Contact

Privacy and Cookies Policy of the mundienergy.pl Store

Date of last update: 24 July 2026

§ 1. Personal Data Controller

  1. The Controller of the Personal Data of Users and Customers of the mundienergy.pl online store is: MUNDI GROUP Spółka z ograniczoną odpowiedzialnością with its registered office in Bielsko-Biała, ul. Barkowska 191, 43-300 Bielsko-Biała, NIP: 9372773312, REGON: 528731301 (hereinafter the „Controller”).
  2. Contact in matters related to the protection of personal data: info@mundienergy.pl.
  3. The Controller declares that it has not appointed a Data Protection Officer (DPO) and independently performs the obligations arising from Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

§ 2. Purposes, legal bases and period of data processing

The Controller processes personal data for the following purposes:

  1. Processing of Orders and the Sales Contract (Purchases Without Registration, Domestic and International Deliveries):
    • Scope of data: First name, last name, delivery/Parcel locker address, country of delivery, e-mail address, phone number, and optionally NIP/EU VAT and company details (invoice).
    • Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract).
    • Storage period: For the time necessary to complete the order, and then until the expiry of the limitation periods for claims and tax and accounting obligations (5 years from the end of the tax year).
  2. Age verification (18+ requirement for caffeine):
    • Scope of data: Declaration of being 18 years of age. Verification is carried out on the basis of the Customer's declaration made when placing an order.
    • Legal basis: Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR (the Controller's legitimate interest arising from the requirements for trading in products with a high caffeine content).
  3. Contact forms, the Ambassador form and the Distributor form:
    • Scope of data: First name, last name, e-mail address, phone number, company/profile name, message content and data provided in the application forms.
    • Purpose and legal basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest) and Art. 6(1)(a) GDPR (User's consent) – data provided via the contact form, the application form for Ambassadors and the form for Distributors is processed solely for the purpose of providing a response, carrying out the recruitment process for the ambassador programme or establishing business cooperation.
    • Storage period: Until the handling of the enquiry, recruitment or establishment of cooperation is completed, or until consent is withdrawn/an objection is raised.
  4. Handling of complaints and returns:
    • Scope of data: First name, last name, e-mail address, order number, bank account number.
    • Legal basis: Art. 6(1)(c) GDPR (fulfilment of a legal obligation).
  5. Direct marketing, analytics and remarketing (Google Ads, Meta Pixel, Google Analytics):
    • Scope of data: IP address, cookie identifiers, data on activity on the Website.
    • Legal basis: Art. 6(1)(a) GDPR (voluntary consent of the User expressed in the cookie banner).
    • Storage period: Until consent is withdrawn or the cookies expire.

§ 3. No newsletter and no user accounts

  1. The Website does not run a newsletter and does not send marketing information by electronic means without the User's prior consent.
  2. The Website does not allow the creation and maintenance of User Accounts. Data during purchases is provided on a one-off basis solely for the purpose of handling the current Order.

§ 4. Recipients of data (entrustment of processing)

Customers' personal data is transferred exclusively to trusted third parties (Processors) with whom the Controller has concluded appropriate data processing entrustment agreements for the proper handling of the Store:

  1. Eco Service Sp. z o.o. (operator of the MagPack brand), ul. Atramentowa 5, 55-040 Bielany Wrocławskie – Logistics operator responsible for warehousing, order picking and preparing the shipment of goods.
  2. PayPro S.A. (Przelewy24) – Electronic payment operator (online payments).
  3. Logistics operators carrying out the delivery of orders (including InPost, DPD, DHL or other carriers cooperating with the Controller) – for the purpose of physically delivering the shipment within Poland or abroad.
  4. LH.pl Sp. z o.o. – Provider of hosting and server infrastructure.
  5. Accounting Office / Law Firm – For the purpose of accounting services and pursuing any claims.
  6. Providers of analytical and marketing tools: Google Ireland Ltd. (Google Ads, Google Analytics), Meta Platforms Ireland Ltd. (Meta Pixel / Facebook).

§ 5. Analytical and advertising tools and cookies

  1. The Website uses its own and third-party Cookies.
  2. Meta Pixel (Facebook/Instagram): A marketing tool provided by Meta Platforms. It allows measuring the effectiveness of ads and targeting remarketing ads at people who have visited the Store.
  3. Google Ads and Google Analytics: Analytical and advertising tools provided by Google. They are used to analyse website traffic, study conversions and display personalised ads.
  4. The User has the ability to manage consents for analytical and marketing cookies using the consent banner (CMP) that appears on the first visit to the Website, as well as by changing the settings of their web browser.
  5. Withdrawal of consent: The User may at any time change or withdraw consent to the use of cookies through the cookie banner settings or the settings of their web browser.

§ 6. Transfer of data outside the European Economic Area (EEA)

Some data may be transferred outside the European Economic Area in connection with the use of Google and Meta services. The transfer of data is carried out in accordance with the applicable GDPR provisions and with the application of appropriate safeguards (e.g. Standard Contractual Clauses approved by the European Commission and the Data Privacy Framework programme).

§ 7. User's rights (GDPR)

Every User whose data is processed by the Controller has the right to:

  • Access their data and receive a copy of it (Art. 15 GDPR),
  • Rectification (correction) of data (Art. 16 GDPR),
  • Erasure of data (the „right to be forgotten”) (Art. 17 GDPR),
  • Restriction of processing (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Object to processing (Art. 21 GDPR),
  • Withdraw consent at any time,
  • Lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa (or its equivalent in the country of residence).

§ 8. Data security

  1. The Controller applies modern technical and organisational measures ensuring protection of the processed personal data appropriate to the threats and the category of data subject to protection.
  2. The connection to the Store is encrypted using an SSL certificate (HTTPS).

§ 9. Changes to the Privacy Policy

  1. The Controller reserves the right to change this Privacy Policy in the event of changes in legal regulations or the implementation of new technical functionalities.
  2. The current version of the Privacy Policy is always available on the Store's website.
  3. This Privacy Policy is effective from 24 July 2026.