Updated: 8 October 2026.
Privacy Policy of Gymiosport.com Store
Dear User!
Welcome to Gymiosport.com! We care about your privacy, so we make every effort to ensure you feel safe while using our services. This document contains key information about the processing of your personal data and the use of cookies on our site. The policy was developed with GDPR - General Data Protection Regulation in mind.
Privacy Policy Contents:
§ 1 Personal Data Administrator
§ 2 Your Rights
§ 3 Personal Data and Privacy
§ 4 Data Publishing
§ 5 Analytics, advertising measurement and external media
§ 6 Data Security
§ 7 Cookies
§ 8 External Services / Data Recipients
§ 9 Transfers outside the European Economic Area
§ 1 Personal Data Administrator
The Personal Data Administrator of the Store's Customers is Kraina OZE sp. z o.o., registered at the address: ul. Żmigrodzka 242D, 51-131 Wrocław, registered in the National Court Register by the District Court for Wrocław-Fabryczna, VI Commercial Division of the National Court Register under number 0000765577, VAT ID: 8952198367, REGON: 381975143, share capital: 260,000 PLN.
If you want to contact us regarding the processing of your personal data, write to us at the email address: gymio@gymiosport.com.
§ 2 Your Rights
You have the right to request:
- access to your personal data, including receiving a copy of your data (Article 15 GDPR),
- rectification of data (Article 16 GDPR),
- erasure of data (Article 17 GDPR),
- restriction of processing (Article 18 GDPR),
- portability of data to another controller (Article 20 GDPR).
You also have the right to:
- object at any time to the processing of your data:
- for reasons related to your particular situation - against the processing of personal data concerning you, based on Article 6(1)(f) GDPR (i.e., on legitimate interests pursued by us) (Article 21(1) GDPR);
- if personal data are processed for direct marketing purposes, to the extent that the processing is related to such direct marketing (Article 21(2) GDPR).
- withdraw consent to the processing of data at any time,
Contact us to exercise your rights. You can change or withdraw consent for optional tools through “Cookie settings” in the footer.
If you believe that your data is being processed unlawfully, you can file a complaint with the President of the Personal Data Protection Office.
§ 3 Personal Data and Privacy
Below, you will find detailed information about the processing of your data, depending on the actions you take.
1. Placing an Order in the Store
| For what purpose? | |
| To fulfill your order | |
| On what basis? | |
| Sale agreement (Article 6(1)(b) GDPR) | Legal obligation related to accounting, requiring us to process your personal data (Article 6(1)(c) GDPR) |
| How long? | |
For the duration of the above-mentioned agreement | Until the expiration of the legal obligation related to accounting that rests on us |
| Additionally, your data will be processed until the expiry of the period in which claims can be pursued - by you or by us (more information on this can be found in the last table of this section) | |
| What happens if you do not provide the data? | |
| You will not be able to place an order | |
2. Creating an Account (registration) in the Store
| For what purpose? |
| Fulfillment of the agreement for providing the account management service in the Store |
| On what basis? |
| Service provision agreement (Article 6(1)(b) GDPR) |
| How long? |
| Until the account is deleted by you or by us upon your request |
| Additionally, your data will be processed until the expiry of the period in which claims can be pursued - by you or by us (more information on this can be found in the last table of this section) |
| What happens if you do not provide the data? |
| You will not be able to create an account and use its features, such as viewing order history or checking order status. |
3. Contacting us (e.g., to ask a question)
| For what purpose? | |
| Handling your inquiries or reports | |
| On what basis? | |
| Agreement or actions taken at your request, aimed at concluding it (Article 6(1)(b) GDPR) – in case your inquiry or report concerns a contract to which we are or may be a party | Our legitimate interest, which involves processing your data for the purpose of communicating with you (Article 6(1)(f) GDPR) – if your inquiry or report is not related to a contract |
| How long? | |
| For the duration of the agreement binding us or – if the contract is not concluded - until the expiry of the period for pursuing claims – see the last table of this section* | Until the expiry of the period for pursuing claims – see the last table of this section - or until we consider your objection to processing* |
| Additionally, your data will be processed until the expiry of the period in which claims can be pursued - by you or by us (more information on this can be found in the last table of this section) | |
| What happens if you do not provide the data? | |
| We will not be able to respond to your inquiry or report | |
* Depending on which is applicable in a given case and which occurs first
4. Consent to analytics and advertising measurement
Optional analytics and marketing operate on the basis of your consent (Article 6(1)(a) GDPR), given separately for each category in the cookie settings. Details of purposes, data, providers and retention are in § 5–7. You may withdraw consent at any time in the footer; refusing does not restrict purchases or account use.
5. Newsletter and marketing messages
We do not currently send a newsletter. If we launch this service, we will provide its terms, sender, purposes and unsubscribe method before signup and obtain the required consent for the selected communication channel. Marketing processing will be based on consent (Article 6(1)(a) GDPR) until consent is withdrawn or the service ends. Each marketing message will offer a simple unsubscribe option; you will also be able to contact gymio@gymiosport.com. Evidence of consent or withdrawal may be retained as needed for accountability and legal claims.
Purchasing, creating an account, contacting us through a form, reading the blog or accepting cookies does not give consent to newsletters or email advertising. Refusal does not affect order handling. Messages necessary to perform the contract or operate an account, such as order confirmations and password resets, have a separate purpose and are not newsletters.
6. Taking action or omitting actions that may lead to the emergence of claims related to the Store or our services.
| For what purpose? |
| Establishing, pursuing, or defending potential claims related to the concluded contract or provided services |
| On what basis? |
| Our legitimate interest, consisting of the processing of personal data for the purpose indicated above (Article 6(1)(f) of the GDPR) |
| How long? |
| Until the expiry of the limitation period for claims or until we consider your objection to processing* |
| What happens if you do not provide the data? |
| The inability to establish, pursue, or defend claims |
* Depending on which is applicable in a given case and which occurs first
§ 4 Publishing Data
If you decide to publish a comment, its content and your signature will be visible to other users of the Store.
We do not disclose your email address to other users – unless you do it yourself.
§ 5 Analytics, advertising measurement and external media
You decide whether to use optional tools in “Cookie settings”, also available in the footer. Analytics, marketing and external media have separate consent options. Refusing consent does not prevent purchases or account use. We process data for these purposes on the basis of your consent (Article 6(1)(a) GDPR). Browsing the website alone does not constitute consent.
Analytics — Google Analytics 4 and Google Tag Manager
With analytics consent, we use Google Analytics 4 through Google Tag Manager. We measure pages visited, traffic sources and campaigns, interactions with products, the cart and checkout form, and purchases. Data may include browser and session identifiers, technical device information, product identifiers, quantities, prices, currency, coupons and a transaction identifier. A confirmed purchase may also be sent from our server if valid analytics consent and the required identifier were recorded for the order. We do not send contact form contents, passwords or order address details as Google event parameters.
The GA4 user and event data retention setting is 2 months; this is separate from cookie expiry and does not cover all aggregated Google reports. See the Google Privacy Policy and Google's information about measurement tools.
Marketing — Meta Pixel
With marketing consent, we activate Meta Pixel to measure advertising effectiveness and tailor advertising to interests. Data recipients include Meta Platforms Ireland Limited and entities involved in providing Meta services. The Pixel reports page and product views, additions to the cart, checkout initiation and confirmed purchases. Data may include the visited page address, browser and device information, IP address, cookie and ad-click identifiers, and event details such as product, quantity, value and currency. Meta may associate this information with your Facebook or Instagram account and use it for measurement and personalised advertising.
Our configuration does not enable automatic matching based on email addresses or phone numbers entered in forms. Conversions API, which sends Meta events directly from the server, is not currently enabled. Meta does not act solely on our instructions: collection and transmission of business tool data to Meta are subject to joint controller arrangements, and Meta's subsequent processing is governed by its policies. See the Meta Privacy Policy, Meta Cookies Policy and Controller Addendum for details and how to exercise your rights. You may also contact us about our part in the processing.
External media — YouTube
YouTube videos load after external media consent. Your browser then connects to Google, which receives technical connection data and may store identifiers under its privacy policy. Without consent, we show a notice allowing you to change your settings instead of loading the player.
§ 6 Data security and form protection
We use encrypted HTTPS connections and access controls. We protect forms against automated submissions using Cloudflare Turnstile, attempt limits and session checks. Cloudflare, Inc. may process your IP address, browser and device information, and data needed to assess whether a request comes from a human. This protection operates independently of analytics and marketing consent. Its purpose is website security, and our basis for processing personal data is our legitimate interest (Article 6(1)(f) GDPR). See the Cloudflare Privacy Policy.
§ 7 Cookies and browser storage
Cookies store information on your device. We also use localStorage and sessionStorage. Necessary mechanisms support sessions, login, the cart, favourites, form protection and consent choices. Optional tools start only after the relevant category is accepted.
| Name / mechanism | Purpose and category | Duration |
|---|---|---|
| gymio_local | Store session identifier — necessary. | Session cookie; session persistence may depend on browser settings. |
| gymio_consent | Remembers consent choices — necessary. | 180 days, unless choices change or renewed consent is required. |
| gymio-consent-change (localStorage) | Notifies other tabs of changed consent — necessary. | Until overwritten or browser storage is cleared. |
| _ga, _ga_* | Distinguishes browsers and sessions in GA4 — analytics. | Up to 2 years by default; browsers may shorten this period. |
| gymio-funnel:* (sessionStorage) | Limits repeated measurement events — analytics. | Until the tab session ends; removed by the script when analytics consent is withdrawn. |
| _fbp, _fbc | Meta ad measurement; _fbc relates to an ad-click identifier — marketing. | Usually up to 3 months, subject to tool behaviour and browser restrictions. |
After an external player or tool starts, its provider may also use storage mechanisms described in the linked policies. The administration panel stores selected display preferences locally to retain them between visits. These preferences are not used for advertising measurement.
You can change consent at any time using “Cookie settings” in the footer, including “Reject optional”. Withdrawal is as accessible as giving consent and does not affect the lawfulness of earlier processing. Our script stops the relevant tools and removes known analytics and Meta cookies that it can access; the page may reload. This does not automatically erase data already sent to providers. Contact us or the relevant provider to exercise your right to erasure. You can also manage cookies and storage in your browser settings. Blocking necessary cookies may prevent login or cart use.
§ 8 External services and data recipients
We disclose data as needed to provide the selected service. Technical providers may process data on our behalf, while payment operators, carriers and online platforms may also act as independent controllers. Not all recipients process data solely on our instructions.
- Hosting: webh.pl (ultimahost.pl Szeliga sp. j.) — hosting the application and store data.
- Email and communication: Google services — operating the store mailbox and correspondence, including order confirmations, account activation, password resets and contact forms.
- Orders and documents: Base (BaseLinker), the InsERT software we use and the SellIntegro integration — order and document handling and synchronisation. Using local software does not itself mean that all data is sent to its manufacturer; provider access depends on the services supplied.
- Payments: mBank S.A. (Paynow) and PayU S.A., according to the selected payment method.
- Delivery: the carrier handling the selected delivery receives data needed to deliver the parcel; this does not apply to personal collection.
- Accounting: Ekonomicus BR Sp. z o.o. — accounting documents.
- Analytics and media: Google Ireland Limited / Google LLC and the entities providing the relevant Google service — GA4, Google Tag Manager and YouTube, according to the consent described in § 5.
- Advertising measurement: Meta Platforms Ireland Limited and Meta entities, after marketing consent, as described in § 5.
- Form protection: Cloudflare, Inc. — Turnstile, as described in § 6.
Data may be disclosed to authorised public authorities where required by law. A review you publish and its display name are visible to visitors; the store does not publish your email address. An invitation to review a purchased product concerns your purchase and does not subscribe you to a newsletter.
§ 9 Transfers outside the European Economic Area
Google, Meta and Cloudflare services may involve processing outside the EEA, including in the United States. The transfer basis depends on the service and recipient: it may be an applicable European Commission adequacy decision (Article 45 GDPR; for the United States, for recipients covered by the relevant certification) or standard contractual clauses and required supplementary safeguards (Article 46 GDPR). Details are described in the provider documents linked above. Contact gymio@gymiosport.com for information on safeguards applicable to our services and how to obtain a copy.