Privacy Policy

This policy explains how we use personal data when you shop with us and your order is delivered to a country of the European Union. For those orders the controller is Best Immune International sp. z o.o. For orders delivered to the United Kingdom and anywhere else, the controller is Best Immune International Ltd.

1. Who is responsible for your data

Best Immune International sp. z o.o., ul. Krakowska 14, 33-100 Tarnów, Poland, NIP 8733294533, KRS 0001085419. For anything about your data, email kontakt@bestimmuneint.pl or write to the address above.

2. What we use, why and for how long

  • Your order (name, email, phone, delivery and billing address, what you bought, how you paid): to make and deliver it, take payment and send you order emails. Basis: the contract (Art. 6(1)(b) GDPR). Kept for as long as the contract runs and then for the periods tax and accounting law require (5 years from the end of the year).
  • Invoices and accounts: Basis: legal obligation (Art. 6(1)(c) GDPR). Kept 5 years from the end of the tax year.
  • Returns and complaints (your messages, order number, contact details): Basis: contract and legal obligation (Art. 6(1)(b) and (c) GDPR). Kept until the liability period and any claims have run out.
  • Your account, if you open one (name, email, phone, saved addresses, order history, reward points): Basis: contract (Art. 6(1)(b) GDPR). Kept until you ask us to close it.
  • Repeat orders, if you choose them: the card you paid with is saved by Stripe (we never see the full card number) so each delivery can be paid. Basis: contract (Art. 6(1)(b) GDPR). Kept until you cancel the repeat order.
  • Product reviews (name, review, rating): Basis: your consent (Art. 6(1)(a) GDPR). Shown until you ask us to remove the review.
  • Messages to us (contact form, email, phone): to answer you. Basis: our legitimate interest in replying (Art. 6(1)(f) GDPR). Kept as long as needed to answer you and deal with any follow-up.
  • Security (IP address, browser details, times of requests in the server logs): to keep the shop safe and stop fraud and spam. Basis: legitimate interest (Art. 6(1)(f) GDPR). Kept up to 90 days.

Analytics

We count visits with our own Matomo, run on our own hosting and without cookies, so we can see which pages help and where the checkout gets stuck. Basis: legitimate interest (Art. 6(1)(f) GDPR). Google Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) only loads if you accept it in the cookie choice; basis: your consent (Art. 6(1)(a) GDPR). You can stop both on this page.

Google Customer Reviews

After you place an order, the order confirmation page may offer you a short survey from Google about your order. To show this offer, the page gives Google your order number, email address, delivery country, expected delivery date and the barcodes of the products you bought. Google emails you the survey only if you agree to take part, and handles your details under its own privacy policy (https://policies.google.com/privacy). This only happens if you accept it in the cookie choice; basis: your consent (Art. 6(1)(a) GDPR).

3. Who receives your data

Only what each one needs, and only to do the job for us (Art. 28 GDPR):

  • payments: Stripe Payments Europe, Ltd. (Dublin, Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), when you pay with them;
  • delivery: the carrier taking your parcel (for example InPost, DPD, DHL), which receives your name, delivery address, phone and email for delivery notices;
  • order and warehouse system: Base (BaseLinker), which passes the order to our warehouse in Poland;
  • the hosting of the shop and the sending of its emails: Gravity Host (GK Tools Ltd, United Kingdom) and the email delivery service it uses;
  • Google, for the address suggestions in the checkout (Google Maps), the spam check on the review and contact forms (reCAPTCHA) and, only if you accept it, Google Analytics;
  • our accountants and legal advisers, and public authorities where the law requires it.

We do not sell your data.

4. Data outside the European Economic Area

The shop is hosted in the United Kingdom, which the European Commission recognises as giving adequate protection (Art. 45 GDPR). Google and PayPal may process data in the USA; they take part in the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and also use the European Commission's standard contractual clauses.

5. Cookies

The shop needs a few cookies to work (session, basket, language, currency, your cookie choice), so these are always on. Google Analytics cookies are only set if you accept them; you can change your choice at any time on this page.

6. Your rights

You can ask us for a copy of your data (Art. 15 GDPR), to correct it (Art. 16), to delete it (Art. 17, unless the law makes us keep it), to restrict its use (Art. 18), to receive it in a usable format (Art. 20) and you can object to uses based on our legitimate interest (Art. 21). Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. Email kontakt@bestimmuneint.pl; we answer within one month.

You can also complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority where you live.

7. Automated decisions

We make no decisions about you by automated means alone (Art. 22 GDPR) and do not profile you for advertising.

8. Changes

We update this policy when the way we use data changes. The version on this page is the one that applies.