Last updated: 2026-07-29
1. Data controller
The controller of your personal data is Pepto Medica (TODO(legal): full company name, registered address, tax id).
Data protection contact: kontakt@pepto-medica.com.
2. What we collect
Order form: first name, last name, e-mail address, phone number, InPost parcel locker code, the ordered products with quantities, and an optional note.
Technical data: a salted one-way hash of your IP address (SHA-256) and your browser user-agent string. We do not store IP addresses in clear text.
We do not collect health data or any other special-category data. Please do not put such information in the notes field.
3. Purposes and legal bases
Handling your request and performing the sale contract — art. 6(1)(b) GDPR, including steps taken at your request prior to entering into a contract.
Contacting you by phone about the order and preventing abuse and spam — art. 6(1)(f) GDPR, the controller's legitimate interest.
Compliance with legal obligations, including accounting and tax obligations where they arise — art. 6(1)(c) GDPR.
4. Recipients
Vercel Inc. — hosting and content delivery.
Neon — managed database, European Union region.
InPost S.A. — delivery operator; data is transferred only when the parcel is dispatched.
Locker codes are verified against InPost's public point registry. The request is made by our server, not your browser — your IP address is not disclosed to InPost at that stage.
5. Retention
Order data is kept for 3 years after the order is completed (the limitation period for claims), then anonymised: name, e-mail, phone and locker code are removed and only statistical data is retained.
If an order is cancelled before fulfilment, the data is deleted within 90 days.
6. Your rights
You have the right to access, rectify, erase, restrict processing of and port your data, and to object to processing based on legitimate interest.
To exercise these rights, write to kontakt@pepto-medica.com. We respond within one month.
You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO, ul. Stawki 2, 00-193 Warsaw).
7. Is providing data mandatory
Providing your data is voluntary but necessary for us to accept and fulfil an order. Without an e-mail address and a phone number we cannot confirm product availability or dispatch a parcel to a locker.
8. Cookies
We use cookies strictly necessary for the site to work (the light/dark theme preference and the admin panel session). These do not require consent.
We do not use marketing cookies or profiling.
9. Automated decision-making
We do not make automated decisions about you, including profiling.
10. User accounts
Access to the site's content may require a free account. To create one you provide an e-mail address and a password, and optionally a name. The password is stored only as a one-way hash (scrypt) — we do not know it and cannot read it. We also record the date you accepted the terms and the date of your last sign-in.
The e-mail address is not verified and is used only to sign in. We send no messages to it.
Purpose and legal basis: providing access to the site's content (Art. 6(1)(b) GDPR — performance of a contract for an electronically supplied service) and protection against abuse (Art. 6(1)(f) GDPR — legitimate interest). For the latter we keep, for at most 60 minutes, a one-way hash of the IP address from which sign-in or registration attempts were made.
Retention: until the account is deleted. We delete an account on your request sent to the contact address in section 1. Account data is not shared with anyone.
A signed-in session is kept by a cookie strictly necessary for the service (HttpOnly, valid for 30 days), which does not require consent.