Privacy and cookie policy

The controller of the personal data of persons using the online shop cnc-megamarket.pl, placing orders or contacting the shop is:

You can contact the Controller about data matters by email or in writing. For security reasons, the Controller may ask for information needed to confirm your identity, but should not request excessive data.

Sources of data

• directly from you — in the shop, a form, a message, a conversation or when you exercise your rights;
• from the person placing an order on behalf of a company or naming the recipient of a shipment;
• from the payment operator, carrier or bank — regarding the status of the service;
• from public business registers, where necessary to verify B2B details;
• automatically from the device, server and web technologies — in line with your cookie settings.

1. Providing the data marked as required at checkout is a condition for accepting and fulfilling the Order. Without it, concluding or performing the contract may be impossible.
2. Payment data may be passed to the selected payment operator or bank. As a rule, the shop should not receive the full card number or payment authentication data.
3. Data necessary for delivery is passed to the carrier, pick-up point operator or delivery provider.
4. If the Customer Account is active, account data, Order history and settings available in the dashboard are stored. The account can be deleted, except for data that must be kept for legal reasons or because of claims.
5. In B2B relationships, data of the customer’s employees and representatives may be processed on the basis of the legitimate interest of carrying out the cooperation and identifying persons authorised to make contact.

The shop uses its own forms running on the shop’s server, with no third-party form or anti-spam services. The following data is collected:

• contact form: name or company name, email address and message;
• product availability enquiry (in product tables): product and catalogue number, full name, email address, phone (optional), required quantity and message;
• B2B account application: company name, tax ID (NIP), website, contact person details (first name, last name, position), business email address, phone, additional information and the declarations and consents given;
• technical data needed to send the form and protect against spam: the address of the page from which the request was sent, and a hash of the IP address stored for 10 minutes solely to limit the number of submissions.

If the contact concerns a possible contract, the legal basis is taking steps at your request prior to entering into it. In other matters, the basis may be the Controller’s legitimate interest in conducting correspondence and responding.

1. A newsletter or email, SMS or telephone marketing may only be carried out after obtaining appropriate, voluntary and demonstrable consent, where required by law.
2. Marketing consent must be separate from accepting the Terms and Conditions and cannot be a condition of purchase. It can be withdrawn at any time without affecting the lawfulness of earlier processing.
3. After consent is withdrawn, the data is no longer used for that marketing. The Controller may keep minimal proof of the consent given and withdrawn, or an entry on the objection list, in order to respect the user’s decision and defend against claims.
4. If the shop publishes reviews, it may process the review content, signature or nickname, rating, date and information about a verified purchase. The scope, legal basis, visibility and publication period must match the actual review mechanism.

Data may only be disclosed to the extent necessary for a specific purpose:

• to providers of hosting, WordPress administration, email, security, backups and IT support;
• to payment operators, banks, carriers and pick-up point operators;
• to the accounting office, invoicing provider, legal and tax advisers;
• to providers of newsletter, analytics, advertising, anti-spam or customer service tools — if active;
• to public authorities and other authorised bodies where required by law.

Depending on the service, a recipient may act as a processor on the Controller’s instructions or as a separate controller. Roles and obligations must be confirmed in each provider’s contracts and documentation.

As of 20.10.2026, the shop’s website does not load resources from third-party servers: fonts, statistics and forms run on the shop’s server, and hosting and email are provided in Poland. The delivery, payment and accounting providers have not yet been fully confirmed.

If data is transferred outside the EEA, the Policy should state the recipient, the country, the legal basis for the transfer and how to obtain information about the safeguards. Depending on the provider, this may be a European Commission adequacy decision, participation in the EU–US Data Privacy Framework or standard contractual clauses with additional safeguards.

• contract data — for the duration of the contract and then until legal obligations and the relevant claim periods expire;
• tax and accounting documents — for the period required by law, calculated according to the regulation applicable to each document;
• complaints and returns — for the time needed to handle them, consumer obligations and any claims;
• account — until the account is deleted or the service ends, except for data kept on another legal basis;
• enquiries — until the matter is closed, and afterwards only as long as justified by the risk of claims or a legal obligation;
• marketing — until consent is withdrawn or an objection is raised, with the option of keeping minimal proof;
• form submissions — 180 days in the shop’s dashboard, and in the mailbox in line with the rules for handling correspondence;
• cookies, logs and analytics — the shop’s analytics data for 365 days, the cookie choice register for 730 days, others according to the cookie table and server settings;
• backups — until the end of the rotation cycle, without using the data for new purposes.

Analytics technologies, Order source attribution, recommendations, newsletter or advertising segmentation may constitute profiling, even if they have no legal effects. Such activities must be distinguished from decisions based solely on automated processing that produce legal effects or similarly significantly affect a person.

Cookies are small pieces of information stored in the browser. localStorage, pixel identifiers and other mechanisms can serve a similar function. The shop may use the following categories:

Cookies and browser storage used in the shop

Consent management

• analytics and marketing scripts are blocked until consent is given;
• the banner makes it equally easy to accept all categories, reject optional ones or choose your own settings;
• no optional category is pre-selected;
• settings can be changed at any time using the “Cookies” button visible on every page;
• the choice register records an anonymous identifier, the notice version, the date and the scope of the choice (without the IP address or browser data) and is kept for 730 days.

Status as of 20.10.2026 based on the shop’s configuration. The list does not include carriers and payment operators — see section 7.

The Controller applies technical and organisational measures appropriate to the risk, in particular access control, encrypted HTTPS connections, updates, backups, restricted permissions, form protection and logging of security events.

No method of transmission or storage offers an absolute guarantee. If a personal data breach occurs, the Controller documents the incident, assesses the risk and, where required by law, notifies the President of UODO and informs the data subjects.

A suspected breach, a misdirected message or an account problem can be reported to biuro@megamarket.pl — confirm the incident address.

1. The Policy may be updated when laws, providers, shop features, purposes or methods of processing change.
2. The new version applies from the date stated in the document. If a change requires new consent, it will not rely solely on publishing the updated Policy.
3. Significant changes may be communicated in the shop or directly to the persons concerned, depending on the risk and the contact details available.
4. Questions, requests and objections can be sent to the Controller’s address or by email: biuro@megamarket.pl — confirm.