Effective from: 04.11.2026
This Privacy Policy explains how we process the personal data of users of the medastex.eu online shop, our customers and people who contact us. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR).
1. Data controller
The controller of your personal data is Medas Textile Sp. z o.o., with its registered office in Janki, Aleja Krakowska 33A, 05-090 Janki, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000654133, NIP (tax ID) 5223079716 (the “Controller”, “we” or “us”).
2. Contact regarding personal data
For any matter concerning personal data, you can contact us:
- by e-mail: info@medastex.pl,
- by post: Medas Textile Sp. z o.o., Aleja Krakowska 33A, 05-090 Janki, Poland.
The Controller has not appointed a Data Protection Officer.
3. What data we process
Depending on how you use our services, we may process:
- identification and contact data: first and last name, company name, tax ID (NIP/VAT), address, e-mail address, telephone number,
- customer account data and order history (including orders placed in our previous online shop and transferred to the new platform),
- delivery and payment data (delivery address, chosen delivery method, invoice details),
- the content of enquiries and messages (price, sample and made-to-order enquiries, contact form, comments),
- the e-mail address provided when subscribing to the newsletter,
- technical data: IP address, browser and device information, cookies (see the Cookie Policy).
4. Purposes, legal bases and retention periods
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Creating and maintaining a customer account | Art. 6(1)(b) – performance of a contract | until the account is deleted, then up to 3 years to defend against claims |
| Fulfilling orders, delivery, handling complaints | Art. 6(1)(b) – performance of a contract | 3 years after the contract ends |
| Answering enquiries (price, samples, made-to-order, contact form) | Art. 6(1)(f) – legitimate interest (answering your enquiry) | 12 months after the correspondence ends; if a contract is concluded – as for orders |
| Accounting and tax settlements | Art. 6(1)(c) – legal obligation | 5 years from the end of the calendar year in which the tax obligation arose |
| Sending the newsletter and commercial information by e-mail | Art. 6(1)(a) – consent | until consent is withdrawn |
| Managing relations with business customers (CRM) | Art. 6(1)(f) – legitimate interest | for the duration of cooperation, then up to 3 years |
| Publishing comments and reviews | Art. 6(1)(f) – legitimate interest | until the comment is removed or you object |
| Establishing and defending legal claims | Art. 6(1)(f) – legitimate interest | until the limitation period for claims expires |
| Security and proper operation of the website | Art. 6(1)(f) – legitimate interest | as described in the Cookie Policy and for the server log retention period |
5. Data of employees and associates of our customers (B2B)
If you are an employee or associate of one of our customers or suppliers, we may have received your data (name, position, business e-mail address and telephone number) from your employer or principal, or directly from you. We process this data under Art. 6(1)(f) GDPR, based on our legitimate interest in communicating about the conclusion and performance of a contract with the company you represent, for the duration of the cooperation and then for up to 3 years to defend against claims. You have the rights described in section 8.
6. Recipients of data
We may share your data, only to the extent necessary for the purposes described above, with the following categories of recipients:
- shop hosting provider: Hostinger International Ltd / UAB Hostinger – servers in the EU (the Netherlands),
- content delivery network and website security provider: Cloudflare, Inc.,
- e-mail and office tools provider: Google (Google Workspace),
- Bitrix24 CRM system – server in the EU (Germany),
- Comarch ERP Optima sales and warehouse system and the IT partner that maintains it,
- accounting office: VEPT CONSULTING Sp. z o.o., ul. Igańska 24, 04-087 Warsaw, Poland,
- bank handling payments: Erste Bank Polska S.A., Plac Europejski 3A, 00-844 Warsaw, Poland,
- courier and transport companies: DPD Polska Sp. z o.o., Raben Logistics Polska Sp. z o.o.,
- public authorities – only where required by law.
7. Transfers outside the European Economic Area
Some of our providers (Google, Cloudflare) are based in the United States or use US entities. In such cases, data is transferred on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by contacting us.
8. Your rights
In connection with the processing of your data, you have the following rights:
- the right of access to your data (Art. 15 GDPR),
- the right to rectification (Art. 16 GDPR),
- the right to erasure, the so-called “right to be forgotten” (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR),
- the right to object to processing based on legitimate interest (Art. 21 GDPR),
- the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).
To exercise these rights, write to info@medastex.pl. You can unsubscribe from the newsletter at any time by clicking the link in the footer of the message.
9. Right to lodge a complaint
If you believe that the processing of your personal data violates the law, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO – Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
10. Voluntary provision of data
Providing data is voluntary, but necessary to create an account, place an order or receive an answer to an enquiry. Providing invoice details is a statutory requirement. Subscribing to the newsletter is entirely voluntary.
11. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
12. Cookies
Information about the cookies used in the shop can be found in the Cookie Policy.
13. Changes to this Privacy Policy
We may update this Privacy Policy. The current version, with its effective date, is always available on this page.