Last updated: 17 October 2026
This policy explains what personal data we process on shineup.pl, for what purposes and on what legal basis, and how we use cookies. It fulfils the information obligation under Art. 13 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller of personal data is ShineUp Sp. z o.o. (the “Controller”). The company's full registration details (registered address, KRS, NIP) are available in the Polish National Court Register and on request.
Data protection contact: email biuro@shineup.pl, phone +48 453 484 170. The Controller has not appointed a Data Protection Officer (Art. 37 GDPR).
2. What data we process, why and on what basis
- Quote requests and contact (quote form, email, phone): name, company, email address, phone number, delivery city, message content, calculator parameters, any logo or artwork file you upload, and which page or campaign the enquiry came from (UTM parameters). Form data is saved in a secured enquiry register on the website server and sent to our office mailbox; we send an automatic confirmation to the email address you provide. Your IP address is used only as an encrypted hash to protect the form from spam (for 1 hour). Purpose: preparing a quote and replying – Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in business correspondence with B2B customers).
- Order fulfilment and invoicing – Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (tax and accounting obligations).
- Establishing, pursuing or defending legal claims – Art. 6(1)(f) GDPR.
- Visitor statistics (analytics cookies) – only with your consent, Art. 6(1)(a) GDPR.
- Marketing and ad measurement (marketing cookies) – only with your consent, Art. 6(1)(a) GDPR.
Providing data is voluntary but necessary to prepare a quote and reply. We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you.
3. How long we keep data
- enquiries that did not lead to an order – up to 12 months from the last contact;
- contract and invoicing data – for the period required by tax and accounting law (generally 5 years from the end of the tax year);
- data needed to defend against claims – until the limitation period expires;
- data processed on the basis of consent – until consent is withdrawn.
4. Recipients
Data may be shared, only as necessary and under data processing agreements or other legal bases, with our hosting and email providers, accounting office, transport and courier companies (for deliveries) and, with your consent, analytics and advertising providers (Google Ireland Ltd., Meta Platforms Ireland Ltd.). Data may also be disclosed to authorities where required by law. We do not sell personal data.
5. Transfers outside the EEA
Using Google and Meta tools (only with your consent) may involve transferring data to the USA, based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses approved by the Commission.
6. Your rights
- right of access and to obtain a copy (Art. 15 GDPR);
- right to rectification (Art. 16 GDPR);
- right to erasure (Art. 17 GDPR);
- right to restriction of processing (Art. 18 GDPR);
- right to data portability (Art. 20 GDPR);
- right to object to processing based on legitimate interest (Art. 21 GDPR);
- right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw).
To exercise your rights, email biuro@shineup.pl.
7. Cookies and similar technologies
Cookies are small text files stored on your device. We use them in accordance with Art. 399 of the Polish Electronic Communications Law of 12 July 2024. Strictly necessary cookies are set without consent; analytics and marketing cookies only after you consent in the cookie banner. Until you decide, analytics and advertising services are not loaded (Google Consent Mode, basic mode).
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| su_consent | ShineUp | stores your cookie choice | necessary | 12 months |
| su-calc (browser storage) | ShineUp | carries calculator results into the quote form | necessary | until the enquiry is sent |
| su-attr (session storage) | ShineUp | remembers the traffic source (e.g. campaign) attached to your quote request | necessary | until the tab is closed |
| _ga, _ga_* | Google Analytics | visitor statistics | analytics (with consent) | up to 2 years |
| _gcl_au | Google Ads | ad performance measurement | marketing (with consent) | 3 months |
| _fbp | Meta (Facebook) | ad measurement and targeting | marketing (with consent) | 3 months |
You can change or withdraw your consent at any time using the cookie icon in the bottom-left corner of the screen or the “Cookie settings” link in the footer. You can also delete or block cookies in your browser settings; blocking necessary cookies may affect some website features.
8. Security
We apply technical and organisational measures appropriate to the risk, including encrypted HTTPS connections, security headers that reduce browser-based attacks, and access to data limited to authorised persons.
9. Changes to this policy
This policy may be updated, e.g. when laws or the tools we use change. The current version, with its update date, is always available on this page.