1. Who the controller is
- The controller of personal data is Kamai.pl Sp. z o.o., with its registered office in Wola Batorska, Wola Batorska 1018, 32-007 Zabierzów Bocheński, Poland, KRS 0000361320, NIP (tax ID) 6832056712, REGON 121297532 (hereinafter: “we”, the “Controller”). We run the Dropcom.eu dropshipping wholesaler.
- For matters concerning personal data, contact us:
- by email: biuro@dropcom.eu (subject line “Personal data”),
- by post: Kamai.pl Sp. z o.o., Wola Batorska 1018, 32-007 Zabierzów Bocheński, Poland,
- by phone: +48 12 307 28 21 (on working days, 8:00–16:00 CET).
- We have not appointed a data protection officer. [TO BE CONFIRMED]
2. What this policy covers
- This policy describes the processing of personal data of:
- visitors to https://dropcom.eu, including those using the contact forms and the AI assistant,
- users of the B2B panel at https://b2b.dropcom.eu: partners who are natural persons, persons representing partners and their employees,
- persons who contact us by email or phone about cooperation, including representatives of manufacturers and suppliers.
- This policy does not cover the data of our partners’ end customers (recipients of dropshipping parcels). We process that data as a processor on behalf of the partner, who is its controller, under a data processing agreement. If you are the recipient of a parcel and have a question about your data, contact the shop where you bought the goods. If your enquiry reaches us, we will also pass it on to that shop.
3. Where we get data from
- You give us most of the data yourself: in a form, in a conversation with the AI assistant, in the B2B panel registration form, in an order, an email or a phone call.
- A partner may give us the data of persons representing it or of its employees (e.g. persons authorised to place orders).
- At registration, we obtain company data from public registers: CEIDG, KRS, the REGON register (Statistics Poland), the VAT taxpayer register (the “white list”) and, for companies from other EU countries, the VIES system. This data may include the name of the business owner or of members of the management board.
- Some technical data is recorded automatically by the server and the browser (sections 9 and 10).
4. Purposes, legal bases and retention periods
The legal bases are the provisions of Article 6(1) of Regulation (EU) 2016/679 (GDPR): point (a) (consent), point (b) (contract or steps prior to entering into it), point (c) (legal obligation), point (f) (the controller’s legitimate interest).
| Purpose | What data | Legal basis | How long |
|---|---|---|---|
| Responding to an enquiry from a form, email or phone call | email, name, company, phone, country, city, content of the enquiry and form answers, page from which the form was sent | Art. 6(1)(b) GDPR (when you ask about cooperation in your own name) or point (f) (our interest: handling enquiries and B2B contact with a person representing a company) | up to 3 years from the last contact, unless we conclude a contract |
| Proof of consent given in a form | text and version of the consent, date, full IP address, browser | Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, and point (f) (demonstrating compliance) | as long as the enquiry data and, in the event of a dispute, until it ends |
| AI assistant: answering your question | content of questions and answers, conversation ID, page address, shortened IP address, browser and operating system | Art. 6(1)(f) GDPR (our interest: providing information about cooperation at your request, improving the quality of answers) | 12 months from the conversation [TO BE CONFIRMED] |
| Passing a conversation with the assistant to customer service | contact details you provide and the latest messages of the conversation | Art. 6(1)(b) or (f) GDPR, as for an enquiry | as for an enquiry |
| Registering and verifying a partner, maintaining an account in the B2B panel | company data, NIP, address, details of authorised persons (name, email, phone), login, delivery addresses, data from public registers | Art. 6(1)(b) GDPR (a partner who is a natural person) or point (f) (our interest: working with a company, verifying a business partner, contacting its representatives) | for as long as the account exists, then until claims become time-barred |
| Orders, payments, deliveries, returns and complaints | order data, invoice data, order and payment history, correspondence | Art. 6(1)(b) GDPR or point (f) (as above), point (c) (obligations under civil and tax law) | until claims become time-barred (as a rule, 3 years for claims related to business activity) |
| Accounting and taxes, including invoices in KSeF | data from invoices and accounting records | Art. 6(1)(c) GDPR (Polish Accounting Act, VAT Act, Tax Ordinance) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Trade credit and deferred payment terms | history of cooperation and payments, company data | Art. 6(1)(f) GDPR (our interest: assessing commercial risk) | for the duration of the cooperation and until claims become time-barred |
| Commercial information about our offer for partners and companies we have been in contact with | email, phone, name, company | Art. 6(1)(f) GDPR (direct marketing of our own services); sending by email or contacting by phone only with your consent required by Art. 398 of the Polish Electronic Communications Law | until you object or withdraw your consent |
| Establishing, pursuing and defending claims | data needed to prove the facts | Art. 6(1)(f) GDPR | until claims become time-barred and proceedings end |
| Website security and protection against abuse | IP address (in server logs; in the request limit as a cryptographic hash), browser, time of request; content of questions to the assistant checked for abuse | Art. 6(1)(f) GDPR (our interest: security of the services) | IP hash in the request limit: about 10 minutes; server logs: according to the hosting provider’s settings [TO BE CONFIRMED] |
5. AI assistant
- The dropcom.eu website has an AI assistant: a chat that answers questions about cooperation based on our knowledge base. The answers are generated by an artificial intelligence system, not a person. They may contain inaccuracies and are not an offer. Our terms and conditions and the information in the B2B panel are binding.
- When you send a question, we pass to OpenAI (section 6) the content of the question, up to the last 10 exchanges of the current conversation, the address of the page you are on and the topic selected in the conversation. The question first goes through automated moderation (detection of prohibited content) and then to the language model that prepares the answer.
- We send requests with a setting that disables storage of responses on OpenAI’s side for further conversations. Under the OpenAI API terms, OpenAI does not use this data to train models and may retain it for up to 30 days to detect abuse. [TO BE CONFIRMED: terms of the agreement with OpenAI]
- We store conversations on our server (section 4). We do not link them to an account in the B2B panel. We store the full IP address only if you consent to being contacted in the conversation or a form, as proof of that consent. Otherwise, we store a shortened IP address (without the last part), which does not identify a specific connection.
- Do not share special categories of data (e.g. about health), other people’s data, passwords or payment details in the conversation.
- The assistant does not make decisions about you that produce legal effects or similarly significantly affect you (Art. 22 GDPR). When you ask to be contacted, your enquiry goes to a member of customer service.
6. Who we share data with
- Data may be received by entities that provide services to us and process data on our instructions (processors), under data processing agreements:
- Hostinger (Hostinger International Ltd.): hosting of the dropcom.eu website, storage of form submissions and conversations with the assistant, sending email notifications from forms,
- OpenAI (OpenAI Ireland Ltd.): running the AI assistant and moderating the content of questions,
- the provider and maintainer of the ERP system and B2B platform on which the b2b.dropcom.eu panel runs [TO BE CONFIRMED: name of the provider and hosting location],
- the provider of the email service on which our mailboxes run [TO BE CONFIRMED],
- the provider of the CRM system in which we manage business contacts, if it is an external entity [TO BE CONFIRMED],
- providers of accounting, legal, IT and document shredding services, to the extent needed to provide the service.
- Data may also be received by separate controllers, to the extent needed to perform their tasks:
- courier and transport companies (e.g. DHL, DPD, InPost, GLS, Raben) for deliveries to a partner’s address and for carriage complaints,
- the banks where we hold accounts, for processing payments,
- public authorities, including the National Revenue Administration (among others through the National e-Invoicing System, KSeF), where required by law,
- Google (YouTube), when you click the play button of a video on our website (section 10(4)).
- We do not sell personal data or share it with other companies for marketing purposes.
7. Transfers of data outside the European Economic Area
- OpenAI may process data in the United States. The transfer is based on standard contractual clauses approved by the European Commission or on the Commission’s adequacy decision (EU-US Data Privacy Framework), if the recipient is covered by it. [TO BE CONFIRMED]
- Google (YouTube) may process data in the United States on the basis of the EU-US Data Privacy Framework.
- The website’s hosting servers are located in the European Economic Area. [TO BE CONFIRMED: data centre location]
- You can obtain a copy of the safeguards used for transfers outside the EEA by writing to the address in section 1.
8. Your rights
- You have the right to:
- access your data and receive a copy of it (Art. 15 GDPR),
- rectify your data (Art. 16 GDPR),
- erase your data (Art. 17 GDPR), where we are not required to keep it, e.g. under tax law,
- restrict processing (Art. 18 GDPR),
- data portability for data processed by automated means on the basis of consent or a contract (Art. 20 GDPR),
- object to processing based on our legitimate interest (Art. 21 GDPR); we always respect an objection to direct marketing,
- withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
- To exercise your rights, write to the address in section 1. We reply without undue delay and no later than within one month. We may ask for information needed to confirm your identity.
9. Do you have to provide data
- Providing data is voluntary.
- Without an email address you cannot send the contact form, and without the data required at registration you cannot create an account in the B2B panel.
- Without order and invoice data we cannot fulfil an order.
- You can use the AI assistant without providing contact details.
10. Cookies and browser storage
- The dropcom.eu website does not use analytics or advertising cookies and does not use tracking tools (e.g. Google Analytics, Meta Pixel). Fonts are loaded from our own server, and the map is a plain link to Google Maps.
- The website stores only the following information in browser storage (sessionStorage and localStorage). The conversation ID and entry parameters are stored only when you send a form or use the assistant; simply browsing the website stores nothing. These are not cookies and are not sent to us automatically. Values in sessionStorage disappear when you close the tab.
| Name | Where | Purpose | How long |
|---|---|---|---|
dropcom.cv | sessionStorage | random conversation ID that links questions to the AI assistant and a form within one visit | until the tab is closed |
dropcom.entry | sessionStorage | entry address parameters (utm) and the address of the page you came from; we attach them to your enquiry if you send a form | until the tab is closed |
dropcom-debug | sessionStorage | diagnostic mode for our team, enabled only by a special address | until the tab is closed |
dropcom-ph | localStorage | test-version tool of the website (showing image markers); not present in the production version | until deleted in the browser |
- The history of a conversation with the assistant is kept only in the memory of the open page and disappears when the page is reloaded or closed. A copy of the conversation is stored on our server (section 5).
- YouTube videos on the website load only after you click the play button, in privacy-enhanced mode (youtube-nocookie.com). From that moment, Google may store its own data in your browser and receives your IP address. Google’s policy: https://policies.google.com/privacy.
- The B2B panel (b2b.dropcom.eu) uses cookies that are necessary for logging in and for the cart to work. [TO BE CONFIRMED: list of panel cookies]
- You can delete stored browser data at any time in your browser settings. The website also works when the browser blocks such storage, but without it the B2B panel will not let you log in.
- The website server records technical data about each request in its logs: IP address, date and time, page address, browser. This data is used for security and troubleshooting.
11. Data security
- We use technical and organisational measures appropriate to the risk, in particular encrypted connections (HTTPS), access to data only for authorised persons, storage of form submissions and conversations in a directory that is not accessible from the internet, shortening IP addresses where the full address is not needed, and request limits that protect against abuse.
- We never ask for your B2B panel password by email or phone. We give the bank account number for payment on the pro forma invoice.
12. Changes to this policy
- We may change this policy when the law, our services or the way we process data change. The new version applies from its publication on the website, and we inform partners of material changes by email or in the B2B panel.
- The current version is always available at https://dropcom.eu/pl/polityka-prywatnosci/ (English translation: https://dropcom.eu/en/privacy-policy/). The version number and date are given at the top of the document. This English version is a translation for information only; in the event of any discrepancy, the Polish version prevails.
Questions about personal data: biuro@dropcom.eu, +48 12 307 28 21.