B2B Zone · effective from 12 October 2026
B2B Zone Privacy Policy
This is an English translation of the Polish Polityka prywatności strefy B2B, provided for convenience only. The Polish version is binding; in the event of any discrepancy between language versions, the Polish version shall prevail.
This document explains how we process personal data in the B2B zone at www.wielkareklama.eu/b2b, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”). We apply these rules to the same extent and on the same legal bases to Partners from Poland and from abroad (the EU, the United Kingdom, Switzerland, Norway and other countries) and to the persons representing them.
1. Controller
The controller is Janusz Ciosek, carrying on business under the name P.P.H.U. Janusz Ciosek WIELKA REKLAMA, ul. Popiełuszki 13, 98-300 Wieluń, Poland, Polish tax ID (NIP) 832-000-27-20. Contact for personal data matters: b2b@wielkareklama.eu, tel. +48 455 455 460.
2. What data we process and why
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Processing the application and verifying the company | company name, Polish tax ID, EU VAT number or foreign register number, country of establishment, address, first and last name, e-mail, telephone, website, business description, register verification result (e.g. name and address from the register, VIES consultation number), IP address | Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) (verification of the business partner, fraud prevention) | until a decision is made; if rejected — 12 months |
| Running the Account and performing orders | Account data, orders, delivery addresses, correspondence, login history, selected language and currency | Art. 6(1)(b) GDPR (contract); for persons representing the Partner — Art. 6(1)(f) (contact with the business partner) | for the life of the Account, then until claims become time-barred (as a rule 6 years; 2 years for claims under contracts of sale and for specific work) |
| Invoicing and tax obligations, including documenting the 0% rate (intra-Community supply, export) | invoice and payment data, EU VAT number and its VIES verification result, transport documents, confirmations of receipt of goods and of exit | Art. 6(1)(c) GDPR (tax, customs and accounting laws) | 5 years from the end of the tax year |
| Arranging shipping, including international shipping, and customs clearance | consignee and sender data, address, telephone, e-mail for notifications, contents and value of the consignment | Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) (customs law) and — for End Customer data — processing on behalf of the Partner (Art. 28 GDPR) | until delivery and any complaint have been completed; transport and customs documents — for the period required by law |
| Security and fraud prevention | IP address, event log (logins, status changes) | Art. 6(1)(f) GDPR | up to 12 months |
| Establishing and defending claims | data necessary to substantiate a claim | Art. 6(1)(f) GDPR | until claims become time-barred |
| Account activity history (operating and improving the portal) | login date and time, IP address, device and browser type, portal pages opened, active time in the portal (a signal every 30 s, only while the tab is open and the user is active) | Art. 6(1)(f) GDPR (security, support, checking that the portal is easy to understand) | 12 months; the Partner can see its login history in the Account |
| Visit statistics (anonymous) | aggregated visit data — without cookies and without identifying individuals | Art. 6(1)(f) GDPR (service development) | aggregated data |
We process End Customer data (delivery addresses) on behalf of the Partner as a processor — the rules are set out in § 12 of the Terms and Conditions. Providing data is voluntary but necessary to open an Account and perform orders.
3. Where we obtain data from
Data is provided by the Partner in the application form and with orders. We supplement and verify company data in public registers:
- Polish companies — the Ministry of Finance VAT taxpayer register (“white list”), CEIDG and KRS;
- companies from the European Union — the VIES system operated by the European Commission (data from national tax administrations);
- companies from the United Kingdom — the Companies House register;
- companies from Switzerland — the UID register (Federal Statistical Office);
- companies from Norway — the Brønnøysund Register Centre (Brønnøysundregistrene);
- companies from other countries — a register extract or other document provided by the Partner.
4. Recipients of data
- server and e-mail provider — Cyber_Folks S.A. (Poznań), servers located in Poland;
- operators of the registers listed in section 3 (European Commission — VIES, Companies House, the UID register, Brønnøysundregistrene) — with regard to the company identification number sent in the verification query; for sole traders, this number may constitute personal data;
- the Furgonetka.pl service, through which we book courier services, and courier companies and carriers (including their partners in the country of destination) — with regard to data required for delivery and customs clearance;
- customs agents and customs authorities — for consignments exported outside the European Union;
- production subcontractors — to the extent necessary to perform the order (without End Customer data, unless the subcontractor ships the order);
- banks holding our PLN and EUR accounts, our accounting office, law firm and online payment operator (once launched) — to the extent necessary for their tasks;
- public authorities — where required by law.
5. Transfers outside the European Economic Area
As a rule, we process data within the European Economic Area (EEA). Data may be transferred outside the EEA only in the following cases:
- company verification with Companies House (United Kingdom) and in the UID register (Switzerland) — both countries are covered by a European Commission adequacy decision (Art. 45 GDPR); the Norwegian register operates within the EEA;
- delivery to an address outside the EEA — we transfer consignee and sender data to the carrier and, to the extent necessary, to entities and customs authorities in the country of destination; where no adequacy decision exists for that country, the transfer is necessary for the performance of a contract or of a contract concluded in the interest of the data subject (Art. 49(1)(b) and (c) GDPR);
- correspondence with a Partner established outside the EEA — to the extent necessary for the performance of the contract (Art. 49(1)(b) GDPR).
6. Cookies and statistics
The B2B Zone uses only strictly necessary cookies: the login session cookie (valid for up to 30 days) and cookies storing your chosen language and price display currency. They serve solely to provide the service you request and therefore do not require consent (Article 399(3) of the Polish Electronic Communications Law; Article 5(3) of Directive 2002/58/EC). To preselect the language, we use the language settings sent by your browser. The cart is stored in your browser’s local storage (localStorage) on your device. We collect visit statistics with our own self-hosted Umami tool (stats.wielkareklama.eu), which does not use cookies and does not create user profiles.
We run Google Analytics 4 (Google Ireland Ltd.) only after you consent via the consent bar (Art. 6(1)(a) GDPR; you can withdraw consent at any time by deleting the b2b_consent cookie in your browser). Without consent the tool runs in restricted mode (Consent Mode) without analytics cookies. After consent a logged-in Account is assigned a pseudonymous identifier (agency-number) without name or e-mail. Google may also process data in the USA under the adequacy decision (EU-US Data Privacy Framework).
7. Your rights
You have the right to access your data, to rectification, erasure or restriction of processing, to data portability and to object to processing based on legitimate interests. Please send requests to b2b@wielkareklama.eu — you may write in Polish, English or German. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in the EU or EEA Member State of your habitual residence or place of work.
We do not make decisions about you based solely on automated processing, including profiling. The partner level results from turnover and may be changed manually by the account manager. The result of the automated register check is only an aid — the decision to accept an application is made by a member of staff.
8. Security
Connections are encrypted (HTTPS), passwords are stored only as cryptographic hashes (scrypt), only authorised persons have access to the admin panel, and data is backed up daily. Print files are not stored in the B2B Zone — you provide them by link.
9. Language versions
This Privacy Policy is available in Polish, English and German. In the event of any discrepancy, the Polish version shall prevail.