Privacy and cookies policy

Courtesy translation. In case of discrepancies the Polish version prevails.

Seller / controller	HELK DESIGN spółka z ograniczoną odpowiedzialnością
Address	ul. Wybranieckich 10, 26-008 Leszczyny, Poland
KRS	0001190595
NIP	6573000791
REGON	542563870
Share capital	PLN 120,000.00
Contact	[email protected]

1. Data controller

The controller of personal data is HELK DESIGN spółka z ograniczoną odpowiedzialnością, ul. Wybranieckich 10, 26-008 Leszczyny, Poland, KRS 0001190595, NIP 6573000791, REGON 542563870. Contact for privacy matters: [email protected].

If HELK DESIGN appoints a data protection officer, their contact details will be published here. As of this version of the Policy no separate data protection officer has been appointed.

2. What data we may process

identification and contact data, e.g. first name, last name, company name, address, e-mail, phone;
data needed to issue sales documents, including the tax ID (NIP) and company details;
order, Product configuration, vehicle and correspondence data related to fulfilment, a complaint or a Custom project;
Customer account data, if the account function is available;
technical data related to the use of the website, e.g. IP address, device identifiers and cookies, session and log data;
marketing and analytics data – only to the extent resulting from the consents given and the tools used.

3. Purposes and legal bases of processing

Purpose	Example data	Basis	Period
Order and contract handling	contact details, delivery, configuration, payment	Art. 6(1)(b) GDPR	for the duration of fulfilment, then for the period required for settlements and the defence of claims
Contact before the contract is concluded	form data, e-mail, phone	Art. 6(1)(b) or (f) GDPR	until the matter is closed, then until claims become time-barred
Accounting and legal obligations	transaction and accounting document data	Art. 6(1)(c) GDPR	for the period required by tax and accounting law
Complaints and claims	order, correspondence, photos, evidence	Art. 6(1)(b), (c) or (f) GDPR	until the matter is closed and the limitation periods expire
Website security and abuse prevention	IP, logs, session data	Art. 6(1)(f) GDPR	for a period adequate to security and the pursuit of claims
Customer account	profile data and account history	Art. 6(1)(b) GDPR	until the account is deleted, subject to data kept on other bases
Newsletter / e-mail or SMS marketing	e-mail, phone, consent information	Art. 6(1)(a) or (f) GDPR and channel consent under the Polish Electronic Communications Law (PKE)	until consent is withdrawn, an objection is raised or the purpose ends
Cookie-based analytics and advertising	identifiers, behaviour and device data	Art. 6(1)(a) GDPR in conjunction with Art. 399 PKE	according to the tool settings and until consent is withdrawn

4. Recipients of data

Data may be shared, only to the extent needed for a given purpose, with the following categories of recipients:

providers of hosting, IT infrastructure, the store platform and technical support;
payment operators, banks and settlement providers;
courier, forwarding and logistics companies;
the accounting office, tax advisers, lawyers, insurers and claims handlers;
providers of e-mail, CRM, helpdesk, newsletter and communication systems;
analytics, advertising and social media providers – only to the extent consistent with the consent settings;
public authorities, where sharing the data results from a legal obligation.

5. Transfers outside the EEA

Some IT, analytics, advertising or communication tools may involve processing data outside the European Economic Area. Where such a transfer occurs, HELK DESIGN uses mechanisms permitted by the GDPR, in particular an adequacy decision, standard contractual clauses or other appropriate safeguards.

6. Rights of data subjects

the right of access to data and to obtain a copy;
the right to rectification;
the right to erasure – where the conditions are met and there is no basis for further storage;
the right to restriction of processing;
the right to data portability in the cases provided for by the GDPR;
the right to object to processing based on legitimate interest, including direct marketing;
the right to withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it;
the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Requests regarding these rights can be sent to [email protected].

7. Obligation to provide data

Providing the data required to place and fulfil an order is voluntary but necessary to conclude and perform the contract. Data marked as optional is not a condition of purchase. Marketing and analytics consents are voluntary.

8. Profiling and automated decisions

If the Customer consents to the relevant cookies, activity data may be used to build audiences, measure campaign effectiveness or personalise ads. HELK DESIGN does not make decisions about the Customer with legal effects solely by automated means.

9. Cookies and similar technologies

The Store uses cookies or similar technologies to keep the website working, remember preferences and handle the cart and the session.
Cookies necessary to deliver a service requested by the user may be used without consent to the extent provided by law. Analytics, advertising or other non-essential cookies are activated only after the required consent has been obtained.
As of publication the Store uses only the necessary cookies listed in section 11. Analytics and marketing cookies are not currently used, but the Store provides a banner and a „Cookie settings” panel where you can give or refuse consent for individual categories in advance. Consent is voluntary and withdrawing it is as easy as giving it — just open the panel again. Until consent is given, no analytics or marketing scripts run. Your choice is stored in the helk_consent cookie (valid 12 months), which itself belongs to the necessary category.
Rejecting non-essential cookies does not block the basic ability to make a purchase.

10. Cookie categories

Category	Purpose	Consent	Used in the Store
Necessary	cart, checkout, security, session	not required	Yes
Functional	remembering optional preferences	depending on the function and basis	No
Analytics	measuring traffic and user behaviour	yes	No
Marketing	ads, remarketing, campaign attribution	yes	No

11. List of specific cookies

The table below reflects the Store configuration as of 16 September 2026. The Store does not currently use analytics or advertising tools or social media pixels, so no analytics or marketing cookies are set. The list should be verified at every technological change.

Name	Provider	Purpose	Period	Category
wp_woocommerce_session_*	WooCommerce (first party)	Links the user with their cart and shopping session data	2 days	Necessary
woocommerce_cart_hash, woocommerce_items_in_cart	WooCommerce (first party)	Information about the cart contents and that the cart is not empty	Session	Necessary
wordpress_logged_in_, wordpress_sec_, wp-settings-*	WordPress (first party)	Keeps the logged-in user’s session and dashboard settings; applies only to accounts with back-end access	Session / up to 1 year	Necessary
helk_consent	HELK DESIGN (first party)	Remembers your choice of cookie categories	12 months	Necessary
__cf_bm, cf_clearance	Cloudflare, Inc.	Protection against bots and abuse, traffic verification, website security	30 minutes / up to 1 year	Necessary

12. Data security

HELK DESIGN applies technical and organisational measures appropriate to the nature of the data processed and the risk, in particular access control, system updates, secured transmission, backups and restricted access to data.

13. Changes to the Policy

The Policy may be updated, among other things, when the law, store tools, providers, processing purposes or cookie configuration change. The current version is published in the Store together with its effective date.

14. Legal bases

Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), in particular Articles 6 and 12–22.
The Polish Electronic Communications Law, in particular Articles 398–400.
The Polish Act on Providing Services by Electronic Means.
Tax, accounting and civil law provisions on the documentation of transactions and claims.