Privacy policy

WINGS24.PL and WINGSBRAND.COM

PRIVACY AND COOKIES POLICY

Updated: July 30, 2026

PART I. PRIVACY POLICY

General information

This privacy policy describes the principles of processing personal data of persons using the online store available at www.wings24.pl, in particular customers, account users, persons contacting the store, newsletter subscribers, and persons using the review, product recommendation, chatbot, and AI assistant functions. Information about cookies and similar technologies is provided in Part II - Cookies Policy.

Administrator and contact

The personal data administrator is WINGS sp. z o.o. with its registered office at Żółtki-Kolonia 38A (16-070 Choroszcz), NIP 542-326-10-87, REGON 365451702. The Administrator has not appointed a Data Protection Officer. For all matters concerning personal data processing, you can contact the Administrator by email at office@wingsbrand.com or in writing at its registered office address.

Data security

The Administrator applies appropriate technical and organizational measures to ensure the security of personal data, in particular access and authorization control, communication protection, administrative account security, backups, and procedures for handling personal data breaches. The scope of applied measures is adjusted to the nature, scope, context, and purposes of processing and the risk of violation of the rights or freedoms of the data subjects.

Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases:

  • managing the customer account - art. 6 sec. 1 letter b GDPR, i.e. performance of the service contract for account management;
  • acceptance and fulfillment of orders, payment processing, delivery, and contact regarding the order - art. 6 sec. 1 letter b GDPR, i.e. performance of the sales contract or taking steps prior to its conclusion;
  • issuing and storing accounting documents and fulfilling tax and accounting obligations - art. 6 sec. 1 letter c GDPR, i.e. fulfilling legal obligations incumbent on the Administrator;
  • handling complaints, returns, contract withdrawals, and warranties - art. 6 sec. 1 letter b and letter c GDPR;
  • handling inquiries submitted via form, email, phone, or other contact channels - Article 6(1)(f) GDPR, i.e., a legitimate interest in conducting communication and providing responses, and when the contact concerns concluding or performing a contract - Article 6(1)(b) GDPR;
  • sending newsletters and marketing communications electronically - Article 6(1)(a) GDPR and consent required by Article 398 of the Electronic Communications Law;
  • marketing own products and services, including ad targeting - Article 6(1)(f) GDPR, and regarding cookies, pixels, and similar consent-requiring technologies - Article 6(1)(a) GDPR and Article 399 of the Electronic Communications Law;
  • analytics, statistics, and improving store performance - Article 6(1)(f) GDPR regarding technical data necessary for the security and operation of the store, and in the case of analytical cookies - Article 6(1)(a) GDPR and Article 399 of the Electronic Communications Law;
  • sending invitations to leave reviews and publishing reviews about purchases or products - Article 6(1)(f) GDPR, i.e., a legitimate interest in collecting reliable reviews and improving the offer; if the message content constitutes commercial information or direct marketing, sending it also requires prior consent under Article 398 of the Electronic Communications Law;
  • establishing, pursuing, or defending claims - Article 6(1)(f) GDPR;
  • ensuring website security, detecting abuse, and maintaining technical logs - Article 6(1)(f) GDPR.
  • handling product recommendations, chatbot, and AI assistant, including providing answers, helping with product selection, and personalizing the shopping experience - Article 6(1)(b) GDPR when the tool is used to take actions before concluding or performing a contract, and Article 6(1)(f) GDPR, i.e., a legitimate interest in facilitating customer service; if the tool’s operation relies on cookies other than necessary ones, Article 6(1)(a) GDPR and Article 399 of the Electronic Communications Law also apply;
  • maintaining a blocklist after consent withdrawal or objection, including the minimum data necessary to exclude further sending - Article 6(1)(c) GDPR in connection with Article 21(3) GDPR and Article 6(1)(f) GDPR, i.e., a legitimate interest in ensuring accountability and preventing accidental sending.

Scope of processed data

The scope of processed data depends on how the store is used. We may process in particular: first and last name, contact and address details, invoicing data, account information, order, payment, and delivery details, purchase, complaint, and return history, correspondence content, review content and rating, information about consents and objections, marketing segment membership, granted discounts and coupons, and technical data including IP address, cookie identifiers, device data, browser, visit source, and website activity. In the case of a chatbot or AI assistant, we may process the content of the entered question, selected answers, product preferences, and session technical data. The user should not provide special category data or third-party data in these tools. Date of birth may be processed only if the user provides it voluntarily, e.g., to participate in a birthday promotion.

Voluntariness of data provision

Providing data required to place and fulfill an order, manage an account, payment, delivery, handle complaints, or issue an invoice is necessary to conclude or perform a contract or fulfill a legal obligation. Failure to provide this data may prevent the service from being performed.

Providing data for marketing purposes, newsletter, reviews, chatbot, or AI assistant is voluntary. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Profiling and automated processing

We may analyze how the store is used, purchase history, website activity, responses to marketing communication, and shopping preferences. The marketing automation tool can assign the user to a specific segment based on this. The segmentation result may affect the order and selection of recommended products, content, ads, offers, discounts, and coupons, and in configured campaigns also the way the price or product availability is presented. As a result, different users may receive or see different offers. The user can object at any time to profiling based on legitimate interest and withdraw consent to marketing, analytical, and personalization cookies. The administrator does not use profiling to make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user, unless the conditions of Article 22(2) GDPR are met and the required safeguards are provided, including the possibility of human intervention, presenting one’s own position, and challenging the decision.

Data retention periods

Order data is stored for the duration of the contract execution and then for the period necessary to settle the transaction, fulfill legal obligations, and until the expiration of applicable limitation periods for claims. Accounting and tax documents are generally stored for 5 years, counted according to tax and accounting regulations. Customer account data is stored until deletion or closure; order data is kept separately for the period indicated above. Inactive accounts should be periodically reviewed and deleted if there is no further basis for their retention. Data related to complaints, returns, withdrawals, and warranties is stored for the duration of the case handling and then until the expiration of the applicable limitation period for claims. Newsletter and marketing data is stored until consent is withdrawn or an objection is raised. After opting out, we may keep the email address and opt-out status on the blocklist for the duration of the marketing communication or for the period necessary to demonstrate respect for the objection and prevent accidental sending. Proofs of granting and withdrawing consent are stored for the period necessary to demonstrate legal compliance and defend against claims. Review data is stored until it is deleted or the publication purpose is lost, taking into account the period necessary to defend claims. Security logs and technical data are stored for the period resulting from the configuration of the given system and no longer than necessary to ensure security, detect abuse, and resolve technical issues; in case of an incident, the relevant part of the logs may be stored longer until the conclusion of proceedings or expiration of claim periods. The duration of individual cookies is indicated in the current cookie list available from the preferences panel.

Review Invitations

After purchase, we may provide TrustMate with the data necessary to send an invitation and verify the purchase, in particular the name, email address, order number, and information about the purchased product. The brand-related invitation is sent after about 3 days, and the product-related invitation after about 5-7 days. If the customer does not leave a review, a maximum of two reminders may be sent. Each message should contain clear information about the right to object and a simple way to opt out of further invitations. After an objection is raised, no further invitations or reminders are sent, and a minimal set of data may remain on the blocklist. Implementing Judge.me in foreign markets requires prior updating of this policy, the list of recipients, information about transfers, and consent settings.

Data recipients, processors, and transfers

Data recipients may include, depending on the function used: Shopify; Semrubicon; CPTI; ExpertSender; Sellasist; Subsync; cyber_Folks; InsERT; TrustMate; Wygodne Zwroty; payment service providers, banks, courier and postal companies; Google, Meta, TikTok, and WP/Onet for analytical and advertising tools; ECDP and Selecty for segmentation, personalization, or recommendations; Responso for chatbot services; as well as providers of legal, accounting, and security services and entities entitled to receive data under the law. Judge.me will become a data recipient only after this tool is activated and the documentation is updated accordingly.

The recipient's role depends on the scope of the specific service. If the entity processes data solely on behalf of and under the instructions of the Controller, processing is based on a contract or other binding terms in accordance with Article 28 of the GDPR. Payment operators, banks, carriers, advertising platforms, or other providers may, to a certain extent, act as separate controllers or joint controllers; in such cases, a data processing agreement is not the appropriate instrument.

Data may be processed outside the European Economic Area even when advertising campaigns are targeted exclusively at the European market, if the provider, its affiliated entity, support staff, or subcontractor processes data in a third country. This particularly applies to certain services from Shopify, Google, Meta, TikTok, Judge.me, or their subcontractors. The transfer is based on the appropriate mechanism from Chapter V of the GDPR, such as a decision confirming an adequate level of protection, the EU-US Data Privacy Framework for certified recipients, binding corporate rules, or standard contractual clauses, and if necessary, after applying additional safeguards. Transferring data to a courier company is not in itself a transfer outside the EEA; such a transfer may occur when shipping to a third country or when the carrier uses infrastructure or subcontractors outside the EEA.

Recommendations, Chatbot, and AI Assistant

The store may operate product recommendations, a chatbot, and an AI assistant to help select products. These tools may analyze information about viewed products, purchase history, selected preferences, question content, and technical session data. Automatically generated responses are auxiliary and do not constitute binding decisions or guarantees regarding product features. If the tool requires cookies other than essential ones, it is activated only after obtaining proper consent.

The provider and configuration of each AI tool should be included in the supplier register, risk assessment, data processing agreement, or other appropriate instrument, as well as in the current cookie list. Before publishing the policy, the administrator should confirm whether conversation content is stored, for how long, in what location, and whether the provider uses it to improve or train models.

Rights of Data Subjects

The data subject has the right to access their data and receive a copy, rectify, delete, restrict processing, transfer data, object to processing based on legitimate interest, including direct marketing and profiling, and the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. In cases covered by Article 22 of the GDPR, the person also has rights related to automated decision-making. The person may file a complaint with the President of the Personal Data Protection Office.

Exercise of Rights and Contact

Requests regarding personal data can be sent to the email address: office@wingsbrand.com or in writing to: WINGS sp. z o.o., Żółtki-Kolonia 38A, 16-070 Choroszcz. The administrator may request additional information only if it is necessary to confirm the identity of the person making the request.

Children's Data

The online store is not intended for children as independent buyers. If the store user is a minor, they should use the store with the consent and supervision of a legal guardian. The administrator does not knowingly direct behavioral marketing or profiling to children.

Updates and external links

The policy may be updated due to changes in law, providers, technology, store functionality, or data processing methods. The current version should be available in one permanently indicated place on the WINGS24 site. Links to external services lead to independently operated sites; however, if a third-party tool is embedded in the store, its operation should be described in this policy and in the Cookie Policy.

PART II. COOKIE POLICY

Consent management

On the first visit, we display a cookie banner. On its first layer, the user should have equal and equally accessible options: "Accept all," "Reject all," and "Manage preferences." In the preferences panel, all categories other than necessary are turned off by default. Analytical, marketing, and personalization cookies and similar technologies are activated only after the user's choice. The user can change or withdraw consent at any time via the permanently available "Cookie preferences" link.

What are cookies and similar technologies

Cookies are small text files or similar identifiers stored on the user's device. They may contain, among others, browser ID, session information, preferences, source of entry, and activity on the site. Besides cookies, we may use Local Storage, Session Storage, marketing pixels, analytical tags, advertising identifiers, and measurement scripts. This information may constitute personal data, especially when combined with other identifiers or user information.

Categories of cookies

  • necessary cookies - used for the operation of the store, cart, login, security, remembering privacy settings, and order fulfillment; do not require consent;
  • personalization and functional cookies - enable remembering preferences, support additional functions, recommendations, chatbot, or assistant; used with consent if not essential for the service requested by the user;
  • analytical cookies - used to measure traffic and how the store is used; used with consent;
  • marketing cookies - used to measure campaigns, create audience groups, remarketing, and personalize ads; used with consent.

Tools used on the site

The site uses or is technically integrated with, in particular: Shopify and Google Tag Manager; Google Analytics and Google Ads; Meta Pixel; TikTok Pixel; WP Pixel and Onet Pixel; TrustMate; ECDP and Selecty; Responso; Zakeke; as well as ExpertSender or Shopify tools related to the newsletter form and communication automation. Each tool should be assigned to the correct category in the panel, and analytical, marketing, and personalization tools must not initiate measurement or store or read identifiers before obtaining consent.

Cookie duration

Session cookies are deleted after the browser session ends, while persistent cookies remain active until the set period expires or they are deleted earlier. The provided 7-day period applies only to the cookie related to displaying or managing the newsletter and does not define the retention of other cookies. The exact, current list should indicate at least the cookie or technology name, provider, purpose, category, and maximum duration. The list should be directly accessible from the preferences panel and updated after any configuration or provider change.

Changing or withdrawing consent

Users can change their choices, reject cookies, or withdraw previously given consent at any time by using the "Cookie Preferences" link available in the footer. Withdrawing consent should be as easy as giving it. Browser settings can also be used to delete or block cookies but do not replace the consent mechanism available on the site.

Third-party cookies and transfers

Due to the use of tools from Shopify, Google, Meta, TikTok, and other providers, data from cookies or similar technologies may be processed outside the European Economic Area. The transfer mechanism indicated in Part I of this policy applies. The mere fact of targeting campaigns to European recipients does not exclude data transfer to a third country.

Final provisions

The cookie policy should be read together with the Privacy Policy. The current version of both documents should be accessible from the banner and the store footer. If a new tool, pixel, integration, or provider is implemented, the Administrator should update the cookie list, assess the legal basis and transfers, and verify that the tool remains blocked until the required consent is obtained before activation.