Privacy Policy

Last updated: 13 June 2026

This Privacy Policy sets out the rules for processing the personal data of persons using the online shop available at: https://urbanaflex.com/, in particular Customers, persons placing orders, persons contacting the Shop, persons subscribing to the newsletter, persons consenting to marketing communications and users visiting the Shop's website.

This Privacy Policy is for information purposes and has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, i.e. the GDPR, and the applicable provisions of Polish law.

1. Data controller

The controller of personal data is:

URBANAFLEX sp. z o.o.
ul. Henryka Sienkiewicza 20 lok. 23
07-409 Ostrołęka
Tax ID (NIP): 7582407512
REGON: 54499478100000
KRS: 0001247600
e-mail: info@urbanaflex.com

hereinafter: the “Controller” or “URBANAFLEX”.

The Controller can be contacted on matters relating to personal data protection at the following e-mail address: info@urbanaflex.com.

The Controller has not appointed a Data Protection Officer. Any questions concerning the processing of personal data may be addressed directly to the Controller.

2. Scope of the Privacy Policy

This Privacy Policy applies to personal data processed in connection with operating the URBANAFLEX online shop, selling products online, handling orders, payments, deliveries, complaints and withdrawals from contracts, correspondence with Customers, the newsletter, marketing communications, purchase reviews and the use of cookies and similar technologies.

The Shop offers in particular litter bins, street furniture products and other goods available in the Shop's current range.

3. No Customer account

The Shop does not currently allow Customer accounts to be created. Orders are placed without registering an account.

Personal data provided when placing an order are processed in order to handle the specific order and for the other purposes described in this Privacy Policy.

4. What personal data we process

The Controller may process, in particular, the following personal data:

• first name and surname;
• name of the company, institution or organisational unit;
• tax identification number (NIP), where required to issue an invoice or to handle a business or institutional order;
• delivery address;
• billing address;
• e-mail address;
• telephone number;
• data relating to the order placed, including the selected products, order number, order status, order value and transaction history;
• payment data, including information on the selected payment method;
• data necessary to handle deferred payment for public sector bodies, in particular contact person details, details of the body, order details and data necessary to issue sales documents;
• data necessary to issue an invoice, bill or other accounting document;
• data provided in the contact form, by e-mail or in other communication with the Controller;
• data relating to complaints, returns, withdrawals from contracts and after-sales correspondence;
• data relating to marketing consents, the newsletter and cookie consents, including the date, source and scope of the consent given;
• data relating to reviews of purchases or products;
• technical data related to the use of the website, such as IP address, cookie identifiers, data about the device, browser, operating system, traffic source, activity on the website and data recorded in server logs.

The Controller does not require Customers to provide special categories of personal data, such as data concerning health, political opinions, religious beliefs, sexual orientation, genetic data or biometric data. Please do not submit such data in forms, messages or correspondence with the Shop, unless this is exceptionally necessary to deal with a specific matter.

5. Purposes, legal bases and periods of data processing

The Controller processes personal data for the following purposes:

6. Voluntary provision of data

Providing personal data is voluntary, but in some cases it is necessary in order to use certain functions of the Shop.

Providing the data needed to place and fulfil an order is a condition for concluding and performing the sales contract. Failure to provide such data may make it impossible to place an order, make a payment, deliver the product, issue an invoice or deal with a complaint.

Providing data for the purposes of the newsletter, marketing communications or the use of certain cookies is voluntary and depends on the user's consent, where such consent is required.

7. Recipients of personal data

Personal data may be transferred to entities that support the Controller in operating the Shop, handling orders, payments, deliveries, accounting, marketing, analytics and communication with Customers.

Recipients of the data may include, in particular:

• providers of hosting and website maintenance services;
• providers of the shop platform or e-commerce software;
• PayU S.A., based in Poznań, as the electronic payment operator;
• banks handling traditional bank transfers;
• courier companies, carriers, and logistics, freight forwarding and postal operators;
• entities handling deliveries of oversized or specialist products;
• providers of invoicing and document management systems, including the Fakturownia system;
• an accounting firm;
• providers of email, mailing systems and customer communication tools;
• providers of analytics tools, in particular Google tools;
• providers of advertising tools and advertising platforms, where these are implemented in the Shop;
• providers of tools for collecting and managing reviews of purchases or products;
• entities handling complaints, servicing, returns or warranties;
• law firms, tax advisers, debt collection agencies or insurers, where necessary to pursue or defend claims;
• public authorities, courts, public prosecutors, tax authorities or other entities entitled to receive data under the law.

Personal data are transferred only to the extent necessary to achieve a specific purpose and on the basis of the relevant legal provisions or data processing agreements.

8. Payments

The Shop offers the following payment methods:

• online payment via PayU;
• traditional bank transfer;
• deferred payment for public sector budgetary units, where the unit concerned meets the conditions for being granted this form of payment.

If online payment is selected, the data necessary to process the payment may be transferred to PayU. PayU may process the data as a separate controller of personal data with regard to handling the payment transaction.

In the case of a traditional bank transfer, the Controller processes the data visible in the transfer, in particular the sender's details, bank account number, payment amount, transfer reference and data identifying the order.

In the case of deferred payment for public sector budgetary units, the Controller may process the unit's data, the contact person's data, the data of persons representing the unit, order data and data necessary to issue sales documents and process the payment.

The Controller does not store full payment card data or authentication credentials for Customers' bank accounts.

9. Delivery of products

In order to deliver an order, the Controller transfers the necessary data to a courier company, carrier, or logistics, freight forwarding or postal operator.

The scope of data transferred may include first name and surname, company or institution name, delivery address, telephone number, email address, consignment number and information necessary for the proper delivery.

Due to the nature of the products offered, including urban furniture and street furniture products, some deliveries may be carried out by specialist carriers or logistics operators handling larger consignments.

10. Newsletter and marketing communications

The user may subscribe to the newsletter or consent to receiving marketing communications by electronic means.

The newsletter and marketing messages may include, in particular, information about the Shop's offer, new products, promotions, special campaigns, shopping inspiration, guides and content relating to the products offered by URBANAFLEX.

Marketing communications by electronic means are conducted on the basis of the user's consent, in accordance with the GDPR and the applicable provisions of the Electronic Communications Law.

The user may withdraw consent to receiving the newsletter or marketing communications at any time by clicking the unsubscribe link in the email, using the available unsubscribe mechanism or contacting the Controller at: info@urbanaflex.com.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

11. Reviews of purchases and products

The Controller may collect reviews of purchases, products or the Shop's customer service.

In order to collect reviews, the Administrator may contact the Customer after an order has been completed, in particular by e-mail, or may use an external tool for managing reviews.

The data processed in connection with reviews may include the e-mail address, order details, rating, review content, the first name or signature provided by the Customer and technical data relating to the submission of the review.

If a review is published in the Shop or on an external review platform, the signature, first name, company name, review content, rating and other information provided by the reviewer may be visible.

12. Cookies and similar technologies

The Shop uses cookies and similar technologies. Cookies are small files stored on the user's device while they use a website.

The Administrator may use the following types of cookies:

• strictly necessary cookies — required for the Shop to function properly, to operate the basket, process orders, remember sessions, ensure security and support the website's basic functions;
• functional cookies — allow the user's preferences, such as website settings, to be remembered;
• analytics cookies — help to analyse how the website is used, measure traffic, compile statistics and improve the performance of the Shop;
• marketing and advertising cookies — used for advertising activities, remarketing, measuring the effectiveness of advertisements and tailoring advertising content to the user's interests.

Strictly necessary cookies may be used without the user's consent, as they are essential for the provision of electronic services and the proper functioning of the Shop.

Other cookies, in particular analytics and marketing cookies, are used once the user's consent has been obtained, where such consent is required.

The user may manage cookie consents via the cookie banner or the cookie settings panel available on the Shop's website. The user may accept cookies, reject non-essential cookies or change their consents.

The user may also change cookie settings in their web browser settings.

Disabling certain cookies may affect the operation of selected functions of the Shop, but should not prevent the use of basic functions such as browsing the product range and placing orders.

13. Google tools and other advertising platforms

The Administrator uses or may use Google tools for analytics, measuring advertising effectiveness, running advertising campaigns and remarketing, in particular tools such as Google Analytics and Google Ads.

The Administrator also uses or may use other advertising platforms for running advertising campaigns, measuring their effectiveness, creating audiences and remarketing.

In connection with the use of such tools, the following may in particular be processed: cookie identifiers, IP address, device data, browser data, data on activity on the website, data on the source of visits to the website, data on interactions with advertisements and conversion information.

To the extent that these tools are not necessary for the operation of the Shop, they are used on the basis of the user's consent given via the cookie banner or the consent management panel.

14. Transfer of data outside the European Economic Area

As a rule, personal data are processed within the European Economic Area.

Owing to the use of Google tools and other analytics, advertising, mailing, cloud or technology tools, personal data may be transferred outside the European Economic Area, in particular to the United States.

In such cases, data are transferred on the basis of mechanisms provided for by the GDPR, in particular a European Commission adequacy decision, standard contractual clauses or other appropriate safeguards required by law.

15. Automated decision-making and profiling

The Administrator does not make decisions concerning Customers based solely on automated processing of data that would produce legal effects concerning them or similarly significantly affect them.

The Administrator may carry out profiling for analytics, advertising or marketing purposes if the user has consented to the use of the relevant cookies or similar technologies.

Profiling may consist in particular of analysing the user's activity on the Shop's website, assigning the user to a specific advertising audience, measuring the effectiveness of advertisements or tailoring advertising content to the user's interests.

Profiling of this kind does not produce legal effects concerning the user or similarly significant effects.

16. Rights of data subjects

The data subject has the following rights:

• the right of access to personal data;
• the right to obtain a copy of the data;
• the right to rectification of inaccurate data;
• the right to have incomplete data completed;
• the right to erasure of data;
• the right to restriction of processing;
• the right to data portability;
• the right to object to the processing of data;
• the right to object to the processing of data for direct marketing purposes;
• the right to withdraw consent at any time, where processing is based on consent;
• the right to lodge a complaint with the President of the Personal Data Protection Office.

To exercise the above rights, please contact the Controller at the following e-mail address: info@urbanaflex.com.

The Controller responds to a request without undue delay, generally within one month of receiving the request. Where a request is complex or a large number of requests has been received, this period may be extended in accordance with the GDPR.

The right to erasure, restriction of processing, data portability or objection may be subject to limitations arising from legal provisions, in particular where further processing of the data is necessary for the Controller to comply with its legal obligations or for the establishment, exercise or defence of legal claims.

17. Right to lodge a complaint with the President of the Personal Data Protection Office

If the data subject considers that the Controller processes their personal data in breach of the GDPR, they have the right to lodge a complaint with the President of the Personal Data Protection Office.

Before lodging a complaint, the data subject may contact the Controller to clarify the matter or to exercise their rights.

18. Security of personal data

The Controller applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other forms of unlawful processing.

These measures are adapted to the nature, scope, context and purposes of the processing and to the risk to the rights or freedoms of natural persons.

19. Links to external websites

The Shop website may contain links to external websites, social media services, payment systems, delivery operators or other third parties.

The Controller is not responsible for the personal data processing practices of third parties. Before using external services, it is recommended that you read their privacy policies.

20. Social media

The Controller may maintain social media profiles.

If a user follows the Controller's profile, comments on posts, sends messages or otherwise interacts with the profile, their data may be processed by the Controller for the purposes of running the profile, communicating with users, promoting products and services and analysing activity on the profile.

The provider of the social media platform concerned also processes the user's data as a separate controller in accordance with its own privacy policy.

21. Changes to the Privacy Policy

The Controller may amend the Privacy Policy in the event of changes in legislation, changes in the operation of the Shop, or the introduction of new services, tools, technologies or methods of data processing.

The current version of the Privacy Policy is available on the Shop website.