Last updated: 2026-07-29
1. Data controller
The controller of your personal data is Pepto Medica (TODO(legal): full company name, registered address, tax id).
Data protection contact: kontakt@pepto-medica.com.
2. What we collect
Order form: first name, last name, e-mail address, phone number, InPost parcel locker code, the ordered products with quantities, and an optional note.
Technical data: a salted one-way hash of your IP address (SHA-256) and your browser user-agent string. We do not store IP addresses in clear text.
We do not collect health data or any other special-category data. Please do not put such information in the notes field.
3. Purposes and legal bases
Handling your request and performing the sale contract — art. 6(1)(b) GDPR, including steps taken at your request prior to entering into a contract.
Contacting you by phone about the order and preventing abuse and spam — art. 6(1)(f) GDPR, the controller's legitimate interest.
Compliance with legal obligations, including accounting and tax obligations where they arise — art. 6(1)(c) GDPR.
4. Recipients
Vercel Inc. — hosting and content delivery.
Neon — managed database, European Union region.
InPost S.A. — delivery operator; data is transferred only when the parcel is dispatched.
Locker codes are verified against InPost's public point registry. The request is made by our server, not your browser — your IP address is not disclosed to InPost at that stage.
5. Retention
Order data is kept for 3 years after the order is completed (the limitation period for claims), then anonymised: name, e-mail, phone and locker code are removed and only statistical data is retained.
If an order is cancelled before fulfilment, the data is deleted within 90 days.
6. Your rights
You have the right to access, rectify, erase, restrict processing of and port your data, and to object to processing based on legitimate interest.
To exercise these rights, write to kontakt@pepto-medica.com. We respond within one month.
You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO, ul. Stawki 2, 00-193 Warsaw).
7. Is providing data mandatory
Providing your data is voluntary but necessary for us to accept and fulfil an order. Without an e-mail address and a phone number we cannot confirm product availability or dispatch a parcel to a locker.
8. Cookies
We use cookies strictly necessary for the site to work (the light/dark theme preference and the admin panel session). These do not require consent.
We do not use marketing cookies or profiling.
9. Automated decision-making
We do not make automated decisions about you, including profiling.