Privacy policy

1. Data Controller and definitions

1. The controller of the personal data of Customers / Users of the Online Store, also referred to as the Seller, is: Multica Group Sp. z o.o., telephone: +48 797 440 961, NIP (tax identification number): 5361958098, REGON (statistical number): 520388875.
2. The Data Controller may be contacted:
   1. at the postal address: Okunin 21, 05-100 Nowy Dwór Mazowiecki;
   2. at the e-mail address: sklep@vetfactory.pl.
3. User - a natural person visiting the website of the Online Store or using the services or functionalities described in this Privacy and Cookie Policy.
4. Customer - a natural person with full legal capacity, a natural person who is a Consumer, a legal person or an organisational unit without legal personality to which the law grants legal capacity, who concludes a distance sales contract with the Seller.
5. Online Store - the website operated by the Seller, available at the electronic address (website): https://vetfactory.pl, through which the Customer/User may obtain information about the Goods and their availability and may purchase the Goods or order the provision of a service.
6. Newsletter - information, including commercial information within the meaning of the Act of 18 July 2002 on the Provision of Services by Electronic Means (ustawa o świadczeniu usług drogą elektroniczną), Journal of Laws 2024, item 1513, originating from the Seller and sent to the Customer/User by electronic means; receiving it is voluntary and requires the consent of the Customer/User.
7. Account - a set of data stored in the Online Store and in the Seller's ICT system concerning a given Customer/User and the orders placed and contracts concluded by them, by means of which the Customer/User may place orders and conclude contracts.
8. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2. Purposes, legal bases and period of data processing

1. For the purpose of performing a distance sales contract, the Seller processes:
   1. information concerning the User's device in order to ensure the correct operation of the services: the IP address of the computer, information contained in cookies or other similar technologies, session data, internet browser data, device data, data concerning activity on the Website, including on individual subpages;
   2. information on approximate location: the Store determines the User's approximate country on the basis of the IP address in order to select the currency and language and to display the consent banner; the Store does not collect precise location;
   3. the personal data of Users: first name, surname, registered office address, correspondence address, e-mail address, telephone number, NIP (tax identification number), bank account number or other personal data the provision of which is necessary to complete a purchase and the provision of which in the purchasing process is required by the Controller.
2. This information does not contain data concerning the identity of Users, but in combination with other information it may constitute personal data, and therefore the Controller affords it the full protection provided for under the GDPR.
3. This data is processed in accordance with Article 6(1)(b) GDPR, for the purpose of providing the service, i.e. the contract for the provision of services by electronic means in accordance with the Terms and Conditions, and in accordance with Article 6(1)(a) GDPR, in connection with consent to the use of specific cookies or other similar technologies, expressed by an active choice in the cookie notice (banner) in accordance with the Act of 12 July 2024 - Electronic Communications Law (ustawa Prawo komunikacji elektronicznej), Journal of Laws 2024, item 1221. The data is processed until the Customer/User ceases to use the Online Store.
4. The Controller undertakes to take all measures required under Article 32 GDPR, i.e. taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

3. Marketing activities of the Controller

1. On the website of the Online Store, the Data Controller may post marketing information about its products or services. These contents are displayed by the Data Controller in accordance with Article 6(1)(f) GDPR, i.e. in accordance with the legitimate interest of the Data Controller consisting in publishing content related to the services provided and content relating to promotional campaigns in which the Data Controller is involved. At the same time, this activity does not infringe the rights and freedoms of Customers/Users; Customers/Users expect to receive content of a similar nature, or even expect it, or it is the direct purpose of their visit to the website(s) of the Online Store.

4. Recipients of Users' data

1. The Data Controller discloses Users' personal data exclusively to processors under concluded personal data processing agreements, for the purpose of providing services to the Data Controller, e.g. hosting and operation of the Website (Shopify International Limited, with its registered office at: Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, the provider of the Shopify platform on which the Online Store operates), IT services, marketing and PR services, and GetResponse S.A., with its registered office in Gdańsk, the tool used for sending the Newsletter.

5. Transfer of personal data to third countries

1. Personal data may be transferred to third countries, i.e. outside the European Economic Area, in particular to Canada and the United States, in connection with the use of the services of Shopify and of the providers of plug-ins and payments listed in section 10. The basis for the transfer of data is the decision of the European Commission finding an adequate level of protection of personal data in Canada, and the standard contractual clauses concluded with Shopify.

6. Rights of data subjects

1. Every data subject has the right to:
   1. access (Article 15 GDPR) - to obtain from the Data Controller confirmation as to whether personal data concerning them is being processed. Where data concerning a person is being processed, that person is entitled to obtain access to it and to obtain the following information: on the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data has been or will be disclosed, the period for which the data will be stored or the criteria used to determine that period, the existence of the right of the data subject to request rectification, erasure or restriction of processing of personal data and to object to such processing;
   2. receive a copy of the data (Article 15(3) GDPR) - to obtain a copy of the data undergoing processing, whereby the first copy is free of charge and for any further copies the Data Controller may charge a reasonable fee based on administrative costs;
   3. rectification (Article 16 GDPR) - to request the rectification of personal data concerning them which is inaccurate, or the completion of incomplete data;
   4. erasure of data (Article 17 GDPR) - to request the erasure of their personal data where the Data Controller no longer has a legal basis for processing it or the data is no longer necessary for the purposes of processing;
   5. restriction of processing (Article 18 GDPR) - to request the restriction of the processing of personal data where:
      1. the data subject contests the accuracy of the personal data - for a period enabling the Data Controller to verify the accuracy of that data,
      2. the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of its use instead,
      3. the Data Controller no longer needs the data, but it is required by the data subject for the establishment, exercise or defence of legal claims,
      4. the data subject has objected to processing - pending the verification whether the legitimate grounds of the controller override the grounds of the data subject;
   6. data portability (Article 20 GDPR) - to receive the personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used and machine-readable format, and to request that this data be transmitted to another controller, where the data is processed on the basis of the consent of the data subject or a contract concluded with them and where the data is processed by automated means;
   7. object (Article 21 GDPR) - to object to the processing of their personal data for the legitimate purposes of the controller, on grounds relating to their particular situation, including to profiling. The Data Controller then assesses the existence of compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subjects, or of grounds for the establishment, exercise or defence of legal claims. If, according to the assessment, the interests of the data subject prove more important than the interests of the controller, the Data Controller will be obliged to cease processing the data for those purposes;
   8. withdraw consent at any time and without giving a reason, but the processing of personal data carried out before the withdrawal of consent will remain lawful. The withdrawal of consent will result in the Data Controller ceasing to process personal data for the purpose for which that consent was given.
2. In order to exercise the above rights, the data subject should contact the Data Controller using the contact details provided and inform it which right they wish to exercise and to what extent.

7. President of the Personal Data Protection Office

1. The data subject has the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), with its registered office in Warsaw, ul. Stanisława Moniuszki 1A, which may be contacted as follows:
2. by post: ul. Stanisława Moniuszki 1A, 00-014 Warsaw;
3. via the electronic submission box available on the website: https://www.uodo.gov.pl/pl/p/kontakt;
4. Helpline: 606-950-000.

8. Contact in matters concerning personal data

1. In matters concerning the processing of personal data, the data subject may contact the Controller by e-mail at sklep@vetfactory.pl or in writing at the Controller's registered office address: Multica Group Sp. z o.o., Okunin 21, 05-100 Nowy Dwór Mazowiecki.

9. Changes to the Privacy Policy

1. The Privacy and Cookie Policy may be supplemented or updated in line with the current needs of the Controller in order to provide Customers/Users with up-to-date and reliable information.
2. This Privacy and Cookie Policy is effective from 30 October 2026.

10. Cookies

1. The Online Store obtains information about Customers, Users and their behaviour in the following ways:
   1. through information voluntarily entered in forms, for the purposes resulting from the function of a given form;
   2. by saving cookies (so-called "cookies") on end devices;
   3. by collecting web server logs by the provider of the Online Store platform (Shopify International Limited) (necessary for the correct operation of the website).
2. Cookies are computer data, in particular text files, which are stored on the end device of the Customer / User and are intended for the use of the Online Store website. Cookies usually contain the name of the website from which they originate, the time for which they are stored on the end device and a unique number.
3. The Online Store uses cookies only after the Customer/User of the Store has given prior consent in this respect. Consent to the use of cookies by the Online Store is expressed exclusively by an active choice of the user in the cookie notice displayed in the Online Store: acceptance of all cookies, rejection, or selection of categories in the preference settings (Articles 399-400 of the Electronic Communications Law). Analytics and advertising tools and the cookies associated with them are launched only after consent has been given. Consent may be changed at any time by reopening the cookie settings.
4. If the Customer/User of the Online Store does not consent to the use of cookies by the Online Store, they may reject cookies in the cookie notice displayed by the Online Store or change the settings of the internet browser they are currently using (this may, however, cause the website of the Online Store to function incorrectly).
5. In order to manage cookie settings, select the internet browser/system from the list and follow the instructions: Internet Explorer, Chrome, Safari, Firefox, Opera, Android, Safari (iOS), Windows Phone.
6. The legal basis for the processing of personal data originating from cookies is the legitimate interests of the Data Controller, consisting in ensuring high-quality services and the security of the services.
7. Two basic types of cookies are used within the Online Store: "session" cookies and "persistent" cookies. "Session" cookies are temporary files which are stored on the User's end device until logging out, leaving the Online Store or switching off the software (internet browser). "Persistent" cookies are stored on the end device of the Customer/User for the time specified in the cookie parameters or until they are deleted by the Customer/User.

Cookies used in the Online Store

Necessary and functional cookies (Shopify)

The Shopify platform on which the Online Store operates uses necessary and functional cookies which enable the operation of the cart, the session, the checkout, and the remembering of consents and location (country, currency and language). The current list of these cookies, together with their retention periods, is available at: https://www.shopify.com/legal/cookies.

Analytics and marketing cookies (only after consent has been given)

The analytics and marketing tools Google Analytics, Google Ads and Meta Pixel (Meta) are launched only after consent has been given in the cookie notice.

Google

Name	Retention period	Description
NID	180 days	These cookies (NID, ENID) are used to remember the user's preferences and other information, such as the preferred language, the number of results to be displayed on a search results page (for example 10 or 20) and whether the user wants the Google SafeSearch filter to be enabled. This cookie is also necessary for offering the Google Pay payment service.

Google Ads

Name	Retention period	Description
_gcl_au	90 days	Used by Google AdSense to experiment with advertising efficiency across websites using its services.
FPAU	90 days	A cookie in which information about users and their activity on the website is collected through embedded elements, for analytics and reporting purposes.
FPGCLAW	90 days	Contains campaign-related information about the user.
FPGCLGB	90 days	Contains campaign-related information about the user.
_gcl_gb	90 days	Contains campaign-related information about the user.
_gac_gb_<>	90 days	Contains campaign-related information about the user.
_gcl_aw	90 days	Contains campaign-related information about the user.
IDE	730 days	This cookie is used to display Google ads on websites other than Google.
1P_JAR	30 days	This cookie is used to collect website statistics and track conversion rates. It sets a unique identifier in order to remember your preferences and other information, such as website statistics and conversion rate tracking.
test_cookie	1 days	Used to check whether the permissions to set cookies in the user's browser are enabled.
AEC	138 days	These cookies prevent malicious websites from acting on behalf of the user without the user's knowledge.
APISID	193 days	This cookie is stored on the computer in order to remain connected to the Google account when revisiting its services. While remaining in this active session and using add-ons on other websites, such as ours, Google will use these cookies to improve the user experience.
CONSENT	559 days	This cookie is stored on the computer in order to remain connected to the Google account when revisiting its services. While remaining in this active session and using add-ons on other websites, such as ours, Google will use these cookies to improve the user experience.
DSID	10 days	The 'DSID' cookie is used to identify a logged-in user on websites other than Google and to remember whether the user has consented to ad personalisation.
OTZ	23 days	This cookie is used to remember the user's preferences and other information, such as the preferred language, the number of results to be displayed on a search results page (for example 10 or 20) and whether the user wants the Google SafeSearch filter to be enabled.
SAPISID	28 days	This cookie is stored on the computer in order to remain connected to the Google account when revisiting its services. While remaining in this active session and using add-ons on other websites, such as ours, Google will use these cookies to improve the user experience.
SEARCH_SAMESITE	176 days	Allows servers to mitigate the risk of CSRF attacks and information leakage by ensuring that a given cookie should be sent only with requests initiated from the same registered domain.
SIDCC	393 days	Retrieves certain tools from Google and saves preferences, for example the number of search results per sheet or the activation of the SafeSearch filter. Adjusts the advertisements appearing in the Google search engine.
SSID	393 days	This cookie is stored on the computer in order to remain connected to the Google account when revisiting its services. While remaining in this active session and using add-ons on other websites, such as ours, Google will use these cookies to improve the user experience.
__Secure-*	730 days	These cookies are used to deliver advertisements better tailored to the user and their interests.

Meta (Meta Pixel)

Meta Pixel sets cookies used to measure the effectiveness of advertisements and to tailor advertisements; details are available at: https://www.facebook.com/privacy/policies/cookies/.

1. Cookies are used for the following purposes:
   1. creating statistics which help to understand how Customers/Users of the Online Store use the websites, which makes it possible to improve their structure and content;
   2. maintaining the session of the Customer/User (after logging in), thanks to which the Customer/User does not have to log in again on every subpage of the Online Store;
   3. determining the profile of the Customer/User in order to display product recommendations and tailored materials to them in advertising networks, in particular the Google network.
2. Software for browsing websites (internet browser) usually allows the storage of cookies on the end device of the Customer/User by default. Customers/Users may change the settings in this respect. The internet browser makes it possible to delete cookies. It is also possible to block cookies automatically.
3. Restrictions on the use of cookies may affect some of the functionalities available on the websites of the Online Store.
4. Cookies placed on the end device of the Customer/User may also be used by advertisers and partners of the Online Store cooperating with the Online Store.
5. Cookies may be used by the Google network to display advertisements tailored to the way in which the Customer/User uses the Online Store. For this purpose, they may retain information about the user's navigation path or the time spent on a given page: https://policies.google.com/technologies/partner-sites.
6. We recommend that the Customer/User read the privacy policies of these companies in order to learn the rules for the use of cookies used in statistics: Google Analytics Privacy Policy.
7. With regard to information on the preferences of the Customer/User collected by the Google advertising network, the Customer/User may view and edit the information resulting from cookies using the following tool: https://www.google.com/ads/preferences/.
8. Plug-ins are placed on the website of the Online Store which may transfer the data of Customers/Users to Controllers such as, for example: Shopify International Limited (the provider of the Online Store platform), Shopify Payments (the operator of card, BLIK and wallet payments within Shopify Payments is Stripe Payments Europe, Limited, Ireland), PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), Klarna (Klarna Bank AB (publ), Stockholm), Judge.me (an application for collecting and publishing reviews), GetResponse (GetResponse S.A., Gdańsk; sending of the newsletter), InPost (delivery and returns) and Google (Google Analytics, Google Ads) and Meta (Meta Pixel) - the latter two only after consent has been given.
9. For the correct performance of the distance sales contract, the Data Controller may share the data of Customers/Users with courier companies. The currently available delivery methods in the Online Store are available at: https://vetfactory.pl/policies/shipping-policy.
10. For the correct performance of the distance sales contract, the Controller may share the data of Customers/Users with online payment systems, i.e. Shopify Payments (the operator of card, BLIK and wallet payments within Shopify Payments is Stripe Payments Europe, Limited, Ireland), Klarna (Klarna Bank AB (publ), Stockholm) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). The currently available payment methods are described in the Terms and Conditions (§ 4), available at: https://vetfactory.pl/policies/terms-of-service.
11. More information on terms and privacy can also be found on the website Google Privacy and Terms.

11. Newsletter

1. The Customer may consent to receiving commercial information by electronic means by subscribing to the Newsletter using the form placed in the footer of the Online Store. If such consent is given, the Customer/User will receive at the e-mail address they have provided information (the Newsletter) of the Online Store, as well as other commercial information sent by the Seller.
2. The Newsletter is sent using the GetResponse tool, provided by GetResponse S.A., with its registered office in Gdańsk, which processes data (the e-mail address) on behalf of the Controller for the purpose of sending the Newsletter.
3. The Customer may unsubscribe from receiving the Newsletter at any time on their own, by clicking the relevant link contained in the body of each Newsletter message, or through the Customer Service Office.

12. Account

1. The Customer/User may not post in the Online Store or deliver to the Seller content, including reviews and other data, of an unlawful nature.
2. The Customer/User obtains access to the Account after registration.
3. Logging in to the Account is passwordless - by means of a one-time code sent to the e-mail address provided by the Customer/User.
4. As part of registration, the Customer / User provides an e-mail address to which a one-time login code is sent. The remaining data (first name, surname, company name, NIP (tax identification number), data for issuing a sales document, shipping data) the Customer / User provides when placing an order. The Customer/User warrants that the data provided by them at registration and when placing an order is true. The Customer/User accepts the Terms and Conditions by placing an order; the link to the Terms and Conditions is available at the checkout and in the footer of the Store.
5. At the moment the Customer/User is given access to the Account, a contract for the provision of services by electronic means concerning the Account is concluded between the Seller and the Customer for an indefinite period. The Consumer may withdraw from this contract on the terms set out in the Terms and Conditions.
6. The Customer/User may terminate the contract for the provision of services by electronic means at any time with immediate effect, by informing the Seller thereof by e-mail or in writing at the address of the Data Controller, given in section 1 point 2 of this Privacy and Cookie Policy.
7. The Seller has the right to terminate the contract for the provision of services concerning the Account in the event of ceasing to provide or transferring the service of the Online Store to a third party, infringement of the law or of the provisions of the Terms and Conditions by the Customer/User, and also in the event of the Customer/User's inactivity for a period of 6 months. The termination takes effect subject to a seven-day notice period. The Seller may stipulate that re-registration of the Account will require the Seller's permission.