Privacy Policy

1. Who we are

The controller of your personal data is:

PRAVEN TRADING COMPANY Denis Nuckowski
ul. Szlak 77 lok. 222, 31-153 Kraków, Poland
VAT ID: PL6511743610 · REGON: 524341528
Email: contact@praven.pl · Phone / WhatsApp: +48 572 472 492

In this policy “PRAVEN”, “we” and “us” refer to the controller above. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable Polish data protection law. We have not appointed a Data Protection Officer; for any privacy question please contact us at contact@praven.pl.

2. What data we process and why

2.1 Enquiries via the contact form

When you send an enquiry through the form on our website we process: your name and/or company name, email address, phone number (optional), the brands you select, any other brands you ask us to source, and the content of your message.

• Purpose: to answer your enquiry and prepare an offer.
• Legal basis: Art. 6(1)(b) GDPR, taking steps at your request before entering into a contract, and Art. 6(1)(f) GDPR, our legitimate interest in answering business enquiries. Where you act on behalf of a company, we process your contact details based on our and your company’s legitimate interest in business communication (Art. 6(1)(f) GDPR).

Providing this data is voluntary, but without your name and email address we cannot reply to you. Fields marked as optional can be left empty.

2.2 Email and WhatsApp communication

If you contact us by email or WhatsApp, we process the data contained in your message and your contact details (email address or phone number) to reply and continue the conversation. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR. Please note that WhatsApp is a service of WhatsApp Ireland Limited (Meta), which processes your data under its own privacy policy as an independent controller.

2.3 Customers, suppliers and business partners

If we enter into a business relationship, we process the contact and company data of you or your representatives to conclude and perform the contract (Art. 6(1)(b) GDPR), to meet our legal obligations, in particular accounting and tax obligations (Art. 6(1)(c) GDPR), and to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

2.4 Newsletter

If you subscribe to our newsletter (for example our K-beauty trend report, news about brands and offers), we process your email address and, if you provide them, your name and company name.

• Purpose: to send you the newsletter, including commercial information about our products and offers.
• Legal basis: your consent (Art. 6(1)(a) GDPR). Sending commercial information by email also requires your consent under Polish electronic communications law, which you give by subscribing.
• Withdrawing consent: you can unsubscribe at any time with one click, using the link in every newsletter email, or by writing to contact@praven.pl. Unsubscribing does not affect the lawfulness of mailings sent before.
• Statistics: our newsletter tool may record whether an email was delivered and opened and which links were clicked. We use this information only in order to understand which content is useful to our subscribers and to improve the newsletter (Art. 6(1)(f) GDPR).

Subscribing is voluntary and is not a condition for receiving an offer from us. The newsletter is sent using Hostinger Reach, provided by Hostinger International Ltd., acting as our data processor.

2.5 Visiting our website

When you visit praven.pl, our hosting provider’s servers automatically record technical data such as your IP address, date and time of the request, the page requested, browser type and operating system (server logs). We use this data only to deliver the website, keep it secure and diagnose errors. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and working website. We do not use this data to identify you and we do not combine it with other data.

The fonts and images on our website are served from our own server. We do not use any analytics, advertising or social media tracking tools on this website.

3. Cookies and similar technologies

Our website does not use cookies or similar technologies to track you, and it does not use analytics or advertising cookies. For this reason we do not display a cookie banner. If we ever introduce non-essential cookies, we will ask for your consent first and update this policy.

4. Who receives your data

We do not sell your personal data. We share it only where necessary with:

• Hostinger International Ltd. (Cyprus), our provider of website hosting, business email and the newsletter tool (Hostinger Reach), acting as our data processor under a data processing agreement. The website is hosted in a data centre in Frankfurt, Germany.
• Providers of IT, accounting and legal services who support our business, only to the extent necessary and under appropriate agreements.
• Couriers and logistics companies, where needed to deliver an order.
• Public authorities, where we are required to do so by law.

5. Transfers outside the European Economic Area

We store and process your data within the European Economic Area. A transfer outside the EEA may occur only if you choose to contact us via WhatsApp (Meta), which may process data in the United States. Such transfers rely on the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. If you prefer, you can always contact us by email instead.

6. How long we keep your data

• Enquiries and correspondence that do not lead to a business relationship: for up to 3 years from our last contact, to be able to refer to earlier conversations and to defend against possible claims, unless you ask us to delete them sooner and we have no overriding reason to keep them.
• Newsletter: until you unsubscribe. After that we keep only your email address and the date of your consent and withdrawal, for as long as needed to prove that we sent the newsletter lawfully and to make sure we do not email you again.
• Data related to contracts and orders: for the duration of the contract and then until the expiry of the limitation period for claims under Polish law.
• Accounting and tax documents (e.g. invoices): for 5 years from the end of the calendar year in which the tax obligation arose, as required by Polish tax law.
• Server logs: for a short period set by our hosting provider, after which they are deleted automatically.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy of it (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure of your data (“right to be forgotten”) (Art. 17);
• restriction of processing (Art. 18);
• data portability, where processing is based on a contract and carried out by automated means (Art. 20);
• object to processing based on our legitimate interest (Art. 6(1)(f)), on grounds relating to your particular situation, and at any time to processing for direct marketing purposes (Art. 21);
• withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise any of these rights, email us at contact@praven.pl. We will respond without undue delay and in any case within one month of receiving your request. We may ask you to confirm your identity before acting on a request.

8. Right to lodge a complaint

If you believe we process your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also contact the supervisory authority in the EU country where you live or work.

9. Other information

• No automated decisions. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
• Business audience. Our website and services are intended for businesses and are not directed at children. We do not knowingly collect data from persons under 16.
• Security. We protect your data with appropriate technical and organisational measures, including an encrypted (HTTPS) connection to our website and access to data limited to authorised persons.

10. Changes to this policy

We may update this policy, for example when we introduce new services or when the law changes. The current version is always available on this page, with its effective date shown at the top.