We ship to 25 EU countries. Shipping by weight is shown in your cart.

My orders0Cart
0.00 PLN

Privacy policy

What we do with data: no cookies and no accounts, the cart stays in your browser.

Data controller

xdruk is the shop's brand. The site is a sales funnel: it shows products, calculates prices and passes your cart to the print shop PROMEDIA.PL. There are no customer accounts or order forms; after enabling chat you may voluntarily enter personal data in a message.

Personal data in connection with the site is processed by the entrepreneurs entered in the Polish Central Register and Information on Business Activity, who run their business as a civil-law partnership under the name “PROMEDIA.PL” S.C., with its seat at ul. Gdańska 91, 90-613 Łódź, Poland, NIP 7272466816, REGON 472304830:

  • Krystian Miazek, NIP 726-265-63-66, REGON 472304830, partner in the civil-law partnership PROMEDIA.PL
  • Małgorzata Anna Miazek-Roróg, NIP 834-166-04-86, REGON 472304830, partner in the civil-law partnership PROMEDIA.PL

Cart, settings and your cookie choice

We save the cart contents and your site settings in your browser storage (localStorage) on your device. The data stays on your device until you delete it (you can do so in the browser settings, after which the cart is empty). After a successful hand-off we also store the print shop cart URL and the hand-off time. When you click through to the cart, the language, products, options and quantities reach our server and are then sent to PROMEDIA.PL; prices are not sent. The basis is steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

We store your choice from the cookie window (statistics: yes or no, chat: yes or no) in your browser (localStorage, key xdruk.cookies.v1) together with the date of the choice. It is not a cookie and does not reach our server. The choice is valid for 12 months, after which we ask again, and it is used only to remember your decision. The basis is our legitimate interest in remembering the decision (Art. 6(1)(f) GDPR).

You can change your choice at any time with the “Cookie settings” button in the footer.

Server logs and abuse protection

The server keeps technical logs of visits: the IP address, the time, the requested address and the technical data sent by your browser. They serve security and keep the site running. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We keep the logs for up to 30 days.

Every attempt to go to the print shop cart is limited: to 10 per minute per IPv4 address or IPv6 /64 subnet, plus an overall limit for the whole shop. The limiter stores a hash of the identifier (SHA-256), not the address itself, and the attempt times for up to one hour; older files are deleted automatically. A separate operational checkout log stores the time, site version, language, item count, result or error, duration and, where available, the cart identifier and connection mode; we keep it for up to 30 days. The basis is our legitimate interest in security and diagnostics (Art. 6(1)(f) GDPR).

With every successful cart hand-off we also write a hand-off log, from which we count carts by language. It contains the time, cart identifier, language, site version (pl or eu), item count, item identifiers and the connection mode to the print shop. The log contains no IP address, prices or cart URL. The cart identifier is pseudonymous data, because it can be linked to the order at PROMEDIA.PL. We keep it for 24 months, after which it is deleted automatically. The basis is our legitimate interest in keeping hand-off statistics (Art. 6(1)(f) GDPR).

Statistics and live chat

We turn on statistics and live chat only with your consent, given in the cookie window (basis: Art. 6(1)(a) GDPR and consent to storing data on your device). Until you consent, the scripts of these tools are not downloaded and your browser does not connect to their servers. Withdrawing consent takes effect from the next page load.

Statistics: anonymous visit statistics, so that we know what to improve in the shop. We do not use them for advertising, and the site has no advertising pixels.

Live chat: the Chateo chat, where we answer questions about printing. Only after you consent does your browser load the chat from app.chateo.pl and connect to Chateo servers. Chateo processes the messages you type and the technical data needed to display the chat (IP address, browser data), and may store its own chat data in browser storage (localStorage). You may voluntarily enter personal data in a message. The chat is optional: you do not need to enable it to buy.

Passing the cart to the print shop

When you click through to the cart, the list of products with the chosen options and quantities reaches our server and from there goes to the print shop PROMEDIA.PL. The payload contains no prices. The basis is steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

From then on the order, file upload, payment and invoice happen in the print shop's cart. The print shop is then the controller of the order data. Its privacy policy describes the purposes and legal bases of processing, retention periods, the recipients of the data and the cookies used in the cart.

Recipients of data

Server logs are handled by the hosting provider. The site is delivered and protected by Cloudflare, Inc. (USA) as a CDN and for protection against abuse (processor): it receives the IP address and request data and, after a browser check, may set a necessary security cookie. Data may be processed outside the EEA on the basis of the EU-US Data Privacy Framework or the standard contractual clauses in Cloudflare's data processing addendum; retention periods are set by Cloudflare in line with its policies. Public authorities may also receive data to the extent the law obliges us. We do not sell data.

If you enable live chat, the recipient of the conversation content is the provider of the Chateo tool (app.chateo.pl).

Your rights

You have the right to request:

  • access to your data and its rectification
  • erasure of data or restriction of its processing
  • transfer of data to another controller
  • objection to processing based on our legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation
  • a complaint to a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO)

Contact

Questions about personal data and exercising your rights: info@xdruk.eu.