated data for up to 3 months |
| Traffic analysis in Google Analytics 4: where users come to the website from and how they use it | identifiers from Google Analytics cookies, pages visited, traffic source (e.g. search engine, advert), visit duration, device and browser information, approximate location determined from the IP address (Google does not store the IP address in Google Analytics 4) | Article 6(1)(a) GDPR (your consent to analytics cookies, also given under Article 399 of the Polish Electronic Communications Law) | event data for up to 14 months from collection (data retention setting in Google Analytics 4); cookies for up to 2 years or until deleted |
| Google advertising: measuring the effectiveness of Google Ads and displaying Wipcool adverts in Google services to people who have visited the website (remarketing) | data collected by Google Analytics 4 (as above), including information on arrival from a Google advert; in Google Consent Mode (Consent Mode v2) we pass on to Google consent to storing advertising cookies (ad_storage), using data for advertising purposes (ad_user_data) and ad personalisation (ad_personalization) | Article 6(1)(a) GDPR (your consent to marketing cookies); this works only if you also consent to analytics cookies, because without that consent we do not load the Google script | as for data in Google Analytics 4; advertising audience lists according to the Google Ads account settings; thereafter according to the Google policies described in section 4 |
| Measuring advertising effectiveness and displaying Wipcool adverts on Meta services (Facebook, Instagram) to people who have visited the website | identifier from the Meta Pixel cookie, pages visited, device and browser information, IP address | Article 6(1)(a) GDPR (your consent to marketing cookies, also given under Article 399 of the Polish Electronic Communications Law) | cookie for up to 3 months; data transferred to Meta according to the Meta policies described in section 4 |
| Establishing, pursuing or defending claims | data needed in the matter concerned, e.g. from correspondence or a service request | Art. 6(1)(f) GDPR | until the limitation periods for claims expire |
| Handling your requests concerning personal data | data from the request and related correspondence | Art. 6(1)(c) GDPR in conjunction with Articles 12–22 GDPR | 3 years from the matter being resolved |
You provide the data directly. If a service request or message is sent on your behalf by your employer or a colleague, we receive the contact person's data (first name, surname, email, telephone) from them.
3. Do you have to provide data
Providing data is voluntary. Without the data marked as mandatory in the form, we will not reply to your message, sign you up for the newsletter or accept your service request. For a paid repair, providing invoicing data is a statutory requirement.
4. Who we share data with
We share data only when this is necessary for the purposes described above. Service providers that process data on our behalf (processors) act under a data processing agreement pursuant to Art. 28 GDPR and only on our instructions.
| Recipient | Role and scope | Where data is processed |
|---|---|---|
| Cloudflare, Inc. (USA) and its group companies | processor: website and file hosting, content delivery network, protection against attacks and bots (including Cloudflare Turnstile), technical logs, anonymous statistics | EEA and USA (mechanism described in section 5) |
| Plus Five Five, Inc. (USA), provider of the Resend service | processor: sending emails from forms, service request confirmations and messages to the service department | USA (section 5) |
| UAB MailerLite (Lithuania) | processor: managing the mailing list and sending the newsletter | EEA; subprocessors also in the USA (section 5) |
| InsERT S.A. (Poland) | processor: online service order service (API) through which a request from the form reaches our Gestor nexo service system | EEA |
| InPost sp. z o.o. (Poland) | separate controller: carriage of the parcel containing the unit; receives the sender's or recipient's data needed for the label and delivery | EEA |
| Courier company selected to collect an oversized unit | separate controller: collection and delivery of the consignment | EEA |
| Email, IT and backup service providers, accounting firm, law firm | processors or separate controllers, to the extent necessary for their services | EEA |
| Authorised Wipcool distributor | separate controller: only when you ask to be contacted by a distributor or the matter concerns a purchase from them, to the extent necessary to resolve it | EEA |
| Google Ireland Limited (Ireland), Google LLC (USA) | processor: provider of Google Analytics 4, only after consent to analytics cookies. After consent to marketing cookies as well, Google uses the data to measure and personalise ads (Google Ads) and acts as a separate controller in that respect | EEA and USA (section 5) |
| Meta Platforms Ireland Limited (Ireland), Meta Platforms, Inc. (USA) | only after consent to marketing cookies: provider of Meta Pixel; joint controller for the collection and transmission of data from our website, thereafter an independent controller | EEA and USA (section 5) |
| Courts, law enforcement agencies and other public authorities | only when required by law | Poland |
For Meta Pixel, we are joint controllers together with Meta Platforms Ireland Limited for the collection of data on our website and its transmission to Meta. We are responsible for obtaining your consent and providing you with this information. Thereafter, Meta processes the data as an independent controller under the terms of the Meta Privacy Policy. Meta makes the essential provisions of the joint controller arrangement available on the Controller Addendum page. You may exercise your rights relating to the collection and transmission of data against us or directly against Meta (Art. 26(3) GDPR).
We also describe how Google uses data from sites that use its services, including for advertising, in our Cookie Policy; Google's policies: How Google uses information from sites or apps that use its services and Google Privacy Policy.
5. Where we store data and transfers outside the European Economic Area
The database and website files (including images and downloadable documents) are stored in the European Union. Emails from forms are sent via Resend from the EU region (Ireland).
Cloudflare, Inc. and Plus Five Five, Inc. (the provider of Resend) are companies based in the USA, and MailerLite's subprocessors may also process data in the USA. As a result, technical data and metadata (e.g. IP address, time and URL of the request, email headers) may be accessible in the USA. Once you consent to analytics or marketing cookies, data from Google Analytics 4 and Meta Pixel (cookie identifiers, pages visited, device information, IP address) is sent to Google and Meta, which process it on their servers, including in the USA (Google LLC, Meta Platforms, Inc.). In that case we transfer it on the basis of the European Commission decision of 10 July 2023 establishing an adequate level of protection under the EU-US Data Privacy Framework (Art. 45 GDPR) - for companies that hold this certification. If a given recipient is not covered by the certification or the decision ceases to apply, we use standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR) together with additional safeguards, e.g. encryption in transit.
You can obtain a copy of the safeguards applied by writing to bok [at] wipcool.pl.
6. Cookies and similar technologies
The website stores some essential information in your browser (e.g. the selected country and your choice in the consent banner). We only activate our own statistics and Google Analytics 4 after you consent to analytics cookies, and Google advertising tools and Meta Pixel only after you consent to marketing cookies. Details, including the list of cookies and their retention periods, are in the Cookie Policy. You can change your consent at any time via the ‘Cookie settings’ link in the website footer.
7. Your rights
You have the right to:
- access your data and obtain a copy of it (Art. 15 GDPR),
- rectification of inaccurate or incomplete data (Art. 16 GDPR),
- erasure of data (Art. 17 GDPR), e.g. when it is no longer needed or you withdraw your consent,
- restriction of processing (Art. 18 GDPR),
- data portability for data that we process by automated means on the basis of consent or a contract (Art. 20 GDPR),
- object to processing based on our legitimate interest (Art. 21 GDPR); we always comply with an objection to direct marketing,
- withdraw consent at any time (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing before withdrawal. You can unsubscribe from the newsletter using the link in every message, and change your cookie consent via ‘Cookie settings’ in the footer,
- lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you believe that we are processing your data unlawfully.
To exercise your rights, write to bok [at] wipcool.pl or to our registered office address. We will reply without undue delay and no later than within one month. In complex cases we may extend this period by a further two months - in that case we will inform you within the first month. We may ask for information needed to confirm your identity.
8. Automated decision-making and profiling
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Cloudflare Turnstile automatically assesses whether a form is being submitted by a human. If your submission is blocked, email or call us.
Once you consent to marketing cookies, Google and Meta use information about your visit to our website (e.g. which product pages you view and whether you arrived from an advert) together with other data they hold about you from their services to tailor the adverts you see on their platforms and on their partners' platforms (e.g. Wipcool adverts on Facebook, Instagram, Google Search and YouTube). We may also instruct them to show adverts to people who have visited our website. This is profiling within the meaning of Article 4(4) GDPR, carried out by Google and Meta as controllers. It only determines which adverts you see and does not produce legal effects concerning you. It is not carried out without your consent, and you can withdraw your consent at any time via ‘Cookie settings’ in the footer. You can also manage adverts in your Google and Meta account settings.
9. How we protect your data
- The connection to the website is encrypted (HTTPS).
- The website does not have its own personal data database. We forward messages and requests immediately to an email inbox and to the service system, which only authorised persons can access.
- Forms are protected by Cloudflare Turnstile verification, a limit on the number of submissions from a single IP address and server-side data validation.
- The link to the service request page contains a random, hard-to-guess identifier, and the shipment number is protected by a signature. The service request page is not indexed by search engines and does not pass its address on to other websites.
- The content management panel is available only to authorised persons, after identity verification by Cloudflare Access.
Note: Anyone who has the link to the service request page can see the repair status and submit a decision on the repair cost. Do not share this link with third parties.
10. Links to other websites
The website contains links to online shops, distributor websites, Google Maps and InPost. Once you go to such a website, the privacy policy of its owner applies. We are not responsible for how they process data.
11. Changes to this policy
We update this policy when the website's features, providers or the law change. The current version is always available on this page, together with the date from which it applies. We will inform subscribers by email of any significant changes concerning the newsletter.