Privacy and Cookie Policy

theiqone.com · Last updated: 26 May 2026

This is a translation provided for convenience. In the event of any discrepancy, the Polish version prevails.

This Privacy and Cookie Policy sets out the rules for processing personal data and for using cookies and similar technologies in connection with the use of the online store available at theiqone.com (the “Store”).

The controller processes data in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”),
• the Polish Act on the Provision of Electronic Services,
• the Polish Telecommunications Law,
• other applicable provisions of Polish and EU law.

1. Data controller

The controller of personal data is:

STARPRIMER Sp. z o.o.
ul. Mostowa 22, 42-400 Zawiercie, Poland
KRS: 0001026580, NIP (Tax ID): 6762639413
E-mail: kontakt@theiqone.com

The controller has not appointed a Data Protection Officer (DPO). All matters relating to personal data protection should be sent to the e-mail address above.

2. Scope, purposes and legal bases of processing

The controller processes users’ personal data in connection with the use of the Store, in particular for the following purposes:

2.1 Performance of the sales contract

• accepting and fulfilling the order,
• handling payments,
• delivering products.

Data: first name, last name, delivery address, e-mail address, phone number, order details.

Legal basis: Art. 6(1)(b) GDPR

2.2 Payment handling

Data is passed to payment operators in order to complete transactions.

Data: identification data, transaction data, amount, order number.

Legal basis: Art. 6(1)(b) and (c) GDPR

2.3 Tax and accounting obligations

Data: first name, last name, address, tax ID, invoice and transaction data.

Legal basis: Art. 6(1)(c) GDPR

2.4 Handling complaints, returns and claims

Data: order details, contact details, bank account number, correspondence.

Legal basis: Art. 6(1)(b) GDPR

2.5 Customer contact

Data: first name, e-mail address, message content.

Legal basis:

• Art. 6(1)(b) GDPR (contact related to a contract),
• Art. 6(1)(f) GDPR (legitimate interest of the controller).

2.6 Direct marketing and newsletter

Data: first name, e-mail address.

Legal basis: Art. 6(1)(a) GDPR (consent)

2.7 Analytics and security

Data: IP address, device data, activity in the Store, cookie data.

Legal basis:

• Art. 6(1)(a) GDPR (marketing and analytics cookies),
• Art. 6(1)(f) GDPR (security and system operation).

2.8 Information obligation

Providing data is voluntary; however:

• without it, the order cannot be fulfilled,
• not consenting to marketing does not affect your ability to use the Store.

3. Recipients of personal data

Personal data may be shared with the following categories of recipients:

• Shopify International Ltd. / Shopify Inc. – e-commerce platform provider,
• PayPro S.A. (Przelewy24) – payment operator,
• courier companies (InPost, DPD, DHL, Poczta Polska),
• accounting office and accounting service providers,
• IT, hosting and e-mail service providers,
• Google LLC (Google Analytics, Google Ads),
• Meta Platforms Ireland Ltd. (Meta Pixel, Facebook Ads),
• Klaviyo, Inc. – e-mail marketing and automation platform provider (newsletter, notifications, behaviour analysis for marketing purposes),
• other providers of marketing and analytics tools.

Data is shared only with entities that process it under data processing agreements or other appropriate legal bases.

4. Transfers of data outside the EEA

In connection with the use of services provided by Shopify, Google, Meta and Klaviyo, data may be transferred outside the European Economic Area, in particular to the United States.

Data transfers take place on the basis of:

• standard contractual clauses (SCCs) approved by the European Commission,
• an implementing decision of the European Commission (EU–US Data Privacy Framework – to the extent the entity participates in the programme).

5. Data retention periods

Personal data is stored for the following periods:

• order-related data – 6 years from the end of the year,
• accounting data – 5 years from the end of the tax year,
• marketing data (newsletter) – until consent is withdrawn,
• correspondence – up to 12 months after contact ends,
• server logs – up to 12 months,
• cookie data – for the periods given in the cookies section.

6. Rights of data subjects

Every data subject has the following rights:

• right of access to data (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (“right to be forgotten”) (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object (Art. 21 GDPR),
• right to withdraw consent at any time (Art. 7(3) GDPR),
• right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or with the supervisory authority in your EU country of residence.

To exercise your rights, contact us at: kontakt@theiqone.com. We respond within 30 days.

7. Profiling and automated decision-making

The controller does not make decisions based solely on automated processing that would produce legal effects for the user.

The Store may use analytics and marketing tools that analyse user behaviour for statistical and advertising purposes; however, they do not affect individual decisions concerning the user.

8. Data security

The controller applies appropriate technical and organisational measures, including:

• encryption of data transmission (SSL/TLS),
• access control to systems,
• regular backups,
• security monitoring,
• procedures for responding to personal data breaches.

9. Cookies and similar technologies

9.1 General information

The Store uses cookies and other tracking technologies (localStorage, marketing pixels) to ensure that the website works properly and securely, and for analysis and optimisation. Cookies are IT data stored on the user’s end device.

9.2 Cookie categories

Strictly necessary cookies – required for the Store to work properly; they do not require the user’s consent.

• shopping cart,
• login,
• session maintenance,
• security.

Functional cookies – allow the user’s preferences to be remembered.

• language settings,
• remembering consents,
• interface personalisation.

Analytics cookies – used only after consent is given.

• traffic analysis,
• user statistics,
• optimising how the Store works.

Provider: Google Analytics

Marketing cookies – used only after consent is given.

• remarketing,
• ad personalisation,
• measuring campaign effectiveness.

Providers: Meta Platforms Ireland Ltd. (Meta Pixel), Google Ads.

9.3 Cookie retention

• session cookies – until the browser session ends,
• functional cookies – up to 12 months,
• analytics cookies – up to 14 months,
• marketing cookies – up to 24 months.

9.4 Legal basis for cookies

Cookies are used on the basis of:

• Art. 6(1)(a) GDPR (consent – analytics and marketing cookies),
• Art. 6(1)(f) GDPR (legitimate interest – strictly necessary cookies),
• Art. 173 of the Polish Telecommunications Law.

9.5 Managing cookies

The user may at any time:

• accept or reject cookies,
• change consent settings,
• delete cookies in the browser,
• block their installation.

Changing these settings does not affect the ability to use the Store’s basic functions.

9.6 Third-party cookies

The Store uses cookies from third parties:

• Shopify (store platform),
• Google (Analytics, Ads),
• Meta Platforms (Facebook/Instagram),
• Klaviyo (e-mail marketing and automation),
• payment operators and marketing tool providers.

Each of these entities has its own privacy policy.

10. Server logs

When the Store is used, system logs are collected automatically, including the IP address, date and time of connection, and browser and operating system information. This data is used solely for technical, security and administrative purposes and is not used to identify the user.

11. Changes to this policy

This policy may be updated, in particular in the event of legal, technological or organisational changes. The current version of the Policy is always available at: theiqone.com/pages/polityka-prywatnosci

12. Contact

Any questions regarding privacy and cookies: kontakt@theiqone.com