TERMS AND CONDITIONS OF THE ONLINE STORE tutu.eu

This Privacy Policy explains how the Controller processes the personal data of visitors to the online store https://tutu.eu/, customers, account holders, and individuals who contact the store. It outlines the purposes and legal bases for data processing, data recipients, retention periods, and the rights of data subjects.

This document is for informational purposes only. It does not constitute terms of sale or a contract with a customer. Neither reviewing this Privacy Policy nor using the store constitutes, in itself, consent to data processing in cases where such consent is required.

In this document, the terms “Store” and “Website” refer to the online store tutu.eu; “Customer” refers to an individual who uses its services or makes purchases; and “Controller” refers to the entity specified in Section 2. “GDPR” refers to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of personal data.

The Store conducts sales within Poland and to other countries in the European Union. It does not operate a newsletter and does not use Google Ads or the TikTok Pixel. A description of the analytical tools employed can be found in Section 10.

The controller of your personal data is Kalvik, located at: Węgierska 12B, 33-340 Stary Sącz; Tax ID (NIP): 734-262-76-68; Statistical ID (REGON): 545150708; email: hubert@tutu.eu; phone: +48 696 230 088.

For matters concerning your personal data, you may contact the controller via email, phone, or regular mail. You may send inquiries regarding data processing, as well as requests to exercise the rights described in section 7, to the email address: hubert@tutu.eu.

If there are reasonable doubts regarding the identity of the person submitting a request, the controller may ask for additional information necessary to verify that identity. The scope of such verification shall be proportionate and limited to the information required to process the request.

The Controller has not appointed a Data Protection Officer. For matters concerning the protection of personal data, please contact the Controller directly at: hubert@tutu.eu.

Data acquisition
Data is collected in connection with the placement and processing of orders, the maintenance of customer accounts, payments and deliveries, returns and complaints, email correspondence, the use of contact forms, and the submission of product reviews—depending on the specific features of the Store being utilized. Data regarding the use of the Website may also be collected via cookies and Google Analytics.
The scope of the required data depends on the action being performed by the Customer and is indicated within the relevant form. Data provided voluntarily within the content of a message is processed in relation to the specific matter to which the communication pertains.

Data categories
Depending on the feature used and the information provided by the customer, the scope of data may include identification and contact details, address information required for delivery or billing, details regarding orders, payments, returns, or complaints, as well as the content of correspondence or feedback. If a customer places an order on behalf of a company and provides invoicing details, the scope may include the company name and tax identification number (NIP).

Objectives and legal bases
The legal basis for processing depends on the purpose for which the data is used. The following bases apply to specific activities:

Google Analytics is used to analyze the use of the Website. According to the Administrator, it is always active, regardless of the user’s consent.

Orders and customer account
Data provided at the time of purchase is used to process the order and for communication regarding its fulfillment, delivery, billing, returns, or complaints. Failure to provide the data necessary for the performance of the contract may make it impossible to fulfill the order.
Account data is used to provide the service of maintaining the account. A request to close an account does not necessarily entail the deletion of records pertaining to previous orders, provided there is a separate legal basis for their continued retention. Being linked to a store or a Business Center (BC) does not limit the Customer’s rights.

Contact and feedback
When you contact us via email or a contact form, you provide your contact address and the information contained in your message. This data is used to respond to your inquiry and handle the matter at hand. The legal basis for this is either the performance of a contract (or taking steps prior to entering into a contract, if the communication relates to such a matter) or our legitimate interest in maintaining correspondence. Sending a message does not, in itself, constitute consent to receive a newsletter or promotional material.
In the case of reviews, the scope of the data, the method of publication, and the specific legal basis for processing depend on the actual mechanism used to collect them.

Microsoft Dynamics 365 Business Central
Order and customer data are stored in Microsoft Dynamics 365 Business Central (hereinafter “BC”). The IT department administrator has access to the data within BC. The use of the system itself does not constitute a separate legal basis; rather, the data processed within it must be linked to specific purposes related to the operation of the store.

The retention period depends on the purpose, the category of data, and legal obligations. The controller has confirmed that order and customer data are retained for 10 years and deleted thereafter. This does not automatically imply the same retention period for all data within the Store.

The obligation to retain documentation or the need to protect legal claims requires an appropriate legal basis and an assessment of necessity. These factors do not automatically justify the continued storage of an entire customer history or all data across every system. Deleting cookies from a browser does not necessarily result in the deletion of data previously transmitted to an analytics provider.

Data may be transferred to entities that support the operation of the Store and the fulfillment of orders, solely to the extent necessary for the services provided. Recipients include the following providers and categories of entities:

• OVHcloud — store hosting; according to the Administrator, the servers are located in Poland.
• PayU — payment processing.
• InPost, DPD, Poczta Polska, and DHL — delivery handling, depending on the selected service.
• IT and accounting service providers — within the scope of the services provided.
• Google Analytics provider — with regard to the data actually sent under the current configuration.

Recipients may also include public authorities authorized to obtain data under applicable law. Order and customer data are also processed within BC; while it is confirmed that IT staff have access, a complete list of individuals and entities with access to the system has not been established.

The store operates on WooCommerce and WordPress. The mere use of this software does not automatically entail the transfer of data to its developers. Whether data is transferred via additional plugins or services must be determined based on the actual configuration.

These rights apply to the extent and under the conditions set out in the GDPR. You may request:

• access to data and copies thereof, as well as information regarding processing;
• rectification of inaccurate data and completion of incomplete data;
• erasure of data or restriction of processing, where the relevant grounds exist;
• the transfer of data provided to the Controller, where processing is carried out automatically based on consent or a contract; direct transfer to another controller is possible, provided it is technically feasible;
• accommodating an objection to processing based on a legitimate interest, on grounds relating to the individual’s particular situation;
• withdrawal of consent, if it serves as the basis for processing, without affecting the lawfulness of processing based on consent before its withdrawal.

The right to erasure is not absolute; in particular, it does not apply when continued storage of data is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims. Neither the 10-year retention period nor the fact that the data is linked to a “BC” (business contact/record) precludes you from submitting such a request.

Requests may be sent to hubert@tutu.eu or to the address of the Data Controller. The Data Controller will provide information regarding the actions taken in response to your request without undue delay—and in any event, no later than one month after receiving it. If necessary, this period may be extended by an additional two months, taking into account the complexity or number of requests; you will be notified of any such extension and the reasons for it within the initial one-month period. Legal basis: Article 12 of the GDPR.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). You are not required to contact the Data Controller before exercising this right.

Providing data is, in principle, voluntary. However, data necessary for the conclusion and performance of a sales contract is required to place and process an order. Failure to provide such data may make it impossible to fulfill the order. Similarly, the absence of data required to maintain an account or respond to an inquiry may prevent the provision of the relevant service.

Providing additional information that is not required for a specific action is voluntary. You should not submit information that is not necessary for handling your matter. The store does not operate a newsletter; therefore, it does not collect data for the purpose of subscription to such a service.

Profiling refers to the automated use of data to evaluate specific characteristics or behaviors of an individual. It should be distinguished from decisions made solely by automated means that produce legal effects or similarly significant impacts on an individual.

The store does not use Google Ads or the TikTok Pixel. The extent of profiling, segmentation, or potential automated decision-making within Google Analytics, BC, or other utilized features has not been verified. The mere absence of advertising tools is not sufficient to declare that such processing does not occur at all.

The Controller implements technical and organizational measures, commensurate with the risks associated with processing, to protect the confidentiality, integrity, and availability of data. Access to data must be aligned with the responsibilities of the individuals performing tasks on behalf of the Controller.

Access to BC by an IT department employee has been confirmed.

This policy may be updated in response to changes in regulations, Store features, tools used, service providers, or data processing methods. The current, verified version will be made available on the website, accompanied by the date of the update. Where required by law, data subjects will also be notified of such changes through other appropriate means.
Updating this policy does not replace the requirement to obtain any necessary consent. As the Store does not operate a newsletter, this document does not provide for notifications regarding changes to be sent via that channel.

W sprawach dotyczących przetwarzania danych osobowych prosimy o kontakt: hubert@tutu.eu, tel. +48 696 230 088, adres korespondencyjny: Węgierska 12B, 33-340 Stary Sącz.
Prosimy wskazać, jakiej sprawy lub prawa dotyczy wiadomość, aby umożliwić jej prawidłową obsługę. Nie trzeba przekazywać danych niezwiązanych ze zgłoszeniem.

According to the Controller, the OVHcloud hosting servers are located in Poland. The locations of backups, as well as the locations from which service providers may access data remotely, have not been confirmed. The location of the store’s servers does not determine the location of data processed by Google Analytics, BC, or email services.
Transfers outside the European Economic Area (EEA)—including remote access by entities based outside the EEA—require an appropriate legal basis and safeguards as specified in Chapter V of the GDPR.