Privacy Policy

Effective from 15 October 2026.

1. Controller and scope of this Policy

The controller of personal data is MAGDA PLANT-BASED sp. z o.o., ul. Zakopiańska 35A, 34-424 Szaflary, Poland, KRS 0000665193, NIP 7352870212, REGON 366717496 (“MAGDA”, the “Controller”).

Contact on personal data matters:

  • e-mail: biuro@magdaplantbased.com;
  • postal address: MAGDA PLANT-BASED sp. z o.o., ul. Zakopiańska 35A, 34-424 Szaflary, Poland, marked “data protection”;
  • phone: +48 18 275 47 69.

This Policy covers the entire website https://magdaplantbased.com, including the B2C and B2B shop, user accounts, forms, the newsletter, payments, deliveries and external integrations. It is information about data processing, not consent or part of the Terms and Conditions. Consent is collected separately only where it is the legal basis for a specific activity, such as subscribing to the newsletter or activating optional analytics or marketing tools.

2. Where the data comes from and what data we process

We receive most data directly from you when you use the Website, create an account, place an order, subscribe to the newsletter or contact MAGDA. Technical data is generated when you use the Website. We also receive payment and delivery information from payment operators, the courier broker and carriers.

We receive the details of another parcel recipient from the buyer. We may receive the details of a B2B customer’s representative or contact person from that person, from the business on whose behalf they act, from another representative, or from public business and tax registers.

Depending on the process, we process:

  • identification and contact data, including name, surname, address, e-mail and phone number;
  • business data and data of persons acting on its behalf, including company name, tax ID (NIP), address, position or role, and the result of B2B account verification;
  • account data, including user ID, secured login credentials, saved addresses, order history, invoices, information needed to reorder and the favourites list;
  • order, delivery and settlement data, including products, quantities, prices, discounts, order number, tracking number, chosen payment method, transaction ID and status, and invoice data;
  • e-mail address and newsletter consent information;
  • correspondence, complaint and quality report data, including message content, attachments, product photos, batch number and how the matter was resolved;
  • technical data, including IP address, request time and URL, browser and device type, session identifiers and information stored on or read from the device;
  • consent and privacy settings information;
  • public data visible in Google reviews, e.g. profile name, photo, rating, review content and date.

If we obtain data indirectly and Article 14 GDPR applies, we provide the relevant information at the latest at the first contact, at the first disclosure to another recipient, or within one month of obtaining the data — whichever comes first. Information for authors of public Google reviews is provided in this Policy.

3. Purposes, legal bases and retention

3.1. Operation and security of the Website

We process technical data to display the Website, maintain the session, basket, login and privacy settings, and keep accounts and systems secure. The legal basis is Article 6(1)(b) GDPR for the service requested by the user and Article 6(1)(f) GDPR for our legitimate interest in the secure and proper operation of the Website and preventing abuse.

Some fonts used on the Website are loaded from Google servers (Google Fonts). When they load, Google receives the IP address and browser information. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is displaying the Website correctly.

We keep logs for as long as needed to operate, diagnose and protect the Website. Records relating to an incident are kept until the matter is resolved and the relevant limitation period has expired.

3.2. B2C and B2B accounts

A B2C account is optional. We process the data of a user who is party to the agreement to create and maintain the account under Article 6(1)(b) GDPR.

B2B accounts are approved manually. We process the data of a sole trader under Article 6(1)(b) GDPR. We process the data of a business’s representative or contact person under Article 6(1)(f) GDPR; our legitimate interest is verifying the business, establishing cooperation, contacting the right person and securely handling B2B sales. We may compare company data with public registers. Individual B2B prices and discounts are granted manually.

We process account data until the account is closed. If there is no login for 24 months, we send a warning of the planned deletion of the profile at least 30 days in advance. Closing an account does not delete order, invoice, complaint or other information that we must keep by law or to protect claims. Data from a B2B application that did not lead to account activation is deleted once verification and any claims have been handled, unless you effectively object earlier.

3.3. Orders

We process the data of a customer who is a natural person to accept and fulfil the order under Article 6(1)(b) GDPR. We process the data of a person acting on behalf of another business under Article 6(1)(f) GDPR; the legitimate interest of MAGDA and the B2B customer is concluding, performing and documenting the transaction and contacting the right person.

After the contract has been performed, we keep the necessary data until the end of the relevant limitation period. Data subject to tax, accounting, KSeF or complaint documentation obligations is kept for the period those obligations require. If a dispute or proceedings are pending, data is kept until final conclusion and settlement of claims.

Fields marked as mandatory are required to carry out the given action. Without the data needed for the account, payment, delivery or invoice, we cannot provide that part of the service. B2C customers do not need to provide a tax ID.

3.4. Payments

We transfer the data needed to process the chosen payment to PayPro S.A., the operator of Przelewy24, or to Autopay S.A. The legal basis is Article 6(1)(b) GDPR. The operators then act as separate controllers for payment handling, payment institution obligations, security and complaints. If you choose instalments, the data is also processed by the lender under its own terms.

MAGDA receives the transaction ID and status and the data needed for settlement.

3.5. Delivery and other recipients

We transfer the data needed to arrange delivery to Alsendo sp. z o.o., which brokers courier services, and to the carrier delivering the parcel, currently InPost sp. z o.o.

We process the buyer’s data under Article 6(1)(b) GDPR. We process the data of another person named as the recipient under Article 6(1)(f) GDPR; the legitimate interest of the buyer and MAGDA is delivering the order to the named person and documenting the delivery.

Recipient data is used in active handling until delivery is completed. The necessary proof of dispatch and delivery may remain in the order documentation for the period required by legal obligations and for claims.

3.6. Invoices and KSeF

We process the data needed to prepare and provide the invoice promised as part of the Order under Article 6(1)(b) GDPR. We fulfil tax, accounting and document retention obligations under Article 6(1)(c) GDPR.

We submit B2B invoices to KSeF (the Polish National e-Invoicing System) to the extent required by law. MAGDA has also adopted a uniform model of submitting B2C invoices to KSeF. For tax obligations, the legal basis is Article 6(1)(c) GDPR; for voluntarily including B2C invoices, Article 6(1)(f) GDPR. MAGDA’s legitimate interest is maintaining a uniform, secure and demonstrable invoice flow. We send the invoice to the customer by e-mail.

Recipients of data in KSeF are the National Revenue Administration authorities and other entities authorised by law. We submit the data needed to issue the invoice. Structured invoices are kept in KSeF for 10 years from the end of the year in which they were issued. Other tax and accounting records are kept for the period required by the relevant laws, taking into account events that extend these periods.

3.7. Contact, complaints and quality reports

We handle ordinary correspondence under Article 6(1)(f) GDPR — our legitimate interest in replying and maintaining relations. If a message concerns entering into or performing a contract, Article 6(1)(b) GDPR also applies. Ordinary correspondence is kept until the matter is closed and then only as long as needed to demonstrate how it was handled or to protect claims. Messages about an order, complaint or other matter requiring longer retention are added to the relevant documentation.

We process complaint data to handle the complaint, fulfil the seller’s obligations, settle the matter and protect claims — under Article 6(1)(b), (c) and (f) GDPR. Documentation is kept for the seller’s liability period and the limitation period for relevant claims, and in the event of a dispute until its final conclusion.

We process data from quality or food safety reports to identify the product and batch, investigate the report, fulfil the obligations of a food business operator and protect claims — under Article 6(1)(c) and (f) GDPR, and where the report concerns a contract, also Article 6(1)(b) GDPR.

We do not ask for medical records or health data unless needed to describe a reaction or product safety issue. Please keep such information to the minimum necessary. We delete or redact unnecessary data. If health data is needed to establish, pursue or defend claims, we process it under Article 9(2)(f) GDPR; otherwise we do not keep it.

3.8. Cookies, analytics and marketing tools

We use technologies necessary for the Website to operate to the extent needed to provide the requested service and ensure security. Tags are managed with Google Tag Manager. Analytics and marketing tools, including Google Analytics 4 and Meta Pixel, and external content, including YouTube videos and widgets showing Google reviews and Instagram updates, operate as described in the Cookie Policy, depending on the choices made in the privacy settings. Where they operate on the basis of consent, the legal basis is Article 6(1)(a) GDPR and the Polish Electronic Communications Law. Consent can be changed or withdrawn at any time.

We keep proof of privacy setting choices for as long as needed to respect the choice, demonstrate consent or its withdrawal, and protect against related claims.

3.9. Google reviews and widgets

The Website may display public reviews from MAGDA’s Google profile and MAGDA’s public Instagram updates. The widgets are provided by Elfsight. We present the author’s public data and review content under Article 6(1)(f) GDPR; our legitimate interest is presenting publicly available reviews of the brand. MAGDA does not verify whether the reviewer bought or used the product. Publication and moderation rules are set by Google.

The rules for loading widgets and the related processing of technical data are described in the Cookie Policy. Review data is displayed until it is removed at the source, the widget is refreshed, or a justified objection is upheld.

3.10. Accessibility tool

The Website features a tool that makes it easier to use, including changing text size and contrast, provided by Elfsight. To provide it, we process technical data, in particular the IP address and browser information. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is making the Website accessible to all users.

3.11. Newsletter

If you subscribe to the newsletter, we process your e-mail address to send information about promotions and new products. The legal basis is your consent — Article 6(1)(a) GDPR — and the consent to receive commercial information required by the Polish Electronic Communications Law. You can withdraw consent at any time using the link in the message or by writing to esklep@magdaplantbased.com. After you withdraw consent, we stop sending the newsletter. We keep information about giving and withdrawing consent for as long as needed to demonstrate it and protect against claims — under Article 6(1)(f) GDPR.

3.12. Accessibility complaints

We process data contained in a complaint about the accessibility of the e-commerce service to handle it and fulfil legal obligations under Article 6(1)(c) GDPR. We may then keep the necessary documentation under Article 6(1)(f) GDPR until the end of the period in which we need to demonstrate proper handling of the complaint or protect claims.

3.13. Legal obligations, exercising rights and claims

We may process data or disclose it to authorised authorities where required by law — Article 6(1)(c) GDPR. We process data needed to establish, pursue or defend claims under Article 6(1)(f) GDPR until the relevant limitation period expires, and in the event of proceedings until their final conclusion.

We handle and document GDPR requests under Article 6(1)(c) GDPR for the period needed to demonstrate that the obligation was properly fulfilled.

4. Recipients of data

Depending on the activity, data may be received by:

  • OVHcloud — hosting and backups;
  • home.pl S.A. — e-mail;
  • PayPro S.A. and Autopay S.A. — payment handling, and for instalments also the lender;
  • Alsendo sp. z o.o. — courier service brokerage;
  • carriers, currently InPost sp. z o.o. — parcel delivery;
  • National Revenue Administration authorities and other entities entitled to KSeF data;
  • Elfsight — accessibility tool and widgets showing Google reviews and Instagram updates;
  • Google — Google Fonts and, as described in the Cookie Policy, Google Analytics, Google Tag Manager and YouTube;
  • Meta and LinkedIn — only to the extent resulting from tools activated after consent;
  • providers of legal, audit or insurance services, and courts and public authorities, where necessary to fulfil a legal obligation or protect claims.

Entities providing services on our behalf receive data only to the extent necessary to provide the service and under an appropriate agreement. Payment operators, carriers, external platforms and public authorities may act as separate controllers to the extent resulting from the law or their own services.

5. Transfers outside the European Economic Area

Using global services of Google, Meta, LinkedIn or Elfsight may involve access to data from countries outside the European Economic Area, in particular the United States.

Transfers are based on a European Commission adequacy decision — including the EU–US Data Privacy Framework, where the recipient and the service are covered by a current certification — or on the European Commission’s standard contractual clauses, supplemented where necessary by additional safeguards. Information about the safeguard used, or a copy of it, can be obtained by contacting the Controller.

6. Your rights

Under the GDPR, you have the right to:

  • access your data and receive a copy — on request, we provide a copy of data relating to your use of the Shop in PDF or CSV format;
  • rectify your data;
  • erase your data;
  • restrict processing;
  • data portability, where processing is automated and based on consent or a contract;
  • withdraw consent at any time, without affecting the lawfulness of earlier processing;
  • object — on grounds relating to your particular situation — to processing based on Article 6(1)(f) GDPR;
  • lodge a complaint with the President of the Personal Data Protection Office (UODO).

These rights may be limited by the GDPR or other laws. For example, we will not delete invoice data before the end of its mandatory retention period.

You can send your request to biuro@magdaplantbased.com or to the Controller’s postal address. Before fulfilling a request, we may ask you to confirm your identity, e.g. by a message from the e-mail address linked to your account. We reply without undue delay, as a rule within one month. If the matter is complex or the number of requests is high, the period may be extended in accordance with Article 12 GDPR; we will inform you of this within the first month.

7. Automated decisions

MAGDA does not make decisions about users based solely on automated processing that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR. B2B account verification and the granting of individual B2B prices and discounts are carried out manually.

8. Security and updates

We apply technical and organisational measures appropriate to the type of data and risk, in particular access restrictions, system security, backups and incident response procedures. Rotating backups at OVH are kept until the end of the cycle needed to restore data after a failure and are then overwritten; a backup related to an incident may be kept until the incident is resolved and to protect claims.

We update this Policy when the law or the way the Website operates changes. The current version and date are always available on this page. A change to the Policy does not in itself replace consent where consent is required for a new purpose.

This is a translation. In the event of any discrepancy, the Polish version prevails.