Privacy policy and information notice

Below we fulfil the information obligation under Article 13 GDPR. We provide this information at the time of data collection — when creating an account, placing an order, sending a contact form or signing up for information about offers.

1. Data controller

The data controller of your personal data is ART WIN-EX Sp. z o.o., ul. Widok 5, 43-300 Bielsko-Biała, Poland.

Tax ID: 5472219582, REGON: 386463732.

2. Contact regarding personal data

Write to info@kapkawina.pl, call +48 530 685 430 or use the contact form on the website. We respond without undue delay, and in matters concerning the rights of individuals no later than within a month (Art. 12(3) GDPR).

We have not appointed a Data Protection Officer (DPO) — we are not obliged to do so. All matters concerning personal data are handled by the contact person indicated above.

3. Purposes of processing, legal bases and retention periods

Purpose of processing	Legal basis	Retention period
Setting up and managing a customer account (B2B, retail network point) — access to prices, orders, invoices	Art. 6(1)(b) GDPR (necessity for entering into and performing a contract)	for the duration of the account, and after its deletion until the expiry of the limitation period for claims (up to 6 years)
Acceptance and fulfilment of the order, delivery, handling of complaints and returns	Art. 6(1)(b) GDPR (performance of a contract)	for the duration of order fulfilment, and thereafter until the expiry of the limitation period for claims (up to 6 years from the end of the calendar year)
Issuing invoices and keeping accounting records	Art. 6(1)(c) GDPR (legal obligation: tax regulations and the Accounting Act)	5 years from the end of the tax year in which the document was issued (tax regulations and the Accounting Act)
Establishing, pursuing and defending against claims	Art. 6(1)(f) GDPR (legitimate interest: protection of the data controller's rights)	for the duration of order fulfilment, and thereafter until the expiry of the limitation period for claims (up to 6 years from the end of the calendar year)
Response to an enquiry from the contact form, email or phone	Art. 6(1)(f) GDPR (legitimate interest: handling communication and protection against abuse)	12 months from last contact
Information about new wines, promotions and offers (own marketing)	Art. 6(1)(a) GDPR (consent) and Art. 10 of the Act on Provision of Electronic Services	until consent is withdrawn
Service security, fraud prevention, error diagnostics	Art. 6(1)(f) GDPR (legitimate interest: security and proper functioning of the website)	log files for up to 30 days; audit trail (who, when, what operation) for up to 12 months
A/B tests of the page layout — we check which version of the page works better; measurement only after consent to cookies	Art. 6(1)(f) GDPR (legitimate interest: development and improvement of the website)	variant assignment works in your session; we collect data only after consent to cookies and store it for no longer than 12 months

4. Recipients of data

Your data may be shared with entities that help us run the service and fulfil orders. We share it only to the extent necessary and only with entities bound by a data processing agreement:

• hosting and email provider — server, mailbox and backup maintenance (MyDevil.net)
• courier company — order delivery (DHL)
• accounting office and accounting software provider — issuing and storing invoices
• IT and technical support providers — administration, maintenance, backups
• public authorities (tax offices, courts, law enforcement) — only where required by law
• law firms and advisors — where necessary to pursue or defend claims

We do not sell personal data and do not share it for marketing purposes with third parties.

We currently do not use external analytics tools (e.g. Google Analytics). If we enable them, we will run them only after your consent, and the information in this document will be updated.

5. Transfer of data outside the European Economic Area

We do not transfer personal data outside the European Economic Area. Our server and mailboxes operate in Poland.

6. Your rights

At any time you can:

• access your data and receive a copy of it (Art. 15 GDPR),
• rectify incomplete or incorrect data (Art. 16 GDPR),
• erase data — "right to be forgotten" (Art. 17 GDPR),
• restrict processing (Art. 18 GDPR),
• receive data in a portable format (Art. 20 GDPR),
• object to processing based on legitimate interest — Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdraw consent at any time (Art. 7(3) GDPR) — without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, write to info@kapkawina.pl. We do not charge any fees for this.

You have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa. You may also lodge a complaint if you believe that the processing violates the GDPR in any other way.

You can withdraw your consent to receive marketing information at any time: in the customer panel (/moje-konto/edytuj/), via the “unsubscribe” link in a message, or by a regular email. Withdrawing consent does not affect order fulfilment.

7. Is providing data mandatory

Providing data is voluntary, but when creating an account and placing an order it is a condition for concluding a contract: without company details, delivery address and email address we cannot issue an invoice or deliver the order. Data provided in the contact form is voluntary — without it we will not respond to the enquiry. Consent to marketing is entirely voluntary and neither creating an account nor processing an order depends on it.

8. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you (Art. 22 GDPR). A/B tests are not used to evaluate individuals — they only measure which version of the page layout works better.

9. Cookies and local technologies

Cookies are small files stored in your browser. We use them to keep you logged in, for form security and to remember your choices. Essential cookies always work — without them the site does not function properly; the rest are described below and you can block them in your browser.

Name	Purpose	Lifetime
sessionid	keeping you logged in to the panel and customer zone; after analytics consent also assigning a stable A/B test variant to unauthenticated guests (session created only after that consent)	12 hours
csrftoken	protecting forms against CSRF attacks	12 months
kapka_age_verified	age verification (age gate for alcohol-related content)	12 months
kapka_consent	storing your cookie decision by category (necessary / analytics) — versioned JSON; so we do not ask on every visit and you can change your decision (link “Cookies” in the footer)	12 months
kapka_language	remembering the selected interface language (PL/EN/IT/ES)	12 months
ab_hero	assignment of the A/B test variant of the page layout — set ONLY after your analytics consent (effectiveness measurement)	90 days

You can delete or block cookies at any time in your browser settings. Blocking essential cookies will prevent you from logging in and placing an order. The site itself does not use external advertising systems nor does it track you across websites.

10. Data security

The service operates exclusively over HTTPS. Passwords are stored as hashes (Argon2) — we have no access to them. Login credentials for email inboxes are encrypted (Fernet). Access to data is limited to authorised employees and processors, and the database is covered by backups. Significant events are logged to detect abuse.

11. Changes to the privacy notice

Each version of this notice has a number (currently 2026-09-v2), which we store together with the date of your acceptance when creating an account. This way we know what content you received at a given time. We inform you about significant changes on the site, and when they require new acceptance — at your next login.

In the event of any discrepancies between the versions of the document in different languages, the Polish version shall prevail.