Privacy policy

DRAFT — 22 October 2026. This document has been prepared for NETWORA SYSTEMS before business registration. Before sales begin, the legal details must be completed and the operational terms approved. It does not confirm that trading has commenced.

1. Controller and contact

NETWORA SYSTEMS, networa.pl. Contact: biuro@networa.pl, +48 690 768 899. Full registration details of the seller and data controller, including the Polish tax identification number (NIP) and the business details required for the selected legal form: TO BE COMPLETED AFTER REGISTRATION. Address recorded in the store settings: Pabianicka 9, B6, 95-030 Rzgów, Poland — TO BE CONFIRMED as the business, correspondence, complaints and returns address.

This document covers networa.pl, enquiries, orders, after-sales support and services performed by NETWORA. The controller's identity must be completed before forms are made publicly available. For data matters, contact biuro@networa.pl. Sending an enquiry is not consent to unrestricted use of data or advertising.

2. What data we process and why

  • Enquiries, quotations and orders: full name, company, tax identification number, address, email, telephone, requirements, order details and correspondence. Data necessary for steps before entering into a contract and for its performance are processed under Article 6(1)(b) GDPR; business contact persons' details and ordinary enquiries unrelated to a contract are processed on the basis of our legitimate interest in handling communications (point (f)).
  • Payments, invoices and complaints: billing details, transaction identifiers and status, order details and the description of the issue. The legal bases are contract performance (point (b)), legal obligations (point (c)) and the establishment, exercise and defence of claims (point (f)). Full card details and security codes are handled by the payment provider; do not send them to us by email or chat.
  • Accounts and subscriptions: contact details, order history, customer identifier, selected plan, schedule, payment and cancellation status, for contract performance (point (b)). Payment details used for recurring charges are handled within the payment provider's system.
  • Security and website operation: IP address, browser and device data, timestamps, logs and technical identifiers, to secure and maintain the website, prevent misuse and investigate faults (legitimate interest, point (f)), while observing consent requirements for non-essential technologies.
  • Voluntary marketing: email or telephone number and a record of consent, if you sign up through an available marketing form. Messages are sent only after the required consent for the relevant channel; consent-based processing falls under Article 6(1)(a) GDPR. You may withdraw consent through an unsubscribe link or by contacting us. Order handling does not depend on marketing consent.
  • Analytics and personalisation: information about pages and products viewed and interactions, where the required consent to the relevant technologies has been given. Data may be used to assess website performance and for the personalisation described in section 4.

Providing the data required for an order or quotation is a condition of its fulfilment; without it we cannot provide the relevant service. Additional fields and marketing consent are optional. We do not require special-category data, such as health information.

3. Forms, messages and WhatsApp

We use contact forms and Forms and Messaging tools to handle enquiries and communications. We process message content, attachments and contact details provided; marketing forms require separate consent. Flow supports process automation, and Subscriptions supports subscription schedules. Do not send passwords, API tokens, card details or recordings containing third parties' personal data through a form without agreeing a secure transfer method.

The WhatsApp button is a standard link to +48 690 768 899. We do not embed an external WhatsApp script in it or send messages automatically. Clicking opens an external service with suggested text that can be changed before sending. From the point the link is opened, WhatsApp processes connection data under its own policies; after a message is sent, we receive the message, shared profile details and telephone number. In the EEA, the provider is WhatsApp Ireland Limited; see the WhatsApp privacy policy. WhatsApp contact is voluntary; email and telephone are also available.

4. Technology providers and recipients

We disclose data only to the extent necessary to authorised persons, hosting and store platform providers, communications and email providers, payment providers, carriers fulfilling deliveries, accounting providers, advisers and authorities entitled by law. Depending on their role, providers act as processors on our instructions or as separate controllers.

Shopify provides the store platform, hosting, checkout, account functionality, payments through Shopify Payments, and Forms, Messaging, Flow and Subscriptions tools. Relevant settlement providers, including Stripe group entities, participate in payments according to the chosen method and the operator's terms. Data necessary for platform operation are processed by the relevant Shopify group entities, including Shopify International Limited in Ireland. Information: Shopify privacy, consumer privacy policy and data rights portal.

PayPal: if you choose this payment method at checkout, PayPal receives the data necessary to process the payment and any refund, particularly identification and contact details, order information, amount, currency and transaction details, and the delivery address where needed. For its own payment services, security and legal obligations, PayPal acts as a separate controller. For the EEA, the relevant entity is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Our disclosure of data necessary for payment serves contract performance (Article 6(1)(b) GDPR); PayPal explains its own legal bases, retention periods and international transfer practices in the PayPal Privacy Statement. Do not send us your PayPal password or authentication codes.

Shopify Network Intelligence is currently enabled. This feature uses store interaction data together with platform data and data from other merchants to improve services, personalise experiences and target advertising. Shopify may act as controller for these own purposes. This does not mean that other merchants can see your data. Required analytics and advertising consents are managed through the cookie banner. You can change preferences or use the provider's privacy portal. Merely visiting the website must not be treated as consent to optional technologies.

home.pl and Cloudflare participate in domain and DNS services. This does not automatically mean that all store traffic passes through Cloudflare's proxy; the scope depends on the actual DNS configuration. Technical data are processed to the extent required to operate the relevant service. Cloudflare privacy policy.

Providers of the accounting integrations we offer, such as inFakt, Fakturownia, wFirma, IFIRMA or FakturaXL, do not automatically receive NETWORA customers' data merely because we describe their solutions. Their involvement in a customer's project depends on a separate engagement, accounts and the required permissions. We send data to KSeF within an agreed integration and with appropriate authorisations, not on the basis of an enquiry about the service alone.

5. Data in IT services, surveillance and processing on behalf of customers

When configuring websites, online stores, Wi-Fi, Protect cameras and Access control, we may obtain agreed access to system data, IP/MAC addresses, configurations, logs, account data, orders or recordings. Access is limited to the purpose of the service; we do not use this data for NETWORA advertising. Where we act as a processor on behalf of a customer, the scope, duration, subprocessors, safeguards and termination of access are governed by a data processing agreement compliant with Article 28 GDPR.

The customer remains the controller of data in their store, network or surveillance system where this follows from their role. They are responsible for an appropriate legal basis, informing individuals, camera fields of view and retention periods; NETWORA is responsible for its own obligations and the agreed performance of the service. Ubiquiti cloud and remote access are enabled only within the agreed scope. Selling a device does not give NETWORA continuing access to camera footage. After the engagement, we revoke unnecessary permissions and return or delete data in accordance with the contract and law.

6. Cookies and similar technologies

We use technologies necessary for the basket, sessions, security, language settings and recording consent decisions. Optional analytics, personalisation and advertising technologies require prior consent where required by law. The banner allows you to accept, reject and manage preferences. Rejecting optional categories should not block the store's essential functionality.

Cookies may be session cookies, deleted at the end of a session, or persistent cookies, which expire after a period set by their provider. Their specific names, providers and durations depend on the features enabled; before public launch, the list of cookies actually set and their durations must be completed following the final consent and application audit. We do not claim that Google Analytics or Meta Pixel is installed without confirming activation.

You can withdraw or change consent through the cookie preference settings available on the website; continuing access to this function must be ensured before public launch. You can also delete cookies or block them in your browser; blocking necessary cookies may make purchasing difficult. Withdrawing consent does not affect the lawfulness of earlier processing.

7. Retention and transfers

We retain contract data and correspondence during performance and for the time needed to handle complaints and defend claims, generally until the relevant limitation period expires (usually 3 or 6 years, depending on the claim). Tax records are generally retained for 5 years from the end of the year in which the tax payment deadline fell, unless law or ongoing proceedings require a longer period. Enquiries that do not lead to a contract are normally retained for up to 12 months after correspondence ends; longer retention requires a justified need relating to claims. Marketing data are processed until consent is withdrawn or the purpose ends; minimal evidence of consent and withdrawal is kept for the period necessary to demonstrate compliance and protect against claims.

Copies and customer data accessible during IT services are retained according to the agreed schedule and data processing agreement; we do not adopt indefinite retention of recordings and passwords. Unnecessary data are deleted or anonymised.

The platform settings indicate hosting in the European Union. Global providers may nevertheless transfer data or provide access outside the EEA. The safeguards depend on the recipient: an adequacy decision or appropriate standard contractual clauses and required supplementary measures. Information about the applicable safeguards and how to obtain a copy can be requested from us or from the provider identified above.

8. Your rights

Within the limits of the GDPR, you have rights of access and a copy of your data, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and may object to direct marketing at any time. Consent can be withdrawn without affecting the lawfulness of earlier processing. Send requests to biuro@networa.pl. We normally respond within one month; we inform you within that period of any permitted extension and its reason. Where necessary, we verify identity proportionately.

You can lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl. NETWORA does not make decisions producing legal effects concerning you solely by automated means. The platform provider's personalisation and advertising profiling are described in section 4 and its documents; these do not constitute consent to unrestricted profiling by NETWORA.

9. Updates

We update this policy when actual processes, providers or law change. A new purpose requiring consent is not activated merely by changing the text. Before launch, this draft requires completion of the controller's identity and verification of subprocessors, consents and technical retention periods.