Privacy and cookies policy
1. Who is the controller of your data?
The controller of personal data collected via www.kelostrada.pl is Bartosz Kalinowski, running a business under the name Kelostrada Bartosz Kalinowski, ul. Krzyżówki 5/219, 03-193 Warszawa, Poland, VAT ID (NIP): 527-254-55-49, REGON: 368425409, registered in the Polish Central Registration and Information on Business (CEIDG).
For any data protection matters you can contact us at [email protected] or in writing at the address above.
2. Purposes and legal bases of processing
| Purpose | Legal basis | Retention period |
|---|---|---|
| Order processing (acceptance, shipping, order-related contact) | art. 6(1)(b) GDPR (contract) | until the order is completed, then until the deadlines below expire |
| Tax and accounting obligations (invoices, sales records) | art. 6(1)(c) GDPR (legal obligation) | 5 years from the end of the relevant tax year |
| Customer account | art. 6(1)(b) GDPR (account service agreement) | until you request account deletion |
| Complaints and returns | art. 6(1)(b) and (c) GDPR | until the procedure ends, then until claims become time-barred (as a rule 6 years) |
| Newsletter (news and promotions) | art. 6(1)(a) GDPR (consent) | until you withdraw consent (unsubscribe) |
| Establishing, pursuing or defending claims | art. 6(1)(f) GDPR (legitimate interest) | until claims become time-barred |
| Site traffic statistics (Google Analytics) | art. 6(1)(a) GDPR (consent given in the cookie banner) | until consent is withdrawn; data in Google Analytics max. 14 months |
| Security and availability of the site (attack protection, CDN) | art. 6(1)(f) GDPR (legitimate interest) | logs max. 30 days |
Providing your data is voluntary but necessary to place an order, create an account or subscribe to the newsletter.
3. Who do we share data with?
- Carriers and shipping brokers - to deliver your parcel: InPost sp. z o.o., Poczta Polska S.A., Furgonetka sp. z o.o. sp.k.;
- Payment operator - online payments (paynow): mElements S.A., ul. Prosta 18, 00-850 Warszawa, Poland (mBank group);
- Order management - BaseLinker sp. z o.o.;
- E-mail provider - SEOHOST sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Poland, hosting our mailboxes;
- Cloudflare, Inc. - site protection and CDN, through which traffic to the shop passes;
- Google Ireland Ltd. - only if you consent to analytics cookies (Google Analytics);
- entities authorised by law (e.g. tax authorities).
We do not sell personal data and do not share it with third parties for their marketing purposes.
4. Transfers outside the European Economic Area
Using Cloudflare and Google services may involve transferring data (e.g. IP address) outside the EEA, including to the USA. Both providers participate in the EU-US Data Privacy Framework, and transfers are additionally based on Standard Contractual Clauses approved by the European Commission.
5. Your rights
- access to your data and a copy of it,
- rectification (correction) of data,
- erasure of data,
- restriction of processing,
- data portability,
- objection to processing based on legitimate interest,
- withdrawal of consent at any time - without affecting the lawfulness of processing before withdrawal.
To exercise these rights, write to [email protected].
You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl).
6. Automated decisions and profiling
We do not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning you.
7. Cookies
The shop uses cookies and similar technologies (localStorage) in two categories:
Essential - required for the shop to work (session, cart, login, remembering your cookie decision). No consent required.
Analytics - Google Analytics 4, activated only after you give consent in the banner. We use Google Consent Mode - before consent no data is sent to Google. If you are logged in and have consented to analytics cookies, an internal pseudonymous customer identifier (User-ID) is also sent to Google Analytics to combine your visits from different devices into one statistic; the identifier contains no personal data such as your name or e-mail address.
Marketing - Google Ads, activated only after you give separate consent in the banner. Used to measure ad effectiveness (conversions) and show more relevant ads (remarketing). As part of conversion measurement we may send Google hashed data, e.g. the e-mail address from your order - only if you consented to marketing cookies.
| Name | Category | Purpose | Lifetime |
|---|---|---|---|
| PrestaShop-* | essential | user session, cart, login | up to 20 days |
| keloConsent (localStorage) | essential | remembering your cookie decision | until deleted by the user |
| _ga, _ga_* | analytics (after consent) | traffic statistics (Google Analytics) | up to 2 years |
| _gcl_* | marketing (after consent) | ad conversion measurement (Google Ads) | up to 90 days |
You can change your decision at any time using the "Cookie settings" link in the page footer, or delete/block cookies in your browser settings - blocking essential cookies may prevent placing orders.
8. Changes to this policy
This policy may be updated, e.g. when service providers or regulations change. The current version is always available on this page.
Last updated: 30 August 2026.