Privacy policy
Last updated: 14 October 2026
1. General provisions
- This document sets out the Privacy policy of the ecoben.eu shop, covering in particular the rules on protecting personal data and on the security of other data entered by the User on the Website.
- This Privacy policy forms an integral annex to the Terms and conditions.
2. Definitions
- Controller: ECOBEN BIOTECH sp. z o.o., ul. Zabrska 28B, 44-177 Paniówki, Poland, tax number (NIP/VAT) PL9691676092, entered in the register of entrepreneurs of the National Court Register of Poland (KRS) kept by Sąd Rejonowy w Gliwicach, X Wydział Gospodarczy KRS, under KRS number 0001210623.
- Website: the website at https://ecoben.eu and all its subpages.
- Parties: the Controller and the User.
- User: a natural person who uses the Website and provides personal data on it.
- GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
3. The Controller and the data processed
- The Controller is the controller of personal data within the meaning of the GDPR.
- The Controller processes data within the limits, for the periods and for the purposes set out in this policy and, where applicable, in the information shown next to the forms used to collect the data.
- Through the Website and other means of communication, the Controller collects and processes the data needed to fulfil orders, namely the data Users provide when placing an order and in the Customer Account: first name and surname, delivery address, billing address, email address, phone number, the User’s comments on the order and, for legal persons, their name and tax number.
- When a User places an order without being logged in, a Customer Account is automatically created for the email address in the billing details, and the User receives an email with a link to set a password. The order history is kept in the account. The User can also log in using a single-use link sent by email and can ask at any time for the account to be deleted by writing to shop@ecoben.eu.
- When a User contacts us by email or phone, we process the data they give us (for example their name, email address, phone number and the content of their message) in order to reply.
- When a User writes to us through the contact form or the B2B enquiry form, we process the data entered in the form: full name, email address, phone number (optional) and the content of the message, together with the consent given by ticking the consent box. We use these data to reply and, for a B2B enquiry, to prepare an offer; a copy of each message is sent to the company mailbox.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Creating and managing the Customer Account, including keeping the order history | Art. 6(1)(b) (performance of the contract for the account service) | until the account is deleted at the User’s request |
| Fulfilling orders (processing, delivery, payment) and communication relating to performance of the contract | Art. 6(1)(b) (performance of the contract of sale) | for the duration of the contract |
| Handling returns and complaints | Art. 6(1)(b) and (c) (contract and the Controller’s legal obligations) | while the matter is being handled and afterwards until the limitation periods for claims expire |
| Meeting accounting and tax obligations (for example issuing and keeping invoices) | Art. 6(1)(c) (legal obligation) | for the period required by accounting and tax legislation |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) (the Controller’s legitimate interest) | until the limitation periods for claims expire |
| Replying to messages sent through the Website forms, by email or by phone, and preparing B2B offers | Art. 6(1)(f) (legitimate interest: communicating with Users) or Art. 6(1)(b), if the message concerns an order or an enquiry (steps taken at the User’s request before entering into a contract) | for the duration of the correspondence and afterwards for as long as needed for any claims |
| Ensuring the technical operation and security of the Website (necessary cookies, server logs) | Art. 6(1)(f) (legitimate interest) | as set out in sections 9 and 10 |
- Personal data are kept for the duration of the contract and afterwards for the period required by law, taking into account the limitation periods for claims and tax obligations. Data processed on the basis of consent (if this becomes relevant) are kept until consent is withdrawn.
- The Controller does not process the data of ecoben.eu Users for direct marketing purposes.
5. Recipients of the data
- Personal data are shared only with the Controller’s trusted partners, to the extent needed for the purposes above, namely:
- IT service providers (website hosting, sending emails, the order management system);
- courier companies, for delivering orders;
- Stripe Payments Europe Ltd. (Ireland), for processing online payments by card, Apple Pay and Google Pay; card details are entered directly with Stripe and are not stored by the Controller;
- the accounting firm and the invoicing service provider;
- the people responsible for managing the Controller.
- Data may be disclosed to public authorities only where the law requires it.
6. Automated decision-making and profiling
- The Controller does not make decisions based solely on automated processing of data, including profiling, that produce legal effects concerning the User or similarly significantly affect them, and does not use profiling for marketing purposes.
- The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
7. The User’s rights
- If their personal data change, the User can update them in the Customer Account or by sending a message to the Controller.
- The User has the right to request access to their personal data, rectification or erasure of the data (the ‘right to be forgotten’) and restriction of processing. They also have the right to data portability, the right to object to processing based on the Controller’s legitimate interest and, where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- The User has the right to lodge a complaint with a supervisory authority. The Controller’s lead supervisory authority is the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO, Poland). The User may also lodge a complaint with the Data Protection Commission in Ireland, www.dataprotection.ie.
- Providing personal data is voluntary. However, the data marked as required in the order form are necessary to make and perform the contract; without them the order cannot be placed or fulfilled.
- The Controller may refuse to erase the User’s personal data if keeping them is necessary to comply with a legal obligation of the Controller or to establish, exercise or defend legal claims.
8. Data security
- The Controller uses all appropriate technical and organisational measures to ensure the security of the User’s personal data and to protect them against accidental or deliberate destruction, accidental loss, alteration, disclosure or unauthorised access. The information is stored and processed on highly secure servers, in line with the security measures required by the applicable law.
- The Controller keeps backup copies containing the User’s personal data.
- The data are stored on equipment and servers located in suitably secured data centres, to which only authorised persons have access.
- The Controller carries out personal data processing in compliance with all the legal and technical requirements of data protection legislation.
9. Cookie policy
- Cookies are small text files that a website sends to the visitor’s device.
- At present, the Website uses only cookies that are strictly necessary for the shop to work, set by the WordPress platform, the WooCommerce plugin and the payment processor (Stripe): for the shopping basket, for the security of online payments, for the shopping session and for logging in to the Customer Account. Without these cookies it is not possible to place an order. Strictly necessary cookies do not require consent.
- The Website uses two types of cookies: ‘session’ cookies, which are temporary and stay on the User’s device until they log out, leave the website or close the browser, and ‘persistent’ cookies, which stay on the device for the period set in their parameters or until the User deletes them.
| Category | Examples | Purpose |
|---|---|---|
| Shopping basket | woocommerce_cart_hash, woocommerce_items_in_cart | remember the products added to the basket |
| Session | wp_woocommerce_session_* | link the basket and order to your visit |
| Login | wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | keep you logged in to the Customer Account and protect the account |
| Online payment (Stripe) | __stripe_mid, __stripe_sid | fraud prevention for payments by card, Apple Pay or Google Pay |
- The Website does not currently use cookies or other tools for analytics or marketing. If such tools are introduced, we will update this policy and ask for Users’ consent before enabling them.
- The User can delete or block cookies in their browser settings. Blocking strictly necessary cookies may stop the basket, ordering and login from working.
10. Server logs
- Like most websites, we keep a record of the HTTP requests made to our server (server logs). This records:
- the IP addresses from which Users access the Website;
- the time the request was received;
- the time the response was sent;
- the name of the client station, identified by the HTTP protocol;
- information about errors that occurred in the HTTP transaction;
- the URL of the page the User visited previously (referrer);
- information about the User’s browser.
- Log data are used solely for administering and securing the Website.
- Logs are kept only for as long as needed to administer and secure the Website. The information in them is not disclosed to anyone other than the people authorised to administer the Website. Statistics that help with administration may be generated from the logs; these summaries contain no data that would identify visitors.
11. Contact
- The User has the right at any time to access and change their personal data, and the right to ask the Controller to erase them without delay (the ‘right to be forgotten’), within the limits set out in section 7.
- Requests concerning the processing of personal data can be sent by email to shop@ecoben.eu.
- The Controller can also be contacted by post at ECOBEN BIOTECH sp. z o.o., ul. Zabrska 28B, 44-177 Paniówki, Poland, or by phone on +48 32 428 10 20 on working days. Other contact details are available on the Contact page.