This translation is provided for information purposes only. The Polish version of the document is binding. Polski
Privacy Policy — Korban Professional (Saint Hair Europe Sp. z o.o.)
Version: KPROF-PRIV-v2
Effective from: 2026-05-19
Previous version: v1 (date unknown, no date on the live website)
1. Personal data controller
The controller of your personal data is:
Saint Hair Europe Sp. z o.o.
ul. Karola Marcinkowskiego 8a/1
85-056 Bydgoszcz
NIP: 9671483384
REGON: 540589167
KRS: 0001147669
Contact in matters of personal data: kontakt@korbanprofessional.pl
Phone: +48 720 803 375 (working days 8:00–16:00)
The Korban Professional brand is a commercial activity conducted by Saint Hair Europe Sp. z o.o.
2. Purposes and legal bases for processing (Article 6 of the GDPR)
| Purpose | Legal basis | Retention period |
|---|---|---|
| a) Conclusion and performance of the sales contract (orders in the korbanprofessional.pl shop) | Art. 6(1)(b) GDPR (performance of a contract) | for the duration of the contract + 6 years (tax settlements) |
| b) Handling of complaints, warranty claims and returns | Art. 6(1)(b) and (c) GDPR (contract + legal obligations) | for the duration of the contract + 2 years |
| c) Issuing and storing invoices | Art. 6(1)(c) GDPR (statutory obligation, Art. 86 § 1 of the Tax Ordinance Act) | 5 years from the end of the year in which the invoice was issued |
| d) Newsletter, marketing e-mails, follow-up after trade fairs | Art. 6(1)(a) GDPR (your consent) | until consent is withdrawn, max. 5 years from the last activity |
| e) Marketing communication via WhatsApp / SMS | Art. 6(1)(a) GDPR (your consent) | until consent is withdrawn, max. 5 years from the last activity |
| f) Marketing profiling (tailoring offers to your activity) | Art. 6(1)(a) GDPR (your consent) | until consent is withdrawn, max. 24 months |
| g) Marketing of own products by traditional means (e.g. a leaflet in the parcel) | Art. 6(1)(f) GDPR (legitimate interest of the controller) | until an objection is raised |
| h) Handling contact enquiries (form, e-mail, phone) | Art. 6(1)(f) GDPR (legitimate interest — providing a response) | 12 months from the last correspondence |
| i) Website traffic analytics (statistics — Plausible, aggregated) | Art. 6(1)(f) GDPR (legitimate interest — improving the website) | 25 months (in accordance with the tool's configuration) |
| j) Google Ads, Facebook Ads advertising (retargeting, lookalike) | Art. 6(1)(a) GDPR (your consent via cookies) | until consent is withdrawn, max. 24 months |
| k) Establishment and defence of claims | Art. 6(1)(f) GDPR (legitimate interest) | until the limitation period expires |
3. Data categories
Depending on the purpose, we process the following data:
- Identification: first name, last name, company/salon name, VAT number (for B2B)
- Contact: e-mail, phone number, delivery address, billing address
- Transactional: order history, amounts, payment methods
- Behavioral: store activity, e-mail opens, clicks (if consent was given)
- Technical: IP address (anonymised in analytics), browser, operating system — collected by cookies (see section 7)
4. Data recipients (processors)
Your data may be transferred to the following processors on the basis of data processing agreements (Art. 28 GDPR):
| Entity | Purpose | Server location | DPA |
|---|---|---|---|
| Hostinger sp. z o.o. | Hosting of the korbanprofessional.pl shop | EU | yes |
| BaseLinker sp. z o.o. | Order and shipping management | EU (Poland) | yes |
| Brevo SAS (formerly Sendinblue) | Sending marketing and transactional e-mails | EU (France) | yes |
| Plausible Insights OÜ (or self-hosted in the EU) | Website traffic analytics (cookieless) | EU (Germany / own instance in Poland) | yes |
| Twenty Sàrl (self-hosted instance) | CRM (contact management) | EU (own server in Poland) | not applicable (own infrastructure) |
| PayU S.A. / Przelewy24 | Online payment processing | EU (Poland) | yes |
| InPost / DPD / DHL / Poczta Polska | Delivery of orders | EU (Poland) | yes |
| Google LLC (Google Ads, Google Analytics, Google Tag Manager — only after consent is given via the cookie banner) | Advertising and analytics | USA (SCC + Data Privacy Framework) | yes |
| Meta Platforms Ireland Ltd. (Facebook, Instagram Ads — only after consent is given via the cookie banner) | Advertising and remarketing | EU (Ireland) + USA (SCC + DPF) | yes |
| Accounting firm (under a separate agreement) | Accounting, tax settlements | EU (Poland) | yes |
Transfers outside the EEA: Google and Meta have servers in the USA. We rely on the Standard Contractual Clauses (SCC) approved by the European Commission and on the Data Privacy Framework (DPF) for those providers that are certified.
5. Information clause (Art. 13 GDPR)
This policy constitutes a complete information clause within the meaning of Art. 13 GDPR. In particular, we inform you that:
- a) The data controller is the entity indicated in section 1.
- b) Purposes and legal bases — see section 2.
- c) Data recipients — see section 4.
- d) Retention period — see section 2 („Retention period” column).
- e) Your rights — see section 6.
- f) The right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
- g) Providing data when concluding a sales contract is voluntary, but necessary for the performance of the contract. Failure to provide data prevents the purchase. Providing data for the newsletter / marketing is voluntary — failure to do so has no consequences.
- h) The data is not used for decision-making based solely on automated processing that produces legal effects. Marketing profiling (if consented to) does not produce such effects.
6. Your rights (Art. 15-22 GDPR)
You have the right to:
- Right of access (Art. 15 GDPR) — to obtain a copy of your data
- Right to rectification (Art. 16 GDPR) — to correct inaccurate data
- Right to erasure / „right to be forgotten” (Art. 17 GDPR) — when the data is no longer necessary, consent has been withdrawn, or the processing is unlawful
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR) — to receive data in a structured format (JSON/CSV) and transmit it to another controller
- Right to object (Art. 21 GDPR) — especially against processing based on Art. 6(1)(f) (legitimate interest), including traditional marketing
- Right to withdraw consent (Art. 7(3) GDPR) — at any time, without affecting the lawfulness of processing before the withdrawal. Method of withdrawal:
– Mailing: click „Nie chcę więcej wiadomości” (“I do not want any more messages”) in the footer of any message, or write to kontakt@korbanprofessional.pl
– WhatsApp / SMS: reply with the word STOP, or write to kontakt@korbanprofessional.pl
– Cookies: click „Zarządzaj zgodami” (“Manage consents”) in the website footer and untick the relevant categories
- Right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl)
Exercising your rights: write to kontakt@korbanprofessional.pl. We respond within 30 days (max. 90 days for complex requests, with prior notice).
7. Cookies and tracking technologies
The korbanprofessional.pl website uses cookies and similar technologies (localStorage, sessionStorage, pixels).
7.1 Cookie categories
| Category | Purpose | Consent required | Examples |
|---|---|---|---|
| Necessary | Operation of the shop, basket, login session | NO (Art. 6(1)(b) — performance of the contract) | PHPSESSID, woocommerce_cart_*, wcml_client_* (currency/language), cookieyes-consent |
| Preferences | Remembering settings (language, currency, wish list) | yes (Art. 6(1)(a)) | wp_lang, breakdance_* |
| Statistics | Traffic analytics, page popularity | yes (Art. 6(1)(a)) | Plausible (cookieless — no cookies!), _ga, _ga_*, _gid (Google Analytics) |
| Marketing | Advertising, retargeting, mailings | yes (Art. 6(1)(a)) | _fbp, _fbc, fr (Facebook Pixel), _gcl_au, IDE (Google Ads), c_user |
7.2 Consent management
On your first visit, we display a cookie banner (CookieYes), where you can:
- Accept all (Accept All)
- Reject all (Reject All — equally prominent button)
- Customize settings (Customize) — choose per category
Your decision is stored in the cookieyes-consent cookie and remains valid for 365 days. After that time, the banner will appear again. You can change your choices at any time by clicking „Zarządzaj zgodami” (“Manage consents”) in the website footer.
7.3 Plausible — why it does not require consent
Plausible Analytics is an alternative to Google Analytics which does not use cookies and does not collect personal data. It measures only anonymous aggregated statistics (number of visits, traffic sources, popular pages). For this reason it does not require consent — it operates from the moment you enter the website, but does not allow a specific person to be identified.
7.4 Google Consent Mode v2
If you accept the „Statistics” and/or „Marketing” categories, we activate Google Consent Mode v2 — a system in which Google Tag Manager adapts the way Google scripts (Analytics, Ads) are loaded to your consent.
8. Data security
We apply appropriate technical and organisational measures:
- Transmission encryption (HTTPS / TLS 1.3) for all communication with the website
- Password encryption (bcrypt) in the database
- Regular backups (daily, 30-day retention)
- Access restricted to authorized personnel (principle of least privilege)
- Access logs for CRM and hosting systems (12-month retention)
- Security updates for WordPress, WooCommerce, plugins (max 14 days from publication)
- MFA (multi-factor authentication) for administrative accounts
9. Breach reporting procedure
In the event of a personal data breach:
- Notification to the President of the Personal Data Protection Office (UODO) within 72 hours of detecting a breach (Art. 33 GDPR)
- Notification to data subjects when a breach may result in a high risk (Art. 34 GDPR)
10. Final provisions
- The policy may be updated in connection with changes in regulations or the development of services
- Any material change will be announced with 14 days' notice on the homepage
- For questions related to personal data protection, please contact: kontakt@korbanprofessional.pl
Date of last update: 2026-05-19
Version: KPROF-PRIV-v2
SHA-256 hash of this version: _to be calculated after publication (sha256sum POLITYKA-PRYWATNOSCI-v2.md)_