Privacy policy
Version 2 — last updated 27 July 2026. We publish changes on this page; using the site after they appear means the current version applies.
Data controller
The controller of your personal data is z Betlejem sp. z o.o. (trading as Scoop & Pack), ul. Nadolnik 8 m. 150, 61-012 Poznań, NIP 7822958371, KRS 0001189172, REGON 542471458. Data enquiries: office@scooppack.com.
What data we collect, why, and on what basis
We collect only the data you provide yourself, and only for the purposes below:
| Data | Purpose | Basis |
|---|---|---|
| Contact form: name, phone number, e-mail address (optional), message content. | replying to your enquiry | your consent (art. 6(1)(a) GDPR) |
| Product creator: phone number and — optionally — e-mail address, brand name, message and product configuration. | preparing your individual offer and contacting you about it | your consent (art. 6(1)(a) GDPR) |
| Saved projects: product configuration (no personal data). | returning to a saved project via a link | legitimate interest — operation of the tool (art. 6(1)(f) GDPR) |
| Analytics data (Google Analytics, Microsoft Clarity). | improving the site and the configurator | your consent — only after “Accept all” (art. 6(1)(a) GDPR) |
Who we entrust data to (processors)
We use trusted providers who process data solely on our instructions:
- Hetzner Online GmbH — website server hosting (Nuremberg, EU)
- cyber_Folks S.A. — e-mail hosting and domain DNS (Poland, EU)
- Google (Analytics) — traffic analytics (only with consent)
- Microsoft (Clarity) — behaviour analytics (with consent; form fields masked)
- n8n (self-hosted instance) — enquiry-handling automation — no transfer outside our infrastructure
- Telegram Messenger — notifying our team about a new enquiry (name and contact details from the form)
Transfers outside the EEA
The analytics providers (Google, Microsoft) are US entities — analytics data reaches them ONLY after you give consent. Transfers rely on Standard Contractual Clauses (SCC) and — where applicable — the Data Privacy Framework. A notification about a new enquiry (name and contact details) is sent to Telegram, whose provider is established outside the EEA — we limit it to what we need in order to call or write back. The website server and e-mail are located in the EU.
How long we keep data
Form and configurator data is kept no longer than 12 months from last contact — after that it is deleted automatically. We delete it earlier at your request or when you withdraw consent, unless law requires longer retention. Saved projects (links) expire after 180 days. Analytics data — per the providers' retention settings. Deletion takes immediate effect on live data; encrypted backups expire in their own cycle (up to 14 days) and are not selectively restored.
Your rights
At any time you have the right to:
- access your data and obtain a copy
- rectify (correct) your data
- erasure (“the right to be forgotten”)
- restriction of processing
- data portability
- object to processing
- withdraw consent at any time (without affecting processing before withdrawal) — via the “Cookie settings” link in the footer, or by writing to us
- lodge a complaint with the President of the Polish Personal Data Protection Office (PUODO)
To exercise your rights, write to office@scooppack.com.
Cookies and similar technologies
Essential cookies work without consent; analytics — only with your consent:
| File / tool | Purpose | Category |
|---|---|---|
| sp-consent | remembering your consent decision | essential |
| Google Analytics (_ga, _ga_*) | visit statistics | analytics (with consent) |
| Microsoft Clarity (_clck, _clsk) | behaviour analysis (form fields masked) | analytics (with consent) |
You can change or withdraw consent at any time via the “Cookie settings” link in the footer.
Changes to this policy
If the scope of processing changes materially, we will ask for your consent again.