Privacy policy

1. Controller of personal data

The controller of your personal data is Global Trade Group sp. z o.o., with its registered office at Al. Jerozolimskie 133/2, 02-304 Warszawa, Poland, VAT: PL5342677352, KRS: 0001096244, REGON: 528171483 (referred to below as “ZOI Matcha” or the “Controller”). For matters relating to the protection of personal data, you can contact us: • Email: info@zoimatcha.com • Phone: +48 516 126 213 • Postal address: Al. Jerozolimskie 133/2, 02-304 Warszawa

2. What data we collect

Depending on how you use our website, we may collect the following categories of data:

• Identification data: first name, surname
• Contact data: email address, phone number, postal address
• Address data: delivery address and billing address
• Transaction data: order history, payment information
• Technical data: IP address, browser type, operating system, cookies
• Activity data: browsing history, product preferences, wishlist
• Communication data: the content of messages, enquiries and reviews
• Order notes: what you type in the “Order notes” field (e.g. instructions for the courier) — please do not include health information or other people’s data in it
• Basket contents when not signed in: the products and quantities saved under a random browser identifier; we attach your email address and first name to it only when you enter them in the order form
• Company data from a wholesale enquiry: company name, VAT number, contact person, email, phone, city and the content of the message
• If you consent to analytics cookies, your basket and your visit in our statistics are given a shared random identifier — this lets us see at which point the purchase was abandoned. When you enter your email address in the order form, that visit is linked to you
• A recording of how the visit unfolds — only with your consent to analytics cookies: scrolling, clicks and the appearance of the page, without the content typed into form fields

3. Purposes of data processing

We process your personal data for the following purposes:

• Fulfilling orders and sales contracts (Article 6(1)(b) GDPR)
• Maintaining the customer account and managing the profile (Article 6(1)(b) GDPR)
• Communication about orders, complaints and enquiries (Article 6(1)(b) or (f) GDPR)
• Sending the newsletter and marketing communications — with your consent, given when you sign up on the website or by ticking a box in the order form for an order paid online (the latter takes effect once the order has been paid); we record when and where it was given (Article 6(1)(a) GDPR)
• Statistical analysis and improving the quality of services (Article 6(1)(f) GDPR)
• Measuring the effectiveness of ads on Meta’s services (Facebook, Instagram) and targeting them at people who have visited the shop — the Meta pixel, only with your consent to marketing cookies (Article 6(1)(a) GDPR). We are jointly responsible with Meta Platforms Ireland Ltd. for collecting this data on our website and transmitting it to Meta; further processing is Meta’s responsibility and is described in Meta’s privacy policy
• Recording how visits unfold in order to find where the shop lets people down — with your consent (Article 6(1)(a) GDPR)
• Sending a link to the basket and a single reminder — at your request, made by ticking a box in the order form (Article 6(1)(a) GDPR)
• A one-off notification that a sold-out product is back in stock — at your request, confirmed through the link in the email: first a message containing that link, then a single message when the product is back (Article 6(1)(a) GDPR)
• A one-off notification of a product launch, which you request in the “Launch” section of the homepage and confirm through the link in the email — first a message containing that link, then a single message when the product appears in the shop (Article 6(1)(a) GDPR)
• Publishing product reviews: we show the first name, the rating and the text; we do not publish the email address — it is used to get in touch about the review and, together with the order number, to confirm the purchase (Article 6(1)(f) GDPR)
• A reminder about an unfinished order, sent to the address given in the order form: three messages at most; one click in any of them ends all reminders about the basket (Article 6(1)(f) GDPR)
• Linking the basket to the visit in the statistics — with your consent to analytics cookies (Article 6(1)(a) GDPR)
• Responding to a wholesale partnership enquiry sent from the form on the /en/wholesale page (Article 6(1)(b) and (f) GDPR)
• Complying with legal obligations, e.g. accounting and tax (Article 6(1)(c) GDPR)
• Pursuing or defending claims (Article 6(1)(f) GDPR)

4. Data retention period

We keep your data for as long as necessary to achieve the purposes for which it was collected: • Order-related data: for the duration of the contract + 5 years (tax and accounting obligations) • Order notes: in our shop, 90 days from when the order is placed; the copy passed to the order management system (BaseLinker) stays there with the order, as above • Customer account data: until the account is deleted • Marketing data: until consent is withdrawn • Data from cookies: in line with the cookie settings (12 months at most) • Complaint data: 1 year after the complaint procedure ends • Recordings of how visits unfold: 30 days • Address given for sending the basket link: 30 days; if you unsubscribe, we delete it straight away — only a hash of the address remains (a pseudonym: we do not keep the address itself, but from the hash we can recognise it if it is given again), so that we do not write to you again (12 months) • Address given for a product availability notification: without confirmation through the link in the email — 7 days; after confirmation — until the notification is sent, 180 days at most. After it is sent, we keep a hash of the address (a pseudonym) with the date of the request for 12 months • Address given for a launch notification: without confirmation through the link in the email — 7 days; after confirmation — until the notification is sent, 180 days at most. After it is sent, we keep a hash of the address (a pseudonym) with the date of sign-up and of confirmation for 12 months, as proof that the message was requested • Email address of a review’s author: 90 days from when the review is added; the review and the first name it is signed with remain, and so does a hash of the address (a pseudonym), to enforce the “one review per person” rule • Basket when not signed in: we delete the email address and first name 90 days after they are entered; a basket without an address — 30 days after the last activity; a basket that became an order is kept for 12 months (after 90 days, without the contact details) • After you unsubscribe from basket reminders, only a hash of the address (a pseudonym) remains, so that we do not write to you again (12 months) • Wholesale partnership enquiry (company, contact person, email, phone, city, VAT number): 2 years from when it is sent

5. Sharing of data

Your personal data may be shared with the following categories of recipients:

• Courier and logistics companies (InPost, the intermediary Apaczka.pl and the carriers DPD, DHL, Poczta Polska, GLS, UPS, FedEx and ORLEN Paczka) — to carry out deliveries
• Payment provider (Stripe) — to process transactions
• Provider of the order and warehouse management system (BaseLinker) — to prepare and dispatch orders; the order data goes there, including order notes
• Provider of the email sending service (Resend) — to deliver order messages, notifications and reminders
• Meta Platforms Ireland Ltd. (Facebook, Instagram) — only with your consent to marketing cookies: information about the pages visited, products viewed, adding to the basket and purchases, to measure the effectiveness of ads and to target them
• IT and hosting service providers — to maintain the website’s infrastructure
• Accounting firm — to keep the accounts
• Public authorities — where required by law

We do not sell your personal data. Some of our providers (Resend, Stripe, Google, Meta) are based in the United States or transfer data there; where data is therefore transferred outside the European Economic Area (EEA), this is done on the basis of a European Commission decision finding an adequate level of protection (the EU–US Data Privacy Framework) or of standard contractual clauses.

6. Your rights

Under the GDPR, you have the following rights:

• Right of access to data — you can obtain information about the data being processed
• Right to rectification — you can ask for inaccurate data to be corrected
• Right to erasure — the “right to be forgotten” in certain cases
• Right to restriction of processing — you can demand that processing be suspended
• Right to data portability — you can receive your data in a machine-readable format
• Right to object — to processing based on legitimate interest
• Right to withdraw consent — at any time, without affecting earlier processing
• Right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO)

To exercise your rights, contact us by email: info@zoimatcha.com

7. Cookies

Our website uses cookies to ensure it works properly, to analyse traffic and to personalise content. Types of cookies we use: • Necessary — required for the website to work (basket, sign-in session) • Analytics — they help us understand how users use the website: our own Umami statistics on our server and — only with your consent — a recording of how the visit unfolds (scrolling and clicks; what you type into form fields is masked, and we delete recordings after 30 days) • Marketing — only with your consent: the Meta pixel (Facebook, Instagram), loaded through Google Tag Manager. It measures the effectiveness of our ads (pages visited, products viewed, adding to the basket, purchase) and makes it possible to target ads at people who have visited the shop. Without this consent, neither Google Tag Manager nor the Meta pixel is loaded • Functional — they remember your preferences (language, currency) You can change or withdraw your consent at any time in “Cookie settings” (the link at the bottom of every page), and in your browser settings. Disabling necessary cookies may affect how the website works.

8. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction: • SSL/TLS encryption of all connections • PCI DSS compliance for payment data • Regular security audits • Role-based access control • Data backups • Data protection training for staff

9. Changes to the privacy policy

We reserve the right to update this privacy policy. We will inform you of significant changes by email or by a notice on the website. We recommend that you read the current version of this document regularly.

10. Contact

If you have any questions about the protection of personal data, please contact us: Global Trade Group sp. z o.o. Registered office address: Al. Jerozolimskie 133/2, 02-304 Warszawa, Poland Postal address: Al. Jerozolimskie 133/2, 02-304 Warszawa VAT: PL5342677352 | KRS: 0001096244 | REGON: 528171483 Email: info@zoimatcha.com Tel: +48 516 126 213