Privacy Policy

Privacy Policy – Mendels

Last update: 26.11.2025

This Privacy Policy sets out the rules for the processing of personal data by the Mendels online store available at https://mendels.co. The store is operated by:

ECHO CORP SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

The Policy has been prepared in accordance with:

• GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council),
• the Polish Personal Data Protection Act,
• the Act on the Provision of Electronic Services.

  1. PERSONAL DATA ADMINISTRATOR

The Data Administrator is Echo Corp sp. z o.o.

For matters related to data protection, contact:

• e-mail: mendel.bydgoski@gmail.com
• address: Wiece 11/C, 60-638 Poznań
• phone: +48 600 353 698

The Administrator processes data in accordance with applicable law and ensures its security.

  1. SCOPE OF PROCESSED DATA

The Administrator may process the following personal data:

• first and last name,
• e-mail address,
• phone number,
• delivery address,
• billing address,
• invoicing details,
• transaction data (without card numbers – handled by payment operators),
• IP address,
• cookies and analytical data.

  1. PURPOSES AND LEGAL BASIS OF PROCESSING

Data is processed for the following purposes:

3.1. Order fulfillment

• preparation, shipment and handling of purchases,
• legal basis: Art. 6(1)(b) GDPR (performance of a contract).

3.2. Customer service and contact

• responses to inquiries, complaints, returns,
• legal basis: Art. 6(1)(b) and (f) GDPR.

3.3. Payments

• data transferred to Przelewy24 and any international payment operators,
• the Administrator does not process payment card details.

3.4. Marketing (with consent)

• newsletter, remarketing campaigns,
• legal basis: Art. 6(1)(a) GDPR.

3.5. Analytics and cookies

• improving website functionality and performance,
• legal basis: the Administrator's legitimate interests.

3.6. Accounting and tax purposes

• legal basis: legal obligation (Art. 6(1)(c) GDPR).

  1. COOKIES

The store uses cookies for:

• ensuring proper website operation,
• analytics (e.g. Google Analytics),
• content personalization,
• marketing activities (e.g. Meta Ads, Google Ads).

Users may manage cookies in browser settings.

  1. DATA RECIPIENTS

Personal data may be shared with:

• courier companies (InPost, international courier),
• payment operators (Przelewy24),
• accounting service providers,
• hosting and technical service providers,
• marketing tool providers.

The Administrator does not transfer data outside the EU unless necessary for international order fulfillment.

  1. DATA RETENTION PERIOD

Data is stored as follows:

• order data – 6 years (tax requirements),
• marketing data – until consent is withdrawn,
• user account data – until the account is deleted,
• analytical data – according to the cookie policy (typically 12–26 months).

  1. USER RIGHTS

The User has the right to:

• access their data,
• rectify data,
• delete data (“right to be forgotten”),
• restrict processing,
• transfer data,
• object to processing,
• withdraw consent at any time,
• lodge a complaint with the President of the Polish Data Protection Authority (UODO).

  1. DATA SECURITY MEASURES

The Administrator applies technical and organizational measures, including:

• SSL encryption,
• server security systems,
• access controls,
• encrypted data transmission.

  1. NEWSLETTER AND MARKETING

9.1. Newsletter subscription

• Subscribing to the newsletter is voluntary.
• The User may unsubscribe at any time via a link in the e-mail.

9.2. Marketing content

• The newsletter may contain commercial information in accordance with the Act on the Provision of Electronic Services.
• Marketing activities may include remarketing campaigns.

  1. USER ACCOUNT

• The User may create an account voluntarily.
• The Administrator has the right to block an account in case of violation of the Terms and Conditions.

  1. INTERNATIONAL ORDERS

For orders outside the EU, data may be transferred to:

• foreign carriers,
• customs authorities,
• local logistics operators.

Data is transferred only to the extent necessary to complete delivery.

  1. CHANGES TO THE PRIVACY POLICY

12.1. Updates

• The Policy may be updated.
• The new version applies from the moment it is published on the website.

12.2. User responsibility

• Users should regularly check for updates to the Policy.

  1. ADMINISTRATOR DETAILS

• Company name: Echo Corp Sp.z.o.o.
• Address: Komandosów 10, 85-549 Bydgoszcz
• E-mail: mendel.bydgoski@gmail.com
• Phone: +48 600 353 698
• NIP/REGON/KRS: 9671478940/529328171/0001119806

This Privacy Policy is effective from the moment it is published on the website.