Version of 12.11.2026
This policy fulfills the information obligation laid down in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter "GDPR", in Poland known as RODO), and in the Polish Act of 10 May 2018 on the protection of personal data (ustawa o ochronie danych osobowych). It explains how we process the personal data of users of the pokupka.eu website, of the moya.pokupka.eu personal account and of customers of the Pokupka service.
1. Controller of personal data
The controller of your personal data is IPS Express Sp. z o.o., Rzeszowska 33, 39-200 Dębica, Polska, NIP 8722412213 (hereinafter the "Controller", "we"), which provides services under the Pokupka trademark.
For any questions concerning the processing of personal data and to exercise your rights, please contact us:
- by e-mail: support@pokupka.eu;
- by post: IPS Express Sp. z o.o., Rzeszowska 33, 39-200 Dębica, Polska, marked "Ochrona danych osobowych" (Personal data protection).
2. What data we process and where we obtain it
- Account data (personal account): surname, first name and patronymic, phone number, e-mail address, customer number.
- Customs clearance data: the recipient's passport details.
- Delivery data: recipient, phone number, branch or delivery address in Ukraine.
- Data on parcels and services: online shop, contents, value, weight and dimensions of the parcel, tracking numbers, shipping history, payment data.
- Correspondence: name or nickname, phone number or e-mail address and the content of messages sent via Telegram, WhatsApp, Viber and e-mail.
- Technical data: IP address, browser and device type, page address, date and time of the request - these are recorded automatically by the server when you open the website.
We obtain data directly from you. If you name another person as the recipient, we obtain that person's data from you (Art. 14 GDPR) - in that case, please inform that person about this policy. The pokupka.eu website contains no forms and does not ask you to enter personal data.
3. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Registering and maintaining an account; receiving, storing, consolidating, dispatching and delivering parcels; purchasing goods on your behalf (Buy-for-me) | conclusion and performance of a contract (Art. 6(1)(b) GDPR) |
| Customs clearance of parcels | legal obligation under customs law (Art. 6(1)(c) GDPR) and performance of a contract (Art. 6(1)(b) GDPR) |
| Accounting and tax records, invoicing | legal obligation (Art. 6(1)(c) GDPR in conjunction with the Polish Accounting Act and tax legislation) |
| Answering inquiries and questions | our legitimate interest - communicating with customers (Art. 6(1)(f) GDPR), and where the inquiry relates to a contract - its performance (Art. 6(1)(b) GDPR) |
| Establishment, exercise and defense of legal claims | our legitimate interest (Art. 6(1)(f) GDPR) |
| Ensuring the security and operation of the websites | our legitimate interest (Art. 6(1)(f) GDPR) |
4. Is providing data mandatory
Providing data is voluntary but necessary to conclude and perform the contract. Without account and delivery data we cannot accept and deliver a parcel, and without the recipient's passport details we cannot carry out the customs clearance required by law.
5. Recipients of data
We disclose data only to the extent necessary for the relevant purpose:
- to carriers and delivery services - Nova Poshta and Nova Post;
- to customs authorities and persons carrying out customs clearance;
- to payment service providers and banks - to accept and refund payments;
- to service providers processing data on our behalf under a contract pursuant to Art. 28 GDPR: hosting, IT services, protection of the websites against attacks;
- to public authorities - only where required by law.
The Telegram, WhatsApp and Viber messengers process correspondence data as independent controllers under their own privacy policies.
We do not sell personal data and do not share it with third parties for their marketing.
6. Transfer of data outside the European Economic Area
Parcels are delivered to Ukraine, so recipient and parcel data are transferred to Ukraine - to Nova Poshta and the Ukrainian customs authorities. The European Commission has not adopted an adequacy decision with respect to Ukraine; the transfer is based on Art. 49(1)(b) GDPR, as it is necessary for the performance of the contract with you. Please note that data protection rules in Ukraine may differ from those in the EU.
Some service providers (for example, services protecting websites against attacks) may process data in the USA. In that case, the transfer is based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR).
7. Retention periods
- Account data - as long as the account is active; after it is deleted - only to the extent needed for the purposes below.
- Data related to the performance of a contract - for the term of the contract and then until the limitation periods under the Polish Civil Code expire (Art. 118 Kodeksu cywilnego).
- Accounting documents - 5 years, counted from the beginning of the year following the financial year to which they relate (Art. 74 of the Accounting Act), and for the periods set by tax legislation.
- Customs clearance documents - at least 3 years (Art. 51 of the Union Customs Code, Regulation (EU) No 952/2013).
- Correspondence - until the matter is resolved, and if it relates to a contract - until the limitation periods expire.
- Server technical logs - only for as long as necessary for security and troubleshooting.
8. Your rights
Under the GDPR you have the right:
- of access to your data and to obtain a copy of it (Art. 15);
- to rectification of your data (Art. 16);
- to erasure of your data (Art. 17);
- to restriction of processing (Art. 18);
- to data portability (Art. 20);
- to object to processing based on our legitimate interest (Art. 21);
- to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you believe the processing infringes the law (Art. 77).
To exercise your rights, write to support@pokupka.eu. We will respond without undue delay and in any event within one month; in complex cases this period may be extended by two further months, of which we will inform you (Art. 12(3) GDPR). Some rights are restricted by law - for example, we cannot erase data that we are required to keep for accounting or customs control purposes.
9. Automated decision-making and profiling
We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
10. Cookies
Cookies are small text files that a website stores in your browser. Under Art. 399 of the Polish Act of 12 July 2024 Prawo komunikacji elektronicznej (Electronic Communications Law), cookies that are strictly necessary to provide a service you have requested may be stored without your consent - we only inform you about them.
The pokupka.eu website uses only such strictly necessary cookies and does not use advertising or analytics cookies:
| Name | Purpose | Duration |
|---|---|---|
cookie_notice | remembers that you have closed the cookie notice | 1 year |
You can view and delete cookies or block them in your browser settings. The website will still work afterwards, but it will show the cookie notice again.
The pokupka.eu website does not load any third-party services into your browser: fonts, scripts and exchange rates for the calculator are served by our own server. The moya.pokupka.eu personal account may use its own cookies necessary for signing in and protection against attacks.
The website contains links to our Instagram and Facebook pages. These are ordinary links - until you click them, these services receive no data from the website.
11. Security
We apply technical and organizational measures appropriate to the risks (Art. 32 GDPR), including an encrypted HTTPS connection for the website and the personal account.
12. Changes to this policy
We may change this policy, in particular if the law or our services change. The current version is always available on this page, and its date is shown at the top.