{"id":8489,"date":"2026-04-24T13:03:20","date_gmt":"2026-04-24T11:03:20","guid":{"rendered":"https:\/\/sonto.eu\/privacy-policy\/"},"modified":"2026-09-18T12:05:24","modified_gmt":"2026-09-18T10:05:24","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/sonto.eu\/en\/privacy-policy\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"<p>This Privacy policy sets out the rules for storing and accessing data on the Devices of Users using the Shop for the purpose of providing services by electronic means by the Controller, and the rules for collecting and processing Users\u2019 personal data provided by them personally and voluntarily through the tools available in the Shop.<\/p>\n<p>The Privacy policy is an integral part of the <a href=\"https:\/\/sonto.eu\/en\/terms-and-conditions\/\">Terms and conditions<\/a>, which set out the rules, rights and obligations of Users using the Shop. A concise summary of the information required by the GDPR is in the <a href=\"https:\/\/sonto.eu\/en\/gdpr-notice\/\">GDPR notice<\/a>.<\/p>\n<h2>\u00a71 Definitions<\/h2>\n<ul>\n<li><strong>Shop<\/strong> \u2013 the \u201cSONTO\u201d online shop operating at https:\/\/sonto.eu<\/li>\n<li><strong>Shop \/ Data Controller<\/strong> \u2013 the Controller of the Shop and Controller of Data (hereinafter the Controller) is \u201cSONTO Sp. z o.o.\u201d, operating at ul. Bagienna 36c, 70-772 Szczecin, Poland, tax identification number (NIP): 9552564863, providing services by electronic means through the Shop<\/li>\n<li><strong>User<\/strong> \u2013 a natural person for whom the Controller provides services by electronic means through the Shop<\/li>\n<li><strong>Device<\/strong> \u2013 an electronic device together with its software, through which the User accesses the Shop<\/li>\n<li><strong>Cookies<\/strong> \u2013 text data collected in the form of files placed on the User\u2019s Device<\/li>\n<li><strong>GDPR<\/strong> \u2013 Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC<\/li>\n<li><strong>Personal data<\/strong> \u2013 information relating to an identified or identifiable natural person<\/li>\n<li><strong>Processing<\/strong> \u2013 an operation or set of operations performed on personal data, whether or not by automated means<\/li>\n<li><strong>Consent<\/strong> \u2013 a freely given, specific, informed and unambiguous indication of will by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them<\/li>\n<li><strong>Anonymisation<\/strong> \u2013 an irreversible process of operations on data which makes it impossible to identify a given record or link it to a specific natural person<\/li>\n<\/ul>\n<h2>\u00a72 Data Protection Officer<\/h2>\n<p>The Controller is not obliged to appoint a Data Protection Officer within the meaning of Article 37 GDPR and has not appointed one. In matters concerning data processing, including personal data, please contact the Controller directly in the manner set out in \u00a712.<\/p>\n<h2>\u00a73 Types of Cookies<\/h2>\n<ul>\n<li><strong>Necessary cookies<\/strong> \u2013 files necessary for the Shop to function correctly; disabling them makes proper use of the Shop impossible. They do not require the User\u2019s consent.<\/li>\n<li><strong>Functional cookies<\/strong> \u2013 files that make it possible to remember the User\u2019s preferences and to personalise the Shop. They require the User\u2019s consent.<\/li>\n<li><strong>Analytics cookies<\/strong> \u2013 files used to collect information on how the Shop is used, to compile statistics and to analyse User behaviour. They require the User\u2019s consent.<\/li>\n<li><strong>Marketing cookies<\/strong> \u2013 files used to display advertising matched to the User\u2019s interests, including remarketing. They require the User\u2019s consent.<\/li>\n<\/ul>\n<p>Cookies are further divided into <strong>first-party<\/strong> (stored by the Shop\u2019s system) and <strong>third-party<\/strong> (stored by the systems of the partners listed in \u00a76), and into <strong>session<\/strong> cookies (deleted when the browser session ends) and <strong>persistent<\/strong> cookies (stored until the stated period expires or until they are deleted manually).<\/p>\n<h2>\u00a73a Cookies used in the Shop and their retention periods<\/h2>\n<div class=\"serwis-legal__tabela\">\n<table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Use in the Shop<\/th>\n<th>Retention period<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Necessary<\/td>\n<td>Keeping the contents of the basket and the shopping session (WooCommerce), remembering the chosen language version (WPML), form security, the session of a signed-in User<\/td>\n<td>Until the browser session ends; the session of a signed-in User up to 14 days<\/td>\n<\/tr>\n<tr>\n<td>Necessary \u2013 consent handling<\/td>\n<td>Remembering the decision made in the cookie consent banner<\/td>\n<td>Up to 12 months<\/td>\n<\/tr>\n<tr>\n<td>Functional<\/td>\n<td>Remembering the User\u2019s preferences and interface settings<\/td>\n<td>Up to 12 months<\/td>\n<\/tr>\n<tr>\n<td>Analytics<\/td>\n<td>Google Analytics 4 (GA4) \u2013 analysis of traffic and User behaviour; Google Tag Manager (GTM) \u2013 management of measurement tags and scripts<\/td>\n<td>GA4: up to 14 months from the last visit<\/td>\n<\/tr>\n<tr>\n<td>Marketing<\/td>\n<td>Remarketing and advertising files<\/td>\n<td>Up to 13 months<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>The User may at any time delete stored Cookies through their web browser settings or change their preferences through the cookie consent banner available in the Shop.<\/p>\n<h2>\u00a74 Consent to Cookies<\/h2>\n<ul>\n<li>On the first visit to the Shop the User is shown a cookie consent banner allowing consent to the storing of cookies other than necessary ones to be given or refused.<\/li>\n<li>Necessary cookies are run automatically, because they are required for the Shop to work correctly.<\/li>\n<li>Functional, analytics and marketing cookies are run only after the User has given express consent. Until it is given, the corresponding scripts are not executed and no data is sent to their providers.<\/li>\n<li>Giving consent is voluntary. The User may at any time change or withdraw consent through the consent settings icon visible in the Shop, the \u201cCookie settings\u201d link in the footer or their web browser settings.<\/li>\n<li>Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.<\/li>\n<\/ul>\n<h2>\u00a75 Purposes of processing personal data<\/h2>\n<p>Personal data provided voluntarily by Users is processed for the following purposes:<\/p>\n<ul>\n<li>Performance of the order and of the sales contract, including preparation of the offer and the transport quote, contact concerning the order and its delivery (Article 6(1)(b) GDPR).<\/li>\n<li>Handling enquiries sent through the contact form (Article 6(1)(b) and (f) GDPR).<\/li>\n<li>Issuing and keeping accounting documents, including invoices (Article 6(1)(c) GDPR).<\/li>\n<li>Handling complaints, returns and the exercise of rights under the statutory warranty or a guarantee (Article 6(1)(b) and (c) GDPR).<\/li>\n<li>Analytics and statistics on the use of the Shop \u2013 on the basis of consent given through the cookie consent banner (Article 6(1)(a) GDPR).<\/li>\n<li>Marketing activities, including remarketing \u2013 on the basis of consent given through the cookie consent banner (Article 6(1)(a) GDPR).<\/li>\n<li>Establishing, exercising or defending legal claims \u2013 on the basis of the legitimate interest of the Controller (Article 6(1)(f) GDPR).<\/li>\n<\/ul>\n<h2>\u00a76 Third-party Cookies<\/h2>\n<p>The Controller uses scripts and components of partners in the Shop which may place their own cookies on the User\u2019s Device. List of partners:<\/p>\n<ul>\n<li><strong>Google Analytics 4 (GA4)<\/strong> \u2013 a service provided by Google LLC, used to analyse traffic in the Shop and User behaviour.<\/li>\n<li><strong>Google Tag Manager (GTM)<\/strong> \u2013 a service provided by Google LLC, used to manage the measurement tags and scripts used in the Shop. The GTM container is run only after consent to analytics cookies has been given; until then it is neither downloaded nor executed.<\/li>\n<\/ul>\n<p>Analytics and marketing cookies are run only after the User has given consent through the cookie consent banner shown on the first visit. The User may change or withdraw the consent given at any time. Services provided by third parties remain outside the Controller\u2019s control \u2014 those entities may change their terms of service, privacy policies and the way they use cookies.<\/p>\n<h2>\u00a77 Types of data collected<\/h2>\n<p><strong>Data collected automatically<\/strong> (some of it may constitute personal data within the meaning of the GDPR, in particular the IP address): IP address, browser type, screen resolution, approximate location, subpages opened, time spent on a subpage, type of operating system, referring page address, browser language, Internet service provider.<\/p>\n<p><strong>Data given in the contact form:<\/strong> e-mail address, telephone number, message content.<\/p>\n<p><strong>Data given when placing an order:<\/strong> first name and surname or company name, delivery address and invoice address, tax identification number (for companies), e-mail address, telephone number, content of notes to the order.<\/p>\n<p><strong>Voluntary nature of providing data.<\/strong> Providing personal data is voluntary, but failing to provide certain data will make it impossible to use selected services \u2014 in particular, failing to provide data in the contact form will make it impossible to answer the enquiry, and failing to provide address and contact data will make it impossible to carry out the order. Providing data to the extent required by law (e.g. data for issuing an invoice) is mandatory and follows from tax and accounting law.<\/p>\n<h2>\u00a78 Access to personal data by third parties<\/h2>\n<p>As a rule, the only recipient of the personal data provided by Users is the Controller. Data collected in the course of the services provided is neither transferred nor resold to third parties.<\/p>\n<p>Access to the data \u2014 usually under a data processing agreement \u2014 may be held by entities responsible for maintaining the infrastructure and services necessary to run the Shop:<\/p>\n<ul>\n<li><strong>Contabo GmbH<\/strong> \u2013 provider of the VPS server on which the Shop runs. The infrastructure is located within the European Union (Germany). Access to the data may occur as a result of maintenance work carried out by the provider\u2019s personnel; that access is governed by the agreement concluded between the Controller and the provider.<\/li>\n<li><strong>Laravel LLC (Laravel Forge)<\/strong> \u2013 provider of the server management platform used for deployments and administration. The platform has technical access to the Shop\u2019s server.<\/li>\n<li><strong>Service and IT support companies<\/strong> carrying out maintenance or responsible for keeping the IT infrastructure running.<\/li>\n<li><strong>Google LLC<\/strong> \u2013 as regards the Google Analytics 4 and Google Tag Manager services.<\/li>\n<li><strong>Carriers, courier and freight companies<\/strong> \u2013 as regards the data necessary to deliver the order (first name and surname or company name, delivery address, telephone number, e-mail address). The data is passed only to the carrier performing the given delivery.<\/li>\n<li><strong>Entities providing accounting services<\/strong> \u2013 as regards the data contained in accounting documents, where accounting is handled by an external entity.<\/li>\n<\/ul>\n<h2>\u00a79 Manner of processing personal data<\/h2>\n<p>As a rule, personal data will not be transferred outside the European Economic Area (EEA). An exception is where data is processed by the provider of analytics tools (Google LLC \u2014 Google Analytics 4, Google Tag Manager) established in the United States. In that case the transfer takes place on the basis of Standard Contractual Clauses (SCC) approved by the European Commission or under the Data Privacy Framework (DPF), which provide an adequate level of personal data protection. The User has the right to obtain information about the transfer safeguards applied and a copy of them by contacting the Controller in the manner set out in \u00a712.<\/p>\n<p>Personal data will not be used for automated decision-making producing legal effects concerning the User or similarly significantly affecting them within the meaning of Article 22 GDPR. The Controller does, however, apply profiling for analytical and marketing purposes, consisting in the analysis of User behaviour in the Shop using Google Analytics 4 and Google Tag Manager. That profiling takes place on the basis of the User\u2019s consent (Article 6(1)(a) GDPR) given through the cookie consent banner and may be withdrawn at any time.<\/p>\n<p>Personal data will not be resold to third parties.<\/p>\n<h2>\u00a710 Personal data retention periods<\/h2>\n<ul>\n<li>Data given in the contact form is kept for the period necessary to answer and handle the matter, and is then deleted or anonymised within 30 days of the end of the correspondence.<\/li>\n<li>Data relating to the performance of an order is kept for the period necessary to carry it out and for the limitation period for claims arising from the contract.<\/li>\n<li>Data contained in accounting documents (e.g. invoices) is kept for the period required by law \u2014 as a rule for 5 years, counting from the end of the calendar year in which the tax payment deadline fell, in accordance with Article 86 \u00a71 of the Tax Ordinance and Article 74(2) of the Accounting Act.<\/li>\n<li>In the event of a breach or suspected breach of the Terms and conditions the Controller may keep the data for no longer than 3 years from the request for its deletion, in order to safeguard a legitimate interest.<\/li>\n<li>Anonymous statistical data which does not constitute personal data is kept indefinitely.<\/li>\n<\/ul>\n<h2>\u00a711 Users\u2019 rights<\/h2>\n<p>In connection with the processing of personal data Users have the following rights, exercised on request made to the Controller:<\/p>\n<ul>\n<li><strong>Right of access to personal data<\/strong> \u2013 to obtain information about the data processed and a copy of it.<\/li>\n<li><strong>Right to rectification<\/strong> \u2013 to request that incorrect data be rectified without delay or that incomplete data be completed.<\/li>\n<li><strong>Right to erasure<\/strong> \u2013 to request that the data be erased without delay. The Controller reserves the right to withhold performance of the request in order to protect a legitimate interest, and to the extent that keeping the data is required by tax and accounting law.<\/li>\n<li><strong>Right to restriction of processing<\/strong> \u2013 in the cases set out in Article 18 GDPR.<\/li>\n<li><strong>Right to data portability<\/strong> \u2013 to receive the data in a structured, commonly used, machine-readable format.<\/li>\n<li><strong>Right to object<\/strong> \u2013 to the processing of data in the cases set out in Article 21 GDPR.<\/li>\n<li><strong>Right to withdraw consent<\/strong> \u2013 where processing is based on consent (Article 6(1)(a) GDPR), consent may be withdrawn at any time, in the same way as it was given \u2014 in the case of cookie consent through the consent settings icon or the \u201cCookie settings\u201d link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.<\/li>\n<li><strong>Right to lodge a complaint<\/strong> \u2013 with a supervisory authority. The competent authority in the Republic of Poland is the President of the Personal Data Protection Office \u2014 Prezes Urz\u0119du Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, https:\/\/uodo.gov.pl.<\/li>\n<\/ul>\n<h2>\u00a712 Contacting the Controller<\/h2>\n<ul>\n<li><strong>Postal address<\/strong> \u2013 SONTO Sp. z o.o., ul. Bagienna 36c, 70-772 Szczecin, Poland<\/li>\n<li><strong>E-mail address<\/strong> \u2013 kontakt@sonto.pl<\/li>\n<li><strong>Telephone<\/strong> \u2013 +48 509 810 910<\/li>\n<li><strong>Contact form<\/strong> \u2013 available on the <a href=\"https:\/\/sonto.eu\/en\/contact\/\">Contact<\/a> page<\/li>\n<\/ul>\n<p class=\"serwis-legal__pierwszenstwo\">This page is a translation of a document drawn up in Polish. In the event of any discrepancy between this translation and the Polish version, the Polish version prevails.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This Privacy policy sets out the rules for storing and accessing data on the Devices of Users using the Shop for the purpose of providing services by electronic means by the Controller, and the rules for collecting and processing Users\u2019 personal data provided by them personally and voluntarily through the tools available in the Shop. [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-8489","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":7}},"_links":{"self":[{"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/pages\/8489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/comments?post=8489"}],"version-history":[{"count":1,"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/pages\/8489\/revisions"}],"predecessor-version":[{"id":8493,"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/pages\/8489\/revisions\/8493"}],"wp:attachment":[{"href":"https:\/\/sonto.eu\/en\/wp-json\/wp\/v2\/media?parent=8489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}