Privacy policy
What data we collect, why, and how long we keep it.
The controller of personal data of buyers in the Sluggers shop is CORPORAL WOJTEK SP. Z O.O., ul. Wojciecha Chrzanowskiego 14 m. 257, 04-392 Warszawa, Poland (NIP 1133207226 · EORI PL113320722600000). Data contact: hello@sluggers.pl.
What data we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, address, e-mail, phone | performing the order and delivery | Art. 6(1)(b) GDPR (contract) | until claims are time-barred |
| Invoice data (company, VAT ID) | issuing the sales document | Art. 6(1)(c) GDPR (legal obligation) | 5 years from the end of the tax year |
| Newsletter e-mail | news about new releases | Art. 6(1)(a) GDPR (consent) | until consent is withdrawn |
| Analytics data (cookies) | statistics and advertising performance | Art. 6(1)(a) GDPR (consent) | up to 24 months |
| Where the visit came from, taken from the ad link: source, medium, campaign, creative, keyword, landing page, time of the click and the Google and TikTok ad click identifiers (gclid, ttclid) | working out which campaign brought the order | Art. 6(1)(f) GDPR (legitimate interest: accounting for our own advertising) | in the cw_attr cookie for up to 30 days, and with the order for as long as the order data; the Meta ad click identifier (fbclid) reaches the order only as part of _fbc in the row below, so only with consent and for the time stated there |
| Purchase information: order number, products and amount, and to match it, SHA-256 hashes of your e-mail, phone, first name, last name, city, postcode and country, plus IP address, browser and Meta identifiers (_fbp, and _fbc, which contains the ad click identifier fbclid) | sharing with Meta Platforms Ireland (Conversions API) after the order is paid, to measure and optimise advertising | Art. 6(1)(a) GDPR (consent to marketing cookies in the cookie banner) | we collect the IP address, browser and Meta identifiers only for online payments and delete them from the order once it stops awaiting that payment: right after the attempt to send the purchase event, or when the order is cancelled or refunded or the payment expires; a payment that is not completed counts as expired 48 hours after it was started, and the data is deleted at the next daily clean-up; without consent nothing is collected or sent |
Name, address, e-mail, phone
- Purpose
- performing the order and delivery
- Legal basis
- Art. 6(1)(b) GDPR (contract)
- Retention
- until claims are time-barred
Invoice data (company, VAT ID)
- Purpose
- issuing the sales document
- Legal basis
- Art. 6(1)(c) GDPR (legal obligation)
- Retention
- 5 years from the end of the tax year
Newsletter e-mail
- Purpose
- news about new releases
- Legal basis
- Art. 6(1)(a) GDPR (consent)
- Retention
- until consent is withdrawn
Analytics data (cookies)
- Purpose
- statistics and advertising performance
- Legal basis
- Art. 6(1)(a) GDPR (consent)
- Retention
- up to 24 months
Where the visit came from, taken from the ad link: source, medium, campaign, creative, keyword, landing page, time of the click and the Google and TikTok ad click identifiers (gclid, ttclid)
- Purpose
- working out which campaign brought the order
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest: accounting for our own advertising)
- Retention
- in the cw_attr cookie for up to 30 days, and with the order for as long as the order data; the Meta ad click identifier (fbclid) reaches the order only as part of _fbc in the row below, so only with consent and for the time stated there
Purchase information: order number, products and amount, and to match it, SHA-256 hashes of your e-mail, phone, first name, last name, city, postcode and country, plus IP address, browser and Meta identifiers (_fbp, and _fbc, which contains the ad click identifier fbclid)
- Purpose
- sharing with Meta Platforms Ireland (Conversions API) after the order is paid, to measure and optimise advertising
- Legal basis
- Art. 6(1)(a) GDPR (consent to marketing cookies in the cookie banner)
- Retention
- we collect the IP address, browser and Meta identifiers only for online payments and delete them from the order once it stops awaiting that payment: right after the attempt to send the purchase event, or when the order is cancelled or refunded or the payment expires; a payment that is not completed counts as expired 48 hours after it was started, and the data is deleted at the next daily clean-up; without consent nothing is collected or sent
Who we share data with
- Our warehouse operator and courier, to the extent needed to deliver the parcel.
- Payment providers (Stripe), to the extent needed to settle the transaction.
- Our accountants and invoicing system, for sales documents.
- Our transactional e-mail provider, to send the order confirmation and the tracking number.
- Analytics and advertising providers, only if you consent in the cookie banner.
- Meta Platforms Ireland Ltd. (Conversions API), after the order is paid and only if you accepted marketing cookies in the cookie banner: the purchase event with matching data as hashes, plus your IP address, browser and Meta identifiers (_fbp, _fbc). Meta may process data outside the EEA under standard contractual clauses.
Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interests. Consent to the newsletter and to cookies can be withdrawn at any time without affecting the lawfulness of earlier processing. Requests: hello@sluggers.pl. You also have the right to complain to a supervisory authority: in Poland, the President of the UODO.
Cookies
- Necessary: cart, language choice, remembering your cookie decision. Always on, because the shop cannot work without them.
- Attribution: our own cw_attr cookie (up to 30 days) remembers the parameters of the ad link that led to the shop, including the ad click identifier. We set it without consent from the banner: it loads no script, we share it with no one and it is used only to account for our own campaigns (described above).
- Analytics: anonymous traffic statistics (Google Analytics 4 with IP anonymisation). Only with consent.
- Marketing: advertising performance measurement (Meta Pixel, TikTok Pixel; after a paid purchase also Meta Conversions API, described above). Only with consent.
You can change your choice at any time via the "Cookie settings" link in the footer. Until you consent we load no analytics or advertising scripts at all.
Where data is stored
Order data is stored on servers in the European Union. Where a provider processes data outside the EEA, it does so under the European Commission’s standard contractual clauses.
Informational page of this shop. For anything specific to your order, write to us.