HT-DRON Privacy Policy

Effective from 11 October 2026

This is an English translation for information. The binding version is the Polish one: Polityka prywatności (PL)

§1. Data controller

1. The controller of personal data is H&T RETAIL GROUP spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Bytom, ul. Golfowa 38/2, 41-907 Bytom, Poland, KRS 0000821592 (District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register), NIP 6292495826, REGON 385201817 (the Controller), which runs the online shop www.ht-dron.pl and its versions uk.ht-dron.pl and en.ht-dron.pl.

2. Contact on personal data matters: e-mail sklep@ht-dron.pl (subject: "Personal data"), phone +48 666 132 049, correspondence address: ul. Francuska 106b/18, 40-507 Katowice, Poland. The Controller has not appointed a data protection officer, as it is not required to do so.

3. This Policy covers the data of Customers, Shop users, people who contact the Controller and representatives of B2B business partners. Capitalised terms have the meaning given to them in the Shop Terms and Conditions.

§2. Purposes, legal bases and retention periods

Providing data is voluntary but necessary to conclude the contract; for invoices and sanctions obligations it is required by law. The Controller does not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR).

§3. Recipients of data

We share data only to the extent necessary for the given purpose:

§4. Transfers of data outside the European Economic Area

1. Ukraine. For deliveries to Ukraine, the recipient's data (name, phone number, address or branch number, contents and value of the parcel) are passed to the carrier and to customs authorities in Ukraine. The European Commission has not issued an adequacy decision for Ukraine. The transfer is based on its necessity for the performance of a contract concluded at your request (Art. 49(1)(b) GDPR). Risk: data protection in Ukraine may differ from the EU standard.

2. USA. Google, Meta and Anthropic may process data in the USA. Transfers are based on the European Commission's decision on the EU–US Data Privacy Framework (for certified entities) or on standard contractual clauses (Art. 46(2)(c) GDPR). A copy of the safeguards can be obtained by writing to the address in §1.

3. Other countries: only where delivery to you requires it, on the same basis as in paragraph 1.

§5. Your rights

1. You have the right of access to your data and to receive a copy (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability of data processed on the basis of a contract or consent (Art. 20), and the right to object to processing based on legitimate interest, including for marketing purposes (Art. 21).

2. You can withdraw consent at any time (link in the newsletter, the "Cookie consents" button in the Shop, or by e-mail). Withdrawal does not affect the lawfulness of processing before it.

3. Requests can be sent to the address in §1. We reply within one month (in justified cases this may be extended by two months, and we will tell you). We may ask you to confirm your identity.

4. You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

§6. Cookies and similar technologies

1. The Shop uses cookies and similar technologies (local storage, pixels). We use essential cookies (basket, login, security, remembering your consent choices) without consent, because they are necessary to provide the service (Art. 399(3) of the Polish Electronic Communications Law).

2. We use analytics and advertising cookies only after you consent in the cookie banner. You can change your consents at any time via the "Cookie consents" link in the Shop header.

3. Types of cookies:

4. The Shop uses Google Consent Mode v2: without consent, Google tools do not store analytics or advertising cookies. You can also delete or block cookies in your browser settings; blocking essential cookies may make it impossible to place an Order.

§7. Marketing, reviews and AI tools

1. We send the newsletter and commercial information by electronic means only with your consent. You can unsubscribe in every message.

2. After a purchase, Ceneo may send one "Trusted Reviews" survey about the order service (legitimate interest: improving quality and reliable reviews). You can object or ignore the survey. A published review contains a first name or nickname, the rating and the text – without the surname or contact details.

3. We may use artificial intelligence tools to prepare replies to messages, product descriptions and sales analyses. These tools act as processors under data processing agreements and do not use your data to train their own models. If you are talking to an AI assistant (e.g. the Shop chat), you will be told so at the start of the conversation. Final decisions on complaints, returns and refusals to sell are made by a human.

§8. Security

1. We use connection encryption (SSL/TLS), access control with two-factor authentication, backups and the principle of least privilege – staff and tools see only the data needed for the task.

2. We do not store full payment card data – it is handled by the payment operator.

3. We never ask for passwords or card details by e-mail or SMS. Please report such messages to sklep@ht-dron.pl.

§9. Changes to the Policy

1. We update the Policy when laws, tools or data recipients change. We inform Customers with an account of significant changes by e-mail.

2. This Policy is effective from 11 October 2026. The previous version is available on request.