Privacy Policy

The controller of your personal data is ECOM BIS sp. z o.o., with its registered office at ul. Bohaterów Warszawy 6/7G, 25-394 Kielce, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000614542, tax identification number (NIP) 6572922956, REGON 364271228 (the "Controller"). For any matters concerning personal data, you can write to office@giftias.com or send a letter to the Controller's registered office. The Controller has not appointed a data protection officer.

This policy applies to the giftias.com website in all its language versions (the "Website"). This policy does not apply to websites of other entities linked from the Website, including shops and brands featured in our gift guides. Each of those entities applies its own data protection rules.

Technical data collected on every visit to the Website: • IP address, date and time of the request, address of the page visited, server response code and response size, address of the page you came from (referer), browser and operating system type (user agent), • purpose: displaying the Website, keeping it secure and detecting abuse, • legal basis: the Controller's legitimate interest (Article 6(1)(f) GDPR). Data from the contact form (Giftias B2B page): • first name and surname, e-mail address, company name and, if you provide them, your phone number and message, • purpose: replying to your enquiry and, where relevant, presenting an offer, • legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) and, where you write on behalf of a company, the Controller's legitimate interest in conducting business correspondence (Article 6(1)(f) GDPR). E-mail correspondence: • the data you provide in your message, • purpose: conducting correspondence and defending against possible claims, • legal basis: the Controller's legitimate interest (Article 6(1)(f) GDPR). Providing data is voluntary. Without an e-mail address we cannot reply to your enquiry. We do not make decisions about you based solely on automated processing, including profiling.

The Website stores in your browser only information that is strictly necessary for it to work: • the language version of the Website you have selected, • technical data needed to display the pages correctly. This information is not used to track you or for advertising purposes and is not shared with other entities. No consent is required to store it (Article 399 of the Polish Electronic Communications Law). The Website does not use analytics tools, tracking pixels or advertising cookies. If we introduce them in the future, we will first update this policy and ask for your consent before any such tools are activated. You can delete the stored information or block it in your browser settings. The Website will still work, but it may not remember your selected language.

Data may be received only by entities that help us run the Website and act on our instructions: • the provider of the server (VPS) on which the Website runs: Hostinger International Ltd., • the e-mail provider (Google Workspace): Google LLC, Mountain View (USA), • BP2 ML sp. z o.o., based in Bydgoszcz, Poland (KRS 0000965558), which operates the contact form under a data processing agreement: it stores enquiries in its database and forwards them to the Controller by e-mail, • entities providing us with IT, legal or accounting services, to the extent necessary to perform those services. We may also disclose data to public authorities where required by law. We do not sell personal data.

We transfer data outside the European Economic Area in one case: e-mail handled by Google LLC in the United States. The transfer is based on European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework, in which Google LLC participates, and additionally on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to the address given in section 1.

• server logs: 14 days, after which they are deleted automatically, unless they are needed to investigate a security incident, • form enquiries: 120 months from receipt, after which we delete them and keep only the number of enquiries received in a given month, without any personal data; email correspondence: for as long as the conversation continues and then until the limitation period for any claims expires, • if a contract is concluded, data needed for settlements: for the period required by tax and accounting regulations.

You have the right to: • access your data and receive a copy of it, • request rectification of your data, • request erasure of your data, • request restriction of processing, • data portability, where we process your data on the basis of a contract and by automated means, • object to processing based on the Controller's legitimate interest. Send your request to the address given in section 1. We will reply without undue delay and in any event within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. If you live or work in another European Union country, you may also lodge a complaint with the supervisory authority in that country.

Connections to the Website are encrypted (HTTPS). Only persons and entities that need access to data to achieve the purposes described in this policy have such access.

We change this policy when the law or the way the Website works changes. The current version is always available on this page, and its effective date is given below. This policy is effective from 18.10.2026.