Privacy policy

1. What this policy covers

This policy explains how we process the personal data of people who visit the Tiendo website at tiendo.eu (the “Site”) and send the inquiry form. It provides the information required by Article 13 of Regulation (EU) 2016/679 (GDPR).

This policy does not cover online stores running on the Tiendo system or the data processed in those stores.

2. Data controller

The controller is NUBLADO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, entered in the Register of Entrepreneurs of the National Court Register under KRS 0001050386, NIP (tax ID) 9571161497, REGON 525989527 (“we”).

For anything related to personal data, write to us at kontakt@nublado.pl.

3. What data we process

When you send the inquiry form, we process the data you enter:

• your name, email address and company name,
• your phone number, if you provide it,
• the address of your current store or website, if you provide it,
• your industry and the approximate number of products,
• whether you already have an online store, the approximate number of orders per month, whether you sell to companies (B2B) and the budget range – if you select them,
• the content of your message,
• your confirmation that you have read this policy, whether you gave marketing consent, the language version of the Site and the date and time the inquiry was sent.

Together with the inquiry we store information about the visit, which helps us understand where inquiries come from and protect the form from abuse:

• the UTM parameters of the address through which the Site was entered (source, medium, campaign, term, content),
• the address of the referring page (referrer) from which the Site was entered,
• the address of the first page viewed during the visit,
• a SHA-256 hash of the IP address calculated with a secret salt – we do not store the IP address itself,
• the browser identifier (user agent), i.e. information about the type and version of the browser and operating system.

The IP address cannot be read from the hash, but the hash makes it possible to recognise further inquiries sent from the same address, so we treat it as personal data (pseudonymised data).

When you send the form we also use your IP address to limit the number of inquiries from one address (at most 5 per 15 minutes). For this limit the IP address is held only in server memory and is not stored in the database.

As with any website, the infrastructure the Site runs on processes technical connection data (such as the IP address, browser type and requested page) to deliver the content to you and to protect the Site from abuse.

4. Purposes and legal bases

• Replying to your inquiry and further contact about it, including preparing a quote or a presentation of the system. Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) or, when you write on behalf of a company, our legitimate interest in contacting a person who represents a prospective client (Article 6(1)(f) GDPR).
• Measuring the effectiveness of our promotion: finding out which sources and campaigns bring inquiries (UTM parameters, referring page, first page viewed, language version). Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• Keeping the Site secure and protecting the form from spam and abuse (the inquiry limit, the IP address hash, the browser identifier, Cloudflare Turnstile verification when it is enabled). Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• Marketing information about our products and services, if you tick the marketing consent box in the form – to the extent and through the channels stated in the consent. Legal basis: your consent (Article 6(1)(a) GDPR).
• Establishing, exercising or defending legal claims, should the need arise. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

5. Do you have to provide your data

Providing data is voluntary, but without the fields marked as required in the form we cannot accept your inquiry or reply to it. The phone number, store address, whether you have a store, the number of orders, selling to companies, the budget and marketing consent are optional – leaving them out does not affect how we handle your inquiry.

6. Who receives the data

Inquiries are visible only to authorised members of our team. We use service providers who process data on our behalf under data processing agreements:

• Microsoft (Microsoft Azure): hosting the Site and the inquiry database, and sending email notifications about new inquiries (Azure Communication Services),
• Cloudflare (Cloudflare Turnstile): checking that the form is sent by a person rather than a program – only when the Turnstile check is shown with the form; in doing so Cloudflare processes, among other things, the IP address and information about the browser and device,
• the provider of our email service, which receives inquiry notifications and our correspondence with you.

We do not sell data or share it with anyone for marketing purposes. We may disclose data to public authorities where the law requires it.

7. Transfers outside the EEA

Microsoft and Cloudflare belong to groups headquartered in the United States, so data may be transferred outside the European Economic Area. Such transfers take place only on the basis of a European Commission adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission. You can get information about these safeguards and a copy of them by writing to kontakt@nublado.pl.

8. How long we keep the data

• Inquiry data and the visit information stored with it – for as long as needed to handle the inquiry and discuss cooperation, and then until the limitation periods for any related claims expire.
• Data used for marketing – until you withdraw your consent.
• The IP address used for the inquiry limit – only in server memory, for the period over which the limit is counted (15 minutes).

If you successfully object to processing based on our legitimate interest, we will stop processing the data for that purpose earlier.

9. Your rights

You have the right to:

• access your data and receive a copy of it,
• have your data rectified,
• have your data erased,
• restrict processing,
• data portability for data processed on the basis of consent or in connection with steps taken before entering into a contract,
• object to processing based on our legitimate interest,
• withdraw your marketing consent at any time; withdrawing consent does not affect the lawfulness of processing before the withdrawal.

To exercise these rights, write to kontakt@nublado.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

10. Cookies and browser storage

The Site itself does not set cookies. Fonts and images are served from our own server. Cookies are set only by the admin panel, which is used exclusively by our team.

To link an inquiry to the source of the visit, the Site saves the UTM parameters, the referring page address and the address of the first page viewed in the browser's session storage (sessionStorage). This information is not sent anywhere until you send the form, and it disappears when you close the browser tab.

The operator of the Site may enable a Google tag (Google Tag Manager or gtag.js) on it. Until it does, the Site uses no analytics or advertising tools. When the tag is enabled, the Site asks for your consent to measure traffic. Without it the Google script is not loaded at all and nothing is sent to Google. After you click “Accept” the Site loads the script from Google's servers (www.googletagmanager.com) and grants the consents in Consent Mode (advertising and analytics); Google may then set cookies (such as _ga) in your browser and receives data about your visit. The contents of a Tag Manager container are set by the operator of the Site, and the Site's security policy allows scripts to be loaded from Google domains only.

We save your choice (accept or reject) in the browser's local storage (localStorage, key tiendo:consent) and remember it until you change it or clear the site's data. You can change or withdraw your consent at any time with the “Cookie settings” link in the footer: withdrawing deletes the Google cookies and reloads the page without their script.

If the Cloudflare Turnstile check is shown with the form, its script is loaded from Cloudflare's servers (challenges.cloudflare.com), and Cloudflare may use browser storage during the check in accordance with its own privacy policy.

11. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling.

12. Changes to this policy

If we change how we process data, we will update this policy and the date at the top of this page.