GDPR Privacy Notice
1. Controller and contact details
The controller of your personal data is ETNIKA Sp. z o.o., with its registered office at ul. Złota 59, 00-120 Warsaw, Poland, Tax Identification Number (NIP) 7011114082 (“ETNIKA”, the “Controller”).
For matters concerning data processing or the exercise of your rights, you may contact us by post at the above address or through the contact details or form available on ETNIKA's website. If the Controller has appointed a Data Protection Officer, the Officer's current contact details are provided on the website.
2. Categories and sources of data
We process data provided when you enrol in the Loyalty Programme and data generated when you use it, including identification and contact details, a membership or account identifier, login data, transaction and product purchase history, points, discounts, rewards and vouchers, enquiries and complaints, communication preferences, and technical data and event logs required to secure the account.
We obtain data directly from you, from devices and systems used to operate the Programme, and from transactions assigned to your membership account. We do not request special categories of personal data referred to in Article 9 GDPR.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Creating and operating the account, awarding points, discounts and rewards, operational communications and complaints | Article 6(1)(b) GDPR — entering into and performing the participation agreement | during participation and thereafter for settling benefits, complaints and claims |
| Tax, accounting and other legal obligations | Article 6(1)(c) GDPR | for the period required by applicable law |
| Account and system security, fraud prevention, statistics and claims | Article 6(1)(f) GDPR — the Controller's legitimate interests | until the purpose ends, an effective objection is made, or the applicable limitation period expires |
| Electronic or telephone marketing and commercial communications — only after separate consent | Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law | until withdrawal; a minimum record is retained for accountability and defence of claims |
| Personalising offers and benefits from activity history — after separate consent | Article 6(1)(a) GDPR | until consent is withdrawn or participation ends |
4. Recipients
Data may be accessed by authorised ETNIKA employees and contractors and by providers whose services are necessary to operate the Programme, including loyalty platform, hosting and IT infrastructure providers, maintenance and support providers, email and SMS providers, analytics and customer-service providers, accountants, payment providers, legal advisers and auditors — only to the extent necessary and under an appropriate agreement or legal basis. Data may also be disclosed to public authorities where required by law. We do not disclose data to partners for their own marketing without separate, freely given consent or another appropriate legal basis.
5. Transfers outside the EEA
If a provider used to operate the Programme processes data outside the European Economic Area, the transfer takes place only under a mechanism provided for in Chapter V GDPR, in particular a European Commission adequacy decision or Standard Contractual Clauses together with the required safeguards. Information about the safeguards may be obtained by contacting the Controller.
6. Profiling and automated decisions
Points, discounts, vouchers or rewards may be calculated or granted automatically under the Programme Rules. These operations are required to perform the Programme and do not constitute decisions producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR.
If you give separate consent to personalisation, we may analyse purchase history, use of points and stated preferences to assign the account to an interest segment and select offer content. This may result in more tailored communications or benefits; refusing consent does not prevent participation. Consent may be withdrawn at any time.
7. Your rights
You have the right to request access to and a copy of your data, rectification, erasure or restriction of processing and, where the conditions are met, data portability. You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR and may object to direct marketing at any time without giving reasons.
Where processing is based on consent, you may withdraw it at any time as easily as it was given. Withdrawal does not affect the lawfulness of prior processing. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl).
8. Voluntary provision of data
Providing data marked as required is voluntary but necessary to enter into and perform the agreement for participation in the Loyalty Programme. Without it, a membership account cannot be created or operated. Marketing and personalisation consents are entirely optional and are not a condition of participation.
9. Security and updates
The Controller applies technical and organisational measures appropriate to the risk, including access control, account protection, event logging and permission-management rules. This notice may be updated if the Programme, providers or applicable law changes. Legal status and version date: 1 September 2026.