Privacy policy

Online store supersonicfood.com SUPERSONIC FOOD PL Sp. z o. o.

Valid from: May 20, 2026

§ 1 Personal data administrator

This Privacy Policy sets out the rules for the processing of personal data obtained via the supersonicfood.com online store (hereinafter referred to as the "Store") and informs you about your rights as data subjects, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and the Act of 10 May 2018 on the protection of personal data.

The administrator of your personal data within the meaning of Art. 4 point 7 of the GDPR is:

SUPERSONIC FOOD PL Sp. z o. o.

street Bruzdowa 100C/2

02-991 Warsaw

Represented by Members of the Management Board: Krzysztof Kozak and Tomasz Teresak

Contact e-mail address: contactus@biz.supersonicfood.com

KRS number: 0000839873, NIP: 9512501164, REGON: 385996745

Data Protection Inspector

The Administrator did not appoint a Data Protection Inspector because there are no circumstances obliging him to appoint him in accordance with Art. 37 GDPR. In all matters relating to the protection of personal data, you can contact the Administrator directly at the e-mail address provided above.

§ 2 General principles of data processing

The Administrator processes Users' personal data only to the extent necessary to ensure the functioning of the Store and the provision of the offered services. Processing takes place on the basis of your consent or on another legal basis provided for in the GDPR.

Definitions

The terms used in this Policy correspond to the definitions contained in Art. 4 GDPR. "Personal data" means any information relating to an identified or identifiable natural person. "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means.

Legal basis for processing

The administrator processes personal data on the following legal bases:

  • art. 6 section 1 letter a GDPR – consent of the data subject (e.g. newsletter, non-required cookies, marketing);

  • art. 6 section 1 letter b GDPR - performance of a contract or taking action at the request of a person before concluding a contract (e.g. fulfillment of an order, maintaining an Account);

  • art. 6 section 1 letter c GDPR - fulfillment of the legal obligation imposed on the Administrator (e.g. tax and accounting obligations);

  • art. 6 section 1 letter f GDPR - legitimate interest of the Administrator (e.g. protection against abuse, pursuing claims, direct marketing of own products);

  • art. 173 of the Act of July 16, 2004 - Telecommunications Law - consent to the use of cookies and similar technologies to the extent not required for the operation of the Store.

§ 3 Rights of the data subject

In connection with the processing of personal data by the Administrator, you have the following rights:

  • the right to access data (Article 15 of the GDPR) - the ability to obtain information about what personal data are processed;

  • the right to rectify data (Article 16 of the GDPR) - request to correct incorrect data or complete incomplete data;

  • the right to delete data, the so-called "right to be forgotten" (Article 17 of the GDPR), unless there are grounds for further processing;

  • the right to limit processing (Article 18 of the GDPR);

  • the right to transfer data (Article 20 of the GDPR) - the ability to receive data in a structured, commonly used, machine-readable format;

  • the right to object to processing (Article 21 of the GDPR), in particular direct marketing;

  • the right to withdraw consent at any time (Article 7(3) of the GDPR) - withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal;

  • the right to lodge a complaint with the supervisory authority (Article 77 of the GDPR).

To exercise the above rights, simply send a message to: contactus@biz.supersonicfood.com.

Supervisory authority

The competent authority for personal data protection in Poland is:

President of the Personal Data Protection Office (PUODO)

street Stawki 2, 00-193 Warsaw

Website: https://uodo.gov.pl

§ 4 Security of transmitted data (SSL/TLS)

In order to ensure the security of transmitted data, the Store uses connection encryption using the SSL/TLS protocol. You can recognize an encrypted connection by changing the address in your browser from "http://" to "https://" and by the padlock symbol in the address bar.

§ 5 Data collected automatically during the visit (server logs)

Each visit to the Store's website causes the Administrator's IT system to automatically register certain data, including:

  • the IP address of the device from which the query is made (usually stored in an anonymized form);

  • dates and times of the visit;

  • the URL of the requested resource and file name;

  • website from which you were redirected (referrer);

  • type of browser and operating system used, Internet service provider.

This data is stored in system logs and is not combined with other personal data of Users.

Legal basis: art. 6 section 1 letter f GDPR - the legitimate interest of the Administrator consisting in ensuring the security of the IT system, proper operation of the Store and explaining possible abuses.

Storage period: log data is stored for a maximum of 30 days, after which it is automatically deleted, unless longer storage is necessary due to security incidents.

§ 6 Cookies and similar technologies

The store uses cookies and similar technologies (e.g. Local Storage, tracking pixels). Cookies are small text files saved on your end device by your web browser.

Cookies necessary for the operation of the Store

Cookies necessary for the functioning of the Store (e.g. shopping cart, security functions, language settings, logging in to the Account) are used on the basis of Art. 173 section 3 of the Telecommunications Law and do not require your consent.

Cookies requiring consent

Other cookies and technologies - in particular analytical, marketing and integration with third-party services - are used only after your consent in the cookie banner (consent management platform). The legal basis is art. 173 section 1 of the Telecommunications Law in connection with Art. 6 section 1 letter a GDPR.

You can withdraw your consent at any time with future effect via the cookie settings panel available in the footer of the Store. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

§ 7 Contact with the Administrator

In the case of contact by electronic means (e-mail, contact form, live chat), we process the data provided in the message (e-mail address, name, telephone number, message content) in order to provide a response and possible further correspondence.

Legal basis: art. 6 section 1 letter b GDPR (contact related to the contract or pre-contractual activities) or Art. 6 section 1 letter f GDPR (the Administrator's legitimate interest in handling inquiries).

Storage period: correspondence data is deleted after the case is completed, unless longer storage is required by law (e.g. Article 74(2) of the Accounting Act - 5 years for accounting documents; Article 86(1) of the Tax Ordinance - up to 5 years for tax documents).

§ 8 Customer account

The store allows you to create a password-protected customer account. During registration, the following are collected: e-mail address, password, name and surname, delivery address, invoice address and - optionally - telephone number.

Legal basis: art. 6 section 1 letter b GDPR – provision of the Account management service.

Storage period: Account data is processed for the duration of its operation. You can delete your account at any time yourself or by contacting the Administrator at contactus@biz.supersonicfood.com. After deleting the Account, the data is deleted immediately, with the exception of data subject to storage obligations (e.g. invoices).

§ 9 Order fulfillment, payment and delivery

In order to process orders, we process the data provided when placing the order (name and surname, delivery address and invoice address, e-mail address, telephone number - optional, order data, selected payment method).

Legal basis: art. 6 section 1 letter b GDPR – performance of the sales contract.

Data recipients

As part of the execution of orders, your data is transferred to the following categories of recipients:

  • payment operators: PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, and PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań - to settle payments;

  • courier and transport companies - to deliver goods to the indicated address;

  • logistics operator – Arteria Logistics – for the purpose of completing and shipping orders;

  • accounting office and tax advisors - in order to fulfill tax and accounting obligations.

The Administrator has concluded agreements entrusting the processing of personal data with all the above-mentioned processing entities - to the extent required by law - in accordance with Art. 28 GDPR.

Storage period

Data regarding orders and invoices are stored for the period specified in tax and accounting regulations, i.e. 5 years from the end of the calendar year in which the tax obligation arose (Article 86(1) of the Tax Ordinance and Article 74(2) of the Accounting Act). Data related to the pursuit of possible claims - for the period of limitation of claims, in accordance with the Civil Code (basically 6 years, and for claims related to running a business - 3 years).

§ 10 Newsletter and e-mail marketing (Klaviyo)

In the Store you can subscribe to the newsletter. The newsletter is sent via the "Klaviyo" tool, provided by Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA.

Subscription to the newsletter

Subscription to the newsletter takes place in the double opt-in procedure - after providing your e-mail address, you receive a message with a link confirming your willingness to receive the newsletter. Failure to confirm within 24 hours results in the data being blocked and deleted after a month.

During recording, we also save the IP address, date and time of recording and confirmation. The purpose is to demonstrate the correctness of the entry and to clarify possible abuses.

Scope of processed data

Only your e-mail address is required. Providing your name and other data is voluntary and serves to personalize the message. Klaviyo also processes statistical data regarding the use of the newsletter (e.g. open and click rates) in order to optimize the content.

Legal basis and withdrawal of consent

The legal basis for sending the newsletter is your consent - Art. 6 section 1 letter a GDPR in connection with Art. 10 of the Act on the provision of electronic services and Art. 172 Telecommunications Law. You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in the footer of each message or by sending a request to contactus@biz.supersonicfood.com.

Transfer of data outside the EEA

Klaviyo, Inc. is certified under the EU-US Data Privacy Framework (European Commission Implementing Decision of July 10, 2023). This ensures an adequate level of protection of personal data. Additionally, standard contractual clauses were included in accordance with Art. 46 section 2 letter c GDPR.

Klaviyo privacy policy: https://www.klaviyo.com/legal/privacy-notice

§ 11 Live chat and customer service (Chatty / Gorgias)

The store provides live chat to contact customer service. The following tools are used:

Chatty

Provider: Chatty (Premio) – chat widget embedded in the Store. Data collected during chat includes message content, e-mail address (if provided), name (if provided) and technical data (browser, device, approximate location based on IP address).

Gorgias

Supplier: Gorgias Inc., 768 Sansome Street, San Francisco, CA 94111, USA. Gorgias is a helpdesk platform that enables central handling of customer inquiries from various channels (e-mail, chat, social media). The following are processed: the content of the inquiry, contact details and - if necessary - order details.

Legal basis, storage period, transfer outside the EEA

Legal basis: art. 6 section 1 letter b GDPR (contract-related contact) or Art. 6 section 1 letter f GDPR (legitimate interest in effective customer service). Storage period: chat and query history is deleted no later than 24 months after the last contact, unless legal provisions or an ongoing matter require longer storage.

In the case of Gorgias, data may be transferred to the USA. Standard contractual clauses have been concluded with Gorgias in accordance with Art. 46 section 2 letter c GDPR. Gorgias privacy policy: https://www.gorgias.com/about/privacy

§ 12 Product reviews (Judge.me)

Customers can leave opinions about purchased products. For this purpose, we use the "Judge.me" tool provided by Judge.me, 50 Tannery Road #03-08, Singapore 347874.

After completing the transaction, you may receive an automatic e-mail with an invitation to leave a review about the purchased product. We process: e-mail address, name (if provided), order data and - after issuing an opinion - the content of the opinion.

We only publish reviews from customers who have actually purchased the product. Opinions are marked with information about a verified purchase - in accordance with the requirement of Art. 7aa of the Consumer Rights Act and Directive 2019/2161 (the so-called Omnibus).

Legal basis: art. 6 section 1 letter f GDPR - legitimate interest in ensuring the authenticity of product reviews. The invitation to submit an opinion is addressed to existing customers pursuant to Art. 10 of the Act on the provision of electronic services.

Transfers outside the EEA: Judge.me is based in Singapore. The European Commission, by decision of 1 February 2019, partially recognized Singapore as a country ensuring an adequate level of data protection; Additionally, standard contractual clauses were included. Privacy policy: https://judge.me/privacy

Storage period: opinion data is stored as long as the opinion is published in the Store. You can request the removal of your opinion at any time.

§ 13 Web analytics and reach measurement

All tools described in this paragraph are activated only after you expressly consent in the cookie banner (Article 173(1) of the Telecommunications Law in connection with Article 6(1)(a) of the GDPR). Without your consent, cookies of these tools are not set and data is not transferred to their providers.

13.1 Google Analytics 4

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for EEA users); parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.

Purpose: web analytics, statistical evaluation of the use of the Store, offer optimization, reach measurement.

Scope of processed data: pseudonymized user ID, shortened IP address, device data (browser, operating system), city-level location data, clicking and scrolling behavior, time spent on the page, referrer URL, technical identifiers.

IP anonymization: By default, Google Analytics 4 anonymizes IP addresses by shortening them before storing them.

Legal basis: art. 6 section 1 letter a GDPR in connection with Art. 173 section 1 Telecommunications Law (consent).

Transfer outside the EEA: Google LLC is certified under the EU-US Data Privacy Framework (Commission Decision of July 10, 2023). Additionally, standard contractual clauses apply.

Storage period: 14 months; after this time, the data is automatically deleted.

Objection/opt-out: via the cookie banner ("Cookie settings" link in the footer) or via the browser plug-in: https://tools.google.com/dlpage/gaoptout

Privacy Policy: https://policies.google.com/privacy

13.2 Google Tag Manager

Supplier: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: managing tags (scripts) on the website from one interface. Google Tag Manager itself does not collect personal data, but it loads other tags (e.g. analytical or marketing tools) that may collect data.

Scope of processed data: when the website is accessed, the IP address and technical identifiers (necessary to provide the tool) are transmitted to Google.

Legal basis: art. 6 section 1 letter a GDPR in connection with Art. 173 section 1 Telecommunications Law (consent).

Transfer outside the EEA: as in the case of Google Analytics - EU-US Data Privacy Framework and standard contractual clauses.

Privacy Policy: https://policies.google.com/privacy

13.3 Microsoft Clarity

Supplier: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

Purpose: analysis of user behavior in the Store using heat maps, session recordings and statistical analyzes to improve the usability of the website.

Scope of processed data: mouse movements, clicks, scrolling, screen size, device and browser information, visit time, information entered (data in sensitive fields, e.g. passwords, are automatically masked by Clarity).

Legal basis: art. 6 section 1 letter a GDPR in connection with Art. 173 section 1 Telecommunications Law (consent).

Transfer outside the EEA: Microsoft Corporation is certified under the EU-US Data Privacy Framework. Additionally, standard contractual clauses apply.

Storage period: up to 12 months.

Objection/opt-out: via the cookie banner ("Cookie settings" link in the footer).

Privacy Policy: https://privacy.microsoft.com/pl-pl/privacystatement

§ 14 Marketing and remarketing (tracking pixels)

All marketing and tracking tools described in this paragraph are activated only after you expressly consent in the cookie banner (Article 173(1) of the Telecommunications Law in connection with Article 6(1)(a) of the GDPR).

14.1 Meta Pixel (Facebook/Instagram)

Supplier: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (for EEA users); parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

Purpose: measuring the effectiveness of advertising on Facebook and Instagram (conversion tracking), creating target groups for advertising (Custom Audiences, Lookalike Audiences), remarketing.

Scope of processed data: pseudonymized user ID, IP address, browser information, pages visited, actions performed (e.g. purchase, adding to cart); in the case of logged in Meta users - also linking to a personal Meta account.

Joint administration: to the extent that personal data are processed jointly with Meta as part of the "Insights" function, joint controllership exists in accordance with Art. 26 GDPR. The important provisions of the agreement with Meta are available at: https://www.facebook.com/legal/controller_addendum

Legal basis: art. 6 section 1 letter a GDPR in connection with Art. 173 section 1 Telecommunications Law (consent).

Transfer outside the EEA: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Additionally, standard contractual clauses apply.

Storage period: cookie life time up to 180 days; aggregated advertising data for up to 24 months.

Objection/opt-out: via cookie banner or advertising settings in your Meta account: https://www.facebook.com/adpreferences

Privacy Policy: https://www.facebook.com/privacy/policy

14.2 TikTok Pixel

Supplier: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (for EEA users); parent company: ByteDance Ltd., Cayman Islands; affiliated companies in the US, Singapore and the People's Republic of China.

Purpose: measuring the effectiveness of advertising on TikTok, tracking conversions, creating target groups for advertising, remarketing.

Scope of processed data: pseudonymized user ID, IP address, browser and device information, pages visited, actions performed (e.g. purchase, adding to cart).

Transfer outside the EEA – important information: TikTok and its parent company ByteDance may transfer personal data to affiliated companies outside the European Union, including the USA, Singapore and the People's Republic of China. With regard to the People's Republic of China, the European Commission has not issued a decision on the adequacy of the level of data protection. TikTok bases data transfer on standard contractual clauses in accordance with Art. 46 section 2 letter c GDPR and additional technical and organizational measures (e.g. "Project Clover" - storing European users' data in data centers in Ireland and Norway). Despite these safeguards, there is a risk of access to your data by authorities from countries outside the EEA. TikTok Pixel is used exclusively on the basis of your express, informed consent in accordance with Art. 49 section 1 letter a GDPR.

Storage period: cookie lifespan up to 13 months; aggregated advertising data for up to 24 months.

Objection/opt-out: via cookie banner or ad settings in your TikTok account.

Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/pl

14.3 Pinterest Tag

Supplier: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (for EEA users); parent company: Pinterest, Inc., 651 Brannan Street, San Francisco, CA 94107, USA.

Purpose: measuring the effectiveness of Pinterest ads, tracking conversions, creating target groups for ads, remarketing.

Scope of processed data: pseudonymized user ID, IP address, browser and device information, pages visited, actions performed.

Legal basis: art. 6 section 1 letter a GDPR in connection with Art. 173 section 1 Telecommunications Law (consent).

Transfer outside the EEA: Pinterest, Inc. is certified under the EU-US Data Privacy Framework. Additionally, standard contractual clauses apply.

Storage period: cookie lifespan up to 365 days.

Objection/opt-out: via cookie banner or ad settings in your Pinterest account: https://www.pinterest.com/settings/privacy

Privacy Policy: https://policy.pinterest.com/pl/privacy-policy

§ 15 Transfer of data outside the European Economic Area

If you use the services of suppliers processing personal data outside the European Economic Area (EEA), the Administrator ensures an appropriate level of protection of your data by:

  • decisions of the European Commission establishing an adequate level of protection (e.g. EU-US Data Privacy Framework for certified US companies);

  • standard contractual clauses (SCC) in accordance with Art. 46 section 2 letter c GDPR;

  • additional technical and organizational measures when required;

  • consent of the data subject in accordance with Art. 49 section 1 letter a GDPR, in particular in the case of suppliers for whom no adequacy decision has been issued.

Detailed information about specific transfers outside the EEA can be found for individual tools in the paragraphs above.

§ 16 Data storage period (general rules)

Personal data is stored only as long as necessary to achieve the purposes of processing or for the period required by law. In particular, the following periods apply:

  • order and invoice data: 5 years from the end of the calendar year in which the tax obligation arose (Article 86(1) of the Tax Ordinance, Article 74(2) of the Accounting Act);

  • commercial correspondence: until the expiry of the limitation period for possible claims;

  • data regarding warranty, guarantee and non-compliance of the goods with the contract: until the expiry of the limitation periods for claims (generally 6 years, and for claims related to business activity - 3 years; Article 118 of the Civil Code);

  • newsletter data: until consent is withdrawn;

  • server logs: maximum 30 days.

§ 17 Withdrawal of consent

If the processing of your data is based on your consent, you can withdraw it at any time with future effect. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Consent may be withdrawn in particular:

  • via the cookie banner in the Store ("Cookie settings" link in the footer);

  • by clicking the unsubscribe link in the footer of each newsletter message;

  • by sending a message to: contactus@biz.supersonicfood.com;

  • in writing to the address of the Administrator's registered office indicated in § 1.

§ 18 Automated decision-making and profiling

The Administrator does not make decisions regarding you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect your situation (Article 22 of the GDPR).

Profiling for marketing purposes (e.g. targeted advertising on Meta, TikTok, Pinterest) takes place only on the basis of your express consent and can be withdrawn at any time via the cookie banner.

§ 19 Changes to the Privacy Policy

The Administrator reserves the right to change this Privacy Policy if necessary resulting from changes in the legal status, changes in the services provided or changes in the method of data processing. The current version of the Policy is permanently available at: supersonicfood.com/polityka-prywatnosci. We will inform Account holders about significant changes electronically to the e-mail address assigned to the Account.



This Privacy Policy is effective as of May 20, 2026.