Privacy policy

Applies to the TWØIE website, business contacts and optional analytics. Version dated 12 October 2026.

Who is responsible for your data

The data controller is MØIE Mieszko Żuchowicz, ul. Królowej Jadwigi 1/2, 77-400 Złotów, NIP 7671588691, REGON 300915931. For matters concerning your data, email biuro@twoie.pl or call: +48 793 579 889.

What data we collect and why

When you submit your basket, we record the business name, NIP tax identification number, contact name, email address, phone number, delivery town or city, selected collection method, notes and order items. We need these to respond to your request, check availability, agree the price and delivery, and prepare the purchase. Do not include particularly sensitive data in the notes.

The office may organise business and contact details in its register and record agreed terms and internal service notes. Adding a contact does not create a customer account or send an invitation. Assigning a request to a business does not automatically share its history with other contacts.

The legal basis for handling an enquiry and taking steps before entering into a contract is Article 6(1)(b) GDPR. For people representing a business, the controller’s legitimate interest in managing the business relationship also applies (Article 6(1)(f) GDPR). Securing the service and establishing or defending legal claims are based on legitimate interests. Legal obligations relating to completed sales have a separate basis under Article 6(1)(c) GDPR.

Providing data is voluntary, but the required fields are necessary to handle a request through the form. You can also contact us by phone. This does not subscribe you to a newsletter.

Customer account

The office may grant access to a business using an approved email address. The office provides a single-use link to set a password. Subsequent sign-ins use the email address and password. We record the link between the verified account and the business, and the access status. People with active access can see the business’s prices and orders submitted from its signed-in accounts. Requests submitted without signing in are not shared automatically. You can ask the office to revoke access. Entering a NIP tax identification number or email address alone does not give access to business data.

Retention and access

Requests are available in the secure office panel. We retain request data for as long as needed to handle the request. Once the matter is closed, further retention depends on ongoing agreements or completion of the purchase, obligations relating to sales documents, and the need to establish, pursue or defend legal claims. Data no longer needed for these purposes is deleted. Linking a request to a business does not justify indefinite retention. We retain business contact data and notes while they serve the business relationship or the stated obligations and claims. Access is available to authorised people handling the request and to the infrastructure providers needed to operate the website: OpenAI Sites, Cloudflare infrastructure and cyber_Folks for email. Processing may involve transfers outside the European Economic Area under the terms and safeguards used by these providers. Contact the controller for details of recipients and transfer safeguards.

The form saves your request with the office. It does not automatically send it to marketplaces, the inventory system or a payment service. Fulfilling an agreed order may require sharing the data needed for delivery with a carrier; the office will confirm the delivery terms.

Your rights

You may request access to your data, rectification, erasure or restriction of processing, and data portability where applicable. You have the right to object to processing based on legitimate interests and to lodge a complaint with the President of the Polish Personal Data Protection Office. The extent to which these rights can be exercised depends on the legal basis for processing and the controller’s legal obligations. Contact us at the email address provided.

Browser storage and technical data

Details of purposes and retention periods are set out in the cookie policy. You can open the settings for essential storage and optional analytics from the footer on any page. We remember analytics acceptance or rejection in localStorage for 180 days. You can change your choice or withdraw consent at any time. Analytics consent is not advertising consent.

We store the basket contents (product codes and quantities) in your browser so they remain when you refresh the page. After you sign in, we store an essential customer-session cookie valid for up to 7 days. We store passwords only as secure hashes. The link to set a password expires after 24 hours or when used. We use technical data from sign-in attempts to limit abuse. “Sign out” removes the customer session from this browser while retaining the basket contents. While submitting an order request, we store its data and an attempt identifier locally. This lets us check the same record after a connection loss or another sign-in without creating a duplicate. We delete this copy once the result is confirmed. If the result remains unknown, the copy stays until the submission is resolved; you can also delete it with the website data. On a shared device, sign out and delete website data when you finish. You can clear the basket by removing its items or the website data. The hosting infrastructure may process technical connection data needed to operate and protect the service.

Optional Google Analytics 4 analytics

Only with your voluntary consent do we use Google Analytics 4 to measure public page views, traffic sources and basic device and browser information. The legal basis for processing data for this purpose is consent (Article 6(1)(a) GDPR). Rejecting analytics does not affect your use of the website. Before consent and after rejection, we do not load the Google script or send analytics requests to Google.

We do not send email addresses, NIP tax identification numbers, business names, basket data or form contents to Analytics. The page URL, title and referring-page URL are sanitised; activation parameters, password-reset parameters and other data from links are not transmitted. Private account and office panels, sign-in, activation and password reset are excluded from measurement.

You can withdraw consent in “Cookie settings” in the footer. We then stop analytics transmission and remove the Analytics cookies accessible to the website; the page may refresh without clearing your basket. Withdrawal does not affect the lawfulness of earlier processing. Analytics consent does not enable advertising consent: advertising storage, advertising user data and advertising personalisation remain denied.

Google Analytics 4 is provided by Google Ireland Limited. Analytics data may be processed outside the European Economic Area under Google’s terms, using the data-transfer mechanisms offered by Google. Google’s privacy documentation describes the processing in more detail. Contact the controller about the rules applying to the TWØIE website.

We store your selected interface language in the twoie_language cookie for up to one year. This record is used only to remember the PL or ENG language preference.

The office and sales panels require sign-in through ChatGPT and use its authentication mechanism. An authorised sales representative can see only the businesses assigned to them and the contacts and requests needed to serve those businesses. We record the assigned representative and agreed terms, including the commission rate; these are internal sales-administration data. Buyers do not need to create an account or sign in through ChatGPT.