1. Who is the controller of your data
The controller of your personal data is Lobos Energy sp. z o.o. with its registered office in Kraków (ul. Mieczysława Medweckiego 17, 31-870 Kraków, Poland), entered in the register of entrepreneurs of the National Court Register under KRS number 0000953828, NIP 6751761487, REGON 521228286 ("we"). In matters concerning personal data, you can write to contact@lobosbags.com, call +48 502 264 158 or send a letter to our registered office.
Capitalized terms have the meaning given to them in the Store Terms and Conditions. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council, and "PKE" means the Polish Electronic Communications Law of 12 July 2024.
2. Why we process data, on what basis and for how long
| Purpose | Legal basis | How long |
|---|---|---|
| Concluding and performing a contract, including maintaining the Account and other Store services you request | Article 6(1)(b) GDPR | until the contract or service has been performed; Account data – until the Account is deleted |
| Handling enquiries, including via chat and on social media | Article 6(1)(f) GDPR and, where the enquiry concerns a contract, point (b) | until the matter is closed, and then until claims become time-barred |
| Legal obligations, including tax and accounting obligations and those related to returns and complaints | Article 6(1)(c) GDPR | as long as the law requires; accounting documents – 5 years from the end of the year in which the tax payment deadline expired |
| Return and complaint requests submitted through the form in the Store, including the bank account number for the refund and photos attached to a complaint | Article 6(1)(b) and (c) GDPR; protecting the form against abuse (IP address, number of attempts) – Article 6(1)(f) GDPR | form session and security data – 24 hours; the bank account number and the account holder's details – 30 days after the return is completed; photos attached to a complaint – until the complaint is closed, and then until claims become time-barred; other request data – 24 months, after which the request keeps only data not related to a person (request and order number, dates, items, amounts) |
| Establishing, pursuing and defending claims, including proving consents and their withdrawal | Article 6(1)(f) GDPR | until claims become time-barred |
| Marketing and analytics: newsletter, advertising and statistics using cookies, including tailoring content to your purchases and activity (profiling) | consent: Article 6(1)(a) GDPR; for emails also Article 398 PKE, and for cookies – Article 399 PKE | until consent is withdrawn |
| Publishing reviews and checking whether they come from buyers | Article 6(1)(f) GDPR | until the review is deleted |
| Store security and fraud prevention | Article 6(1)(f) GDPR | as long as we store the data concerned |
| Running our social media profiles | Article 6(1)(f) GDPR | until the comment or message is deleted |
| Business contacts | Article 6(1)(f) GDPR | for the duration of the cooperation, then until claims become time-barred |
Where the legal basis is Article 6(1)(f) GDPR, our legitimate interest is the purpose described in the given row; in that case, you can object (section 6).
We receive some data from other persons or entities: from the person placing the order (details of the parcel recipient or of the Gift Card recipient), from payment operators and carriers (information about payment and delivery) and from social media operators (name and public profile data).
3. Who we share data with
We share data only to the extent necessary for the purposes in section 2. The recipients of data include, in particular:
- store and payments: Shopify (Store platform, checkout, Account, emails, Shopify Payments and Shop Pay), Tpay (Krajowy Integrator Płatności S.A.) and PayPo (deferred payments);
- orders and delivery: BaseLinker (order handling and shipping labels), InPost, DHL, FedEx and the parcel broker GlobKurier;
- newsletter and notifications: Klaviyo and EcomSend (product availability notifications);
- customer service: Responso (customer messages) and Chatbase (website chat with an AI assistant);
- email, documents and artificial intelligence tools: Google Workspace (including Gemini), Microsoft 365, Claude (Anthropic), ChatGPT (OpenAI), Read AI (notes from online meetings) and n8n (email, document and returns automation);
- statistics and advertising: Google (Analytics, Ads, Merchant Center), Meta (Facebook, Instagram), TikTok, Microsoft Clarity (statistics and session recordings on the website) and Windsor.ai (sales and advertising reports);
- social media: Metricool and Blotato (publishing content and handling messages);
- cookie consents: Pandectes (cookie banner and consent records);
- accounting: our accounting office, invoicing software and the National e-Invoicing System (KSeF);
- others: legal advisers and public authorities, where required by law.
Payment operators, carriers and advertising platforms also process data on their own account, under their own privacy policies. We update this list when we change or add providers; we will provide the current list of recipients of your data on request sent to contact@lobosbags.com.
With regard to data collected by advertising tools on our website and statistics of our social media profiles, we are joint controllers with the operator of the platform concerned (Meta, TikTok). The essence of the arrangement is available from the platform operator, which further processes the data under its own rules.
4. Transfers of data outside the European Economic Area
Some recipients process data outside the European Economic Area (EEA), including in the USA. In such cases, we transfer data on the grounds provided for in Chapter V GDPR, in particular on the basis of a European Commission decision finding an adequate level of data protection (Article 45 GDPR) or standard contractual clauses (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to contact@lobosbags.com.
5. Cookies and similar technologies
Cookies and similar technologies store information on your device or read it from your device. We use them in four groups:
- necessary – operation of the Store, Cart and Account and remembering your cookie choices; they do not require consent;
- functional – remembering settings and additional Store features;
- analytical – statistics and analysis of how the Store is used;
- marketing – tailoring advertising and other marketing content and measuring its effectiveness.
You give or refuse consent to cookies other than necessary ones in the cookie banner. You can change or withdraw your consent at any time in the cookie settings available in the Store; withdrawing consent does not affect the lawfulness of earlier processing. The list of cookies and their providers is available in the cookie banner. You can also block cookies in your browser; blocking necessary cookies may make it impossible to place an order.
6. Your rights
Under the GDPR, you have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability. You can withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
Right to object. You can object at any time to the processing of your data based on our legitimate interest (Article 6(1)(f) GDPR) – on grounds relating to your particular situation, and to processing for direct marketing purposes – without giving any reason.
Send your request to contact@lobosbags.com or by post to our registered office. We may ask you to confirm your identity.
7. Other information
Do you have to provide data? Providing data is voluntary, but without the data needed for the order we will not conclude a contract, and invoice data is required by tax law. Consents to the newsletter and to cookies other than necessary ones are voluntary and do not affect your ability to make purchases.
Changes to this policy. This policy applies from 3 November 2026. We publish the current version on this page.