Polityka prywatności

Privacy Policy and Personal Data Protection (GDPR)

Adventure Stack Online Store

Table of Contents

  • § 1. General Provisions and Data Controller

  • § 2. Legal Grounds and Purposes of Data Processing

  • § 3. Scope of Collected Personal Data

  • § 4. Data Recipients and Transfers Outside the EEA

  • § 5. Data Retention Period

  • § 6. Rights of the Data Subject

  • § 7. Cookies, Operational Data and Analytics (Shopify)

  • § 8. Personal Data Security

  • § 9. Amendments to the Privacy Policy and Final Provisions

§ 1. General Provisions and Data Controller

  1. This Privacy Policy sets out the rules governing the processing and protection of personal data of Users utilizing the Adventure Stack Online Store, accessible at adventurestack.com.

  2. The Controller of personal data collected via the Online Store is the Seller: PLAST-MET Automotive Systems Spółka z o.o., with its registered office at ul. Głowackiego 24, 32-300 Olkusz, Poland, Tax Identification Number (NIP): PL 6372197568, National Business Registry Number (REGON): 364123812, email address: info@plast-met.com, telephone: +48 32 74 56 600 (hereinafter referred to as the "Controller").

  3. Personal data are processed in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), the Polish Personal Data Protection Act, and the Act on the Provision of Services by Electronic Means.

§ 2. Legal Grounds and Purposes of Data Processing

The Controller processes personal data for the following legitimate purposes:



  • Performance of the Sales Contract (Art. 6(1)(b) GDPR): Processing customer orders, shipping purchased goods, managing electronic payments, and direct communication regarding contract execution.

  • Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Issuance and retention of statutory accounting and tax documentation (including VAT invoices), fulfillment of bookkeeping duties, and management of statutory warranty or complaint procedures.

  • Customer Account Maintenance (Art. 6(1)(b) GDPR): Provision of services rendered electronically with respect to creating, hosting, and maintaining an individual Customer Account within the store.

  • Legitimate Interests of the Controller (Art. 6(1)(f) GDPR): Establishing, defending against, or pursuing legal claims; conducting web analytics and evaluating traffic metrics; providing customer technical support; and maintaining IT systems integrity and cybersecurity.

  • Direct Marketing and Newsletter (Art. 6(1)(a) GDPR): Delivering commercial communications, news, and promotional offers based on express and voluntary consent granted by the User.

§ 3. Scope of Collected Personal Data

  1. Order Processing and Registration Data: When placing an order or registering an account, the Controller may collect the following personal details:

    • First and last name

    • Residential and/or delivery address

    • Email address

    • Contact telephone number

    • Company name and Tax Identification Number (NIP) for commercial customers

  2. Technical and Operational Data: While browsing and interacting with the store, the system automatically collects operational data, including:

    • Public IP address

    • Web browser type and version

    • Device operating system

    • Cookie identifiers and usage preferences

    • Navigation metrics, page views, and browsing patterns

§ 4. Data Recipients and Transfers Outside the EEA

  1. To ensure seamless store operations and proper execution of contracts, personal data may be entrusted to third-party processors operating under binding data protection agreements:

  • Platform and IT Infrastructure: E-commerce platform provider and hosting services (Shopify Inc.).

  • Payment Gateways: Financial operators facilitating electronic transactions (e.g., Stripe, Przelewy24, PayU, BLIK).

  • Logistics and Shipping: Postal operators, courier entities, and fulfillment centers handling package delivery.

  • Professional Services: External accounting firms, legal counsel, and certified electronic invoicing software providers.

  1. In connection with the operation of the e-commerce infrastructure via Shopify, personal data may be transferred to third countries outside the European Economic Area (EEA), such as the United States or Canada. All international transfers are conducted with adequate safeguards in accordance with Chapter V of the GDPR, primarily relying on European Commission Adequacy Decisions or Standard Contractual Clauses (SCC).

§ 5. Data Retention Period

  1. Contractual and Transactional Data: Stored for the duration necessary to execute the contract, and thereafter retained for the statutory period mandated by accounting and tax regulations (5 years calculated from the end of the calendar year in which the tax obligation arose).

  2. Consent-Based Data (e.g., Marketing / Newsletter): Retained until such time as the User withdraws consent or opts out of future communications.

  3. Legal Claims and Protection: Maintained for the statutory limitation period for civil claims established under the Polish Civil Code.

§ 6. Rights of the Data Subject

Under the GDPR, each User has the right to exercise the following legal entitlements:



  • Right of Access (Art. 15 GDPR): Obtain confirmation as to whether data are processed, review the data, and obtain a copy.

  • Right to Rectification (Art. 16 GDPR): Request prompt correction of inaccurate personal data or completion of incomplete information.

  • Right to Erasure ("Right to be Forgotten" - Art. 17 GDPR): Request deletion of data when grounds specified by law are met.

  • Right to Restriction of Processing (Art. 18 GDPR): Demand limitation of processing during disputes or verification periods.

  • Right to Data Portability (Art. 20 GDPR): Receive personal data in a structured, commonly used, machine-readable format or have it transmitted directly to another controller.

  • Right to Object (Art. 21 GDPR): Object at any time to data processing carried out under the legitimate interest of the Controller (Art. 6(1)(f) GDPR).

  • Right to Withdraw Consent (Art. 7(3) GDPR): Revoke consent at any moment without affecting the lawfulness of processing carried out prior to revocation.

  • Right to Lodge a Complaint: Submit a formal complaint to the national supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

§ 7. Cookies, Operational Data and Analytics (Shopify)

  1. The Online Store employs cookie technology to secure essential technical functionality, adapt site configurations to User preferences, and generate aggregated analytical data.

  2. Users maintain full control over cookie usage and can modify parameters at any time via web browser settings or by utilizing the interactive Cookie Management Banner available on the website.

§ 8. Personal Data Security

  1. The Controller implements high-standard organizational and technical safeguards compliant with Article 32 of the GDPR to protect processed data against unauthorized alteration, disclosure, loss, or destruction.

  2. All digital communication and data transmissions containing personal details are protected using modern, secure SSL/TLS cryptographic encryption protocols.

§ 9. Amendments to the Privacy Policy and Final Provisions

  1. The Controller reserves the right to amend this Privacy Policy to reflect statutory legislative updates or structural advancements in site technology.

  2. The revised version of the Privacy Policy takes effect and becomes legally binding upon publication on the store website.