Privacy policy
Version 4 — last updated 24 August 2026. We publish changes on this page; using the site after they appear means the current version applies.
Data controller
The controller of your personal data is z Betlejem sp. z o.o. (trading as Scoop & Pack), ul. Dworcowa 13A, 62-030 Luboń, NIP 7822958371, KRS 0001189172, REGON 542471458. Data enquiries: office@scooppack.com.
What data we collect, why, and on what basis
We collect the data you provide in our forms and — when you send an enquiry — a minimal technical record of how you reached the site. With your consent, analytics and marketing tools also record your visit to the site. The purposes are as follows:
| Data | Purpose | Basis |
|---|---|---|
| Contact form: name, phone number, optional e-mail address and message content. | replying to your enquiry | your consent (art. 6(1)(a) GDPR) |
| Product creator: phone number, optional e-mail address, brand name, message and product configuration. | preparing your individual offer and contacting you about it | your consent (art. 6(1)(a) GDPR) |
| Saved projects: product configuration (no personal data). | returning to a saved project via a link | legitimate interest — operation of the tool (art. 6(1)(f) GDPR) |
| Analytics and marketing data (Google Analytics, Microsoft Clarity, and Meta Pixel with Conversions API). After marketing consent, Meta may receive event information, the page address, _fbp/_fbc identifiers, IP address, User-Agent, and the form e-mail and phone number normalized and hashed with SHA-256. We do not send Meta the message, brand name, or product configuration. | improving the site and configurator, conversion measurement, attribution, advertising optimisation and remarketing | your consent — only after “Accept all” (art. 6(1)(a) GDPR) |
| Enquiries: a technical record of the visit source — channel and campaign name from the link, ad click identifier, referring domain and the address of the first page visited. No IP address and no persistent device identifier. | establishing which marketing activities produce real enquiries | legitimate interest — measuring the effectiveness of our own activities (art. 6(1)(f) GDPR) |
Who we entrust data to (processors)
We use trusted providers who process data solely on our instructions:
- Hetzner Online GmbH — website server hosting (Nuremberg, EU)
- cyber_Folks S.A. — e-mail hosting and domain DNS (Poland, EU)
- Google (Analytics) — traffic analytics (only with consent)
- Microsoft (Clarity) — behaviour analytics (with consent; form fields masked)
- Meta Platforms Ireland Ltd. — measuring visits and conversions through Meta Pixel and Conversions API, attribution, advertising optimisation and remarketing (only with marketing consent)
- n8n (self-hosted instance) — enquiry-handling automation — no transfer outside our infrastructure
- Telegram Messenger — notifying our team about a new enquiry (name and contact details from the form)
- Cloudflare, Inc. — protecting our forms against abuse (Turnstile); the script loads only once you start filling in a form
Transfers outside the EEA
Analytics and marketing measurement providers (Google, Microsoft, Meta) may process data in the USA — data reaches them ONLY after you give consent. Transfers rely on Standard Contractual Clauses (SCC) and — where applicable — the Data Privacy Framework. A notification about a new enquiry (name and contact details) is sent to Telegram, whose provider is established outside the EEA — we limit it to what we need in order to call or write back. Cloudflare, Inc. (USA) checks whether a form is filled in by a human. This check rests on our legitimate interest, so it does not depend on consent, and the transfer relies on Standard Contractual Clauses. If you never touch a form, your browser does not contact Cloudflare at all. During the check your browser may store a technical marker, needed only to complete the task. The website server and e-mail are located in the EU.
How long we keep data
Form and configurator data is kept no longer than 12 months from last contact — after that it is deleted automatically. We delete it earlier at your request or when you withdraw consent, unless law requires longer retention. Saved projects (links) expire after 180 days. Analytics data — per the providers' retention settings. Deletion takes immediate effect on live data; encrypted backups expire in their own cycle (up to 14 days) and are not selectively restored.
Your rights
At any time you have the right to:
- access your data and obtain a copy
- rectify (correct) your data
- erasure (“the right to be forgotten”)
- restriction of processing
- data portability
- object to processing
- withdraw consent at any time (without affecting processing before withdrawal) — via the “Cookie settings” link in the footer, or by writing to us
- lodge a complaint with the President of the Polish Personal Data Protection Office (PUODO)
To exercise your rights, write to office@scooppack.com.
Cookies and similar technologies
Essential cookies work without consent; analytics and marketing cookies — only with your consent:
| File / tool | Purpose | Category |
|---|---|---|
| sp-consent | remembering your consent decision | essential |
| Google Analytics (_ga, _ga_*) | visit statistics | analytics (with consent) |
| Microsoft Clarity (_clck, _clsk) | behaviour analysis (form fields masked) | analytics (with consent) |
| Meta Pixel (_fbp, _fbc) | measuring visits and marketing effectiveness | marketing (with consent) |
| sp-src (session storage) | remembering the visit source until an enquiry is sent; cleared when the tab closes | essential (technical, session-only) |
You can change or withdraw consent at any time via the “Cookie settings” link in the footer.
Changes to this policy
If the scope of processing changes materially, we will ask for your consent again.