Privacy Policy
Privacy Policy
By Insomnia
dated 1 April 2026
BY INSOMNIA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Warsaw, at the following address: ul. Kwitnącego Sadu 2, 02-202 Warsaw, entered into the register of entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register, KRS 0001254394, NIP 7011323130, REGON 545283013, with share capital in the amount of: PLN 5,000, as the data controller of personal data, has implemented and applies appropriate technical and organizational measures to ensure that data processing takes place in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) (Official Journal of the European Union L 119/1, Polish version 4.5.2016) and the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781, as amended).
1. Who is the controller of personal data?
BY INSOMNIA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Warsaw, at the following address: ul. Kwitnącego Sadu 2, 02-202 Warsaw, entered into the register of entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register, KRS 0001254394, NIP 7011323130, REGON 545283013, with share capital in the amount of: PLN 5,000.
2. Who can I contact regarding my personal data?
e-mail address: sklep@byinsomnia.pl
phone number: + 48 515 818 600
3. What is the purpose and legal basis for processing personal data?
| Purpose of data processing | Legal basis for data processing | Data retention period |
|---|---|---|
| provision of the User Account service and all related Services in the Store | Article 6(1)(b) of the GDPR (performance of a contract) | Data is stored until the User closes the account. |
| Performance of a sales contract or a contract for the provision of electronic services, including taking action at the request of the data subject prior to concluding the contract, as well as actions related to any complaints concerning the contract | Article 6(1)(b) of the GDPR (performance of a contract) | Data will be stored for the period necessary to perform the contract |
| Accounting settlement of the concluded contract – keeping accounting books | Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act of 30 January 2018 (Journal of Laws of 2018, item 395) | The retention period results from tax law provisions and, as a general rule, is 5 years counted from the beginning of the year following the financial year in which the tax obligation arose |
| Direct marketing | Article 6(1)(f) of the GDPR (legitimate interest of the controller) | Data will be stored for the period during which the legitimate interest pursued by the Controller exists, but not longer than the limitation period for the Controller's claims against the data subject arising from the business activity conducted by the Controller; the retention period is determined by the effectiveness of the marketing campaigns conducted |
| Marketing carried out on the basis of marketing consent given | Article 6(1)(a) of the GDPR in conjunction with Article 10 of the Act on the Provision of Electronic Services – consent of the data subject | Data is stored until the data subject withdraws consent. |
| Maintaining statistics regarding website traffic | Article 6(1)(f) of the GDPR (legitimate interest of the controller) – processing is necessary for purposes arising from the Controller's legitimate interests | Data is stored for the validity period of the individual cookies (usually from 24 hours to 2 years) or until the User effectively objects to tracking. |
4. What personal data is processed?
first and last name, phone number, e-mail address, computer IP address
If the customer requests a VAT invoice – we may additionally process the name of their business, correspondence or residential address, and NIP (tax identification) number.
If the customer requests delivery of goods – we may additionally process the delivery address provided
5. To whom may the collected personal data be disclosed?
Due to the need to ensure the proper functioning of the website, as well as the proper performance of contracts concluded through it, the Controller will disclose data to its business partners, indicated below. The Controller uses only the services of such data processors that provide sufficient guarantees of implementing appropriate technical and organizational measures, so that processing meets the requirements of the GDPR and protects the rights of data subjects.
Disclosure of data by the Controller does not occur in every case and not to all recipients or categories of recipients indicated in the privacy policy, and moreover – does not always cover all processed data. The Controller discloses data to processors only to the extent necessary for the purpose for which the disclosure takes place and only with respect to the data that is necessary for that purpose.
Data may be disclosed to the following recipients or categories of recipients:
- service providers supplying the Controller with technical, IT and organizational solutions that enable the Controller to conduct its business activity, including the Online Store and the Electronic Services provided through it (in particular, providers of computer software for running the Online Store, providers of e-mail and hosting services, and providers of software for company management and technical support for the Controller) – the Controller discloses the Customer's collected personal data to the selected provider acting on its behalf only in the case and to the extent necessary to achieve the given data processing purpose in accordance with this privacy policy.
- entities handling electronic or card payments – the Controller discloses the Customer's collected personal datato the selected payment processing entity in the online store, acting on behalf of the Controller, to the extent necessary to handle the payment made by the Customer.
- providers of accounting, legal and advisory services who provide the Controller with accounting, legal or advisory support (in particular, an accounting office, a law firm or a debt collection company) – the Controller discloses the Customer's collected personal data to the selected provider acting on its behalf only in the case and to the extent necessary to achieve the given data processing purpose in accordance with this privacy policy.
6. Will data be transferred outside the EEA?
Yes, your data may be transferred outside the European Economic Area (EEA), mainly to the USA, in connection with the Controller's use of analytical and advertising tools (e.g. Google Analytics, Meta Pixel). The Controller ensures the security of this data by using only providers that guarantee an adequate level of protection based on a decision of the European Commission (e.g. the Data Privacy Framework) or by applying Standard Contractual Clauses approved by the European Commission.
7. Information on rights related to data processing
Persons whose data is processed have the right to access that data, and may request its rectification, erasure or restriction of its processing. They may also exercise the right to object to the processing of data and the right to transfer data to another data controller. To exercise any of these rights, please contact us by phone or e-mail.
We inform you of the right to lodge a complaint with the supervisory authority responsible for enforcing personal data protection regulations, i.e. the right to lodge a complaint with the President of the Personal Data Protection Office
8. Consent
If we process personal data on the basis of consent – the data subject has the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal, nor does it affect processing carried out on the basis of another legal basis for data processing (e.g. in order to fulfill our obligations under the law).
9. Objection
The data subject has the right to object at any time – for reasons related to their particular situation – to the processing of personal data, if the basis for processing is the so-called legitimate purpose clause (Article 6(1)(f) of the GDPR) or public interest (Article 6(1)(e) of the GDPR). In such a situation, we will not process the data covered by the objection on that basis. However, the law grants us the right to refuse to comply with such a request if there are, on our part, important legitimate grounds for further processing that override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defense of legal claims.
If personal data is processed for the purposes of direct marketing, you may object at any time to the processing of data for that purpose. After accepting such a request, we will not process data for direct marketing purposes.
10. Is the provision of personal data a statutory or contractual requirement or a condition for concluding a contract, and is the data subject obliged to provide it, and what are the possible consequences of not providing the data?
Providing personal data is not a statutory requirement, but without obtaining it, the Controller will not be able to conclude a contract with the customer.
11. Information on automated decision-making, including profiling.
Not applicable.
12. Users' Rights
1. The Controller enables the User to have their Personal Data deleted from the Data Set at their request, as well as in other cases provided for by applicable law.
2. The Controller may refuse to delete Personal Data if the User has not settled all outstanding amounts owed to the Controller or has violated the Terms and Conditions or applicable law, and the retention of Personal Data is necessary to establish the User's liability.
3. Every User has the ability to view and edit their Personal Data at any time, within the functionality of the Store, after logging in using their e-mail address and password.
13. Cookies
Cookies are small pieces of text information in the form of text files, sent by a server and saved on the device of the person visiting the Online Store's website (e.g. on the hard drive of a computer, laptop, or on the memory card of a smartphone – depending on the device used by the visitor to our Online Store). Detailed information on cookies, as well as the history of their creation, can be found, among other places, here: https://pl.wikipedia.org/wiki/HTTP_cookie.
Cookies can be divided:
1. by their provider: first-party cookies, created by the Controller, and third-party cookies – belonging to entities other than the Controller
2. by their storage period: session cookies (those that are active only while the customer is using the website) and persistent cookies (those that are saved in the memory of the user's computer)
3. by the purpose of their use: necessary (enabling the proper functioning of the website), functional/preference (enabling the website to be adapted to the preferences of the visitor), analytical (collecting data on how the website is used), and marketing-advertising and social media cookies (collecting information about the website visitor in order to display personalized advertisements to that person and to carry out other marketing activities)
The Controller will use cookies for the following purposes:
- Necessary: ensuring the proper functioning of the website, maintaining the User's session after logging in, and remembering products added to the cart.
- Functional: remembering settings selected by the User (e.g. language, region) and personalizing the interface.
- Analytical: examining website performance, creating anonymous visit statistics (via Google Analytics 4) in order to improve the structure and content of the Store.
- Marketing: tailoring displayed advertisements to the User's interests and conducting remarketing activities (e.g. reminders about an abandoned cart).
Website users may change their cookie settings at any time. Detailed information on the possibilities and methods of managing cookies is available in the software (web browser) settings.
Examples of editing options in popular browsers:
– Mozilla Firefox: www.support.mozilla.org/pl/kb/ciasteczka
– Internet Explorer: www.support.microsoft.com/kb/278835/pl
– Google Chrome: www.support.google.com/chrome/bin/answer.py?hl=pl&answer=95647
– Safari: www.safari.helpmax.net/pl/oszczedzanie-czasu/blokowanie-zawartosci/
– Opera: https://help.opera.com/pl/latest/web-preferences/#cookies
– Microsoft Edge: https://support.microsoft.com/en-us/help/4468242/microsoft-edge-browsing-data-and-privacy
The Controller may use Google Analytics, GA4 services on the website, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the Controller maintain statistics and analyze website traffic. The collected data is processed within the above services to generate statistics useful in administering the website and analyzing traffic. This data is aggregate in nature. By using the above services, the Controller collects data such as the sources and medium through which visitors reach the website and how they behave on the website, information about the devices and browsers used to visit the website, IP address and domain, geographic data, and demographic data (age, gender) and interests. A person can easily block the sharing of information about their activity on the Online Store's website with Google Analytics – for this purpose, they can, for example, install the browser add-on provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=pl.