Privacy policy and information notice

Below we fulfil the information obligation under Article 13 GDPR. We provide this information at the time of collection of data — when creating a B2B Account, placing an order, sending a contact form or signing up for information about offers.

1. Data controller

The data controller is:

ART WIN-EX Sp. z o.o., ul. Widok 5, 43-300 Bielsko-Biała, Poland.

Tax ID: 5472219582, REGON: 386463732.

2. Contact regarding personal data

For matters concerning personal data, you can contact the Controller:

• via email: demo@koryto.coolcatsof.dev,
• by phone: +48 530 685 430,
• via the contact form available on the Website.

The controller has not appointed a data protection officer.

We consider requests concerning the exercise of rights under the GDPR without undue delay, as a rule no later than within one month of receipt.

In cases provided for by the GDPR, this period may be extended.

If there are reasonable doubts as to the identity of the person making the request, the Controller may request additional information necessary to confirm their identity.

3. What data we process

Depending on how you use the Website, we may process, in particular:

• first name and surname;
• position or function within the enterprise;
• company name;
• company address;
• NIP and REGON;
• company registration data;
• email address;
• phone number;
• delivery address;
• B2B Account data;
• order history;
• information regarding payments and settlements;
• data contained in invoices and other accounting documents;
• information regarding trade credit limits and payment terms;
• history of complaints, returns and correspondence;
• information about permits or other authorisations required to purchase or trade alcoholic beverages;
• IP address;
• information about the device, browser and session;
• system logs;
• information related to Account security;
• information regarding consents granted and preferences;
• other data voluntarily provided to the Controller.

Company data does not always constitute personal data. We apply the GDPR to the extent that a given piece of information relates to an identified or identifiable natural person.

4. Purposes and legal bases of processing

Data is processed for the purpose of creating, verifying, activating and maintaining a B2B Account and enabling the use of the Website's functionalities.

The basis for processing is Article 6(1)(b) GDPR and, where applicable, also Article 6(1)(f) GDPR – the legitimate interest of the Controller related to the security of B2B cooperation and verification of counterparties.

We may verify Customer data in public registers and check information needed to establish whether they hold the legally required entitlement to purchase or resell certain products.

The basis may be Article 6(1)(c) GDPR, if verification arises from a legal obligation, or Article 6(1)(f) GDPR – the legitimate interest of the Controller consisting in limiting legal and commercial risk.

Data is processed for the purpose of accepting, preparing, fulfilling and delivering an order and for communication related to its fulfilment.

The basis is Article 6(1)(b) GDPR.

Data may be processed for the purpose of handling payments, identifying payments, monitoring receivables, keeping accounts and managing credit limits.

The basis is Article 6(1)(b), (c) or (f) GDPR, depending on the specific purpose of processing.

The legitimate interest of the Controller is in particular to reduce the risk of non-payment and to protect the company's property interests.

Data is processed for the purpose of fulfilling obligations arising from tax, accounting and other applicable legal provisions.

The basis is Article 6(1)(c) GDPR.

Data is processed for the purpose of accepting, documenting and handling complaints and carrying out related settlements.

The basis is Article 6(1)(b) and, where applicable, Article 6(1)(f) GDPR.

Data may be processed for the purpose of establishing, pursuing, securing or enforcing the Controller's receivables and other claims, and defending against claims by Customers or third parties.

The basis is Article 6(1)(f) GDPR.

The legitimate interest of the Controller is the protection of its rights and property and the ability to demonstrate proper performance of the contract.

Data provided via the form, email or telephone is processed for the purpose of communication and responding to enquiries.

The basis is Article 6(1)(b) or (f) GDPR respectively.

Technical data, IP addresses, logs and information regarding the use of the Website may be processed for the purpose of protecting Accounts, detecting abuse, preventing fraud, diagnosing errors, ensuring the stability of the Website and establishing the circumstances of security incidents.

The basis is Article 6(1)(f) GDPR.

If the user has given the required consent, we may send information about products, new wines, promotions, tastings, events and other Koryto offers.

Marketing communication is conducted in accordance with the GDPR and applicable regulations on electronic communication.

Consent may be withdrawn at any time.

5. Data retention period

We store data for the period necessary to fulfil the purpose for which it was collected, and for the period during which further storage is required or permitted by applicable law.

Data relating to the B2B Account may be stored for the duration of its activity, and after deactivation or deletion – to the extent necessary to fulfil legal obligations and protect the Controller's rights.

Data relating to orders, deliveries, payments, complaints and commercial cooperation may be stored for the duration of the contract, and thereafter until the expiry of the relevant limitation periods for claims.

Tax and accounting documentation is stored for the period required by law.

If a dispute, payment arrears, court, enforcement, tax, administrative or other proceedings concerning a given transaction arise, the relevant data may be stored until the matter is concluded and the obligations arising from it are fulfilled.

Data processed on the basis of consent may be processed until that consent is withdrawn or the purpose of processing ceases.

We keep technical and security-related data for as long as is justified by the need to ensure the security of the Service. If the data indicate abuse, an attempted fraud, a breach of the terms of use of the Service or the possibility of claims arising, they may be stored for the period necessary to clarify the matter and protect the Administrator's rights.

Once the legal basis ceases to apply, the data is erased or anonymised.

Specific retention periods for individual processing purposes:

Purpose of processing	Retention period
Setting up and managing a customer account (B2B, retail network point) — access to prices, orders, invoices	for the duration of the account, and after its deletion until the expiry of the limitation period for claims (up to 6 years)
Acceptance and fulfilment of the order, delivery, handling of complaints and returns	for the duration of order fulfilment, and thereafter until the expiry of the limitation period for claims (up to 6 years from the end of the calendar year)
Issuing invoices and keeping accounting records	5 years from the end of the tax year in which the document was issued (tax regulations and the Accounting Act)
Establishing, pursuing and defending against claims	for the duration of order fulfilment, and thereafter until the expiry of the limitation period for claims (up to 6 years from the end of the calendar year)
Response to an enquiry from the contact form, email or phone	12 months from last contact
Information about new wines, promotions and offers (own marketing)	until consent is withdrawn
Service security, fraud prevention, error diagnostics	log files for up to 30 days; audit trail (who, when, what operation) for up to 12 months
A/B tests of the page layout — we check which version of the page works better; measurement only after consent to cookies	variant assignment works in your session; we collect data only after consent to cookies and store it for no longer than 12 months

6. Recipients of data

Data may be transferred to entities that help us run the Website and our business and fulfil orders.

These may include, in particular:

• hosting and email providers, including MyDevil.net;
• courier and transport companies, including DHL;
• accounting office;
• accounting software providers;
• IT service providers;
• entities providing technical infrastructure and backups;
• banks and entities involved in payment processing;
• law firms;
• tax and business advisers;
• entities providing debt collection services;
• courts, tax authorities, law enforcement authorities and other authorised public bodies.

Depending on the nature of the cooperation, a given entity may act as a processor of data on our behalf or as a separate data controller.

We do not sell personal data to third parties.

We currently do not use external analytics tools (e.g. Google Analytics). If we enable them, we will run them only after your consent, and the information in this document will be updated.

7. Transfer of data outside the EEA

As a rule, we use services and infrastructure that enable data processing within the European Economic Area.

If the use of a particular service involves transferring data outside the European Economic Area, the transfer will take place only using the legal bases and safeguards required by the GDPR.

We do not transfer personal data outside the European Economic Area. Our server and mailboxes operate in Poland.

8. Rights of data subjects

To the extent provided for by the GDPR, you have the right to:

• access to data;
• obtaining a copy of data;
• rectification of data;
• erasure of data;
• restriction of processing;
• data portability;
• objecting to processing based on legitimate interest;
• withdrawal of consent.

These rights are exercised in the cases and to the extent set out by the GDPR.

A request for erasure of data does not mean an obligation to erase information that the Controller is still obliged or entitled to store, in particular due to:

• tax and accounting obligations;
• unpaid receivables;
• open orders;
• complaints;
• obligations arising from legal provisions;
• establishing, pursuing or defending against claims.

To exercise your rights, please write to: demo@koryto.coolcatsof.dev.

As a rule, exercising rights is free of charge. In cases provided for by the GDPR, the Controller may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

You can withdraw your consent to receive marketing information at any time: in the customer panel (/moje-konto/edytuj/), via the “unsubscribe” link in a message, or by a regular email. Withdrawing consent does not affect order fulfilment.

9. Right to lodge a complaint

A person who believes that their data is processed in breach of the GDPR has the right to lodge a complaint with:

President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa. You may also lodge a complaint if you believe that the processing violates the GDPR in any other way.

10. Is providing data mandatory

Providing data is voluntary, but in many cases it is necessary to establish or perform cooperation.

Failure to provide the required data may make it impossible, among other things:

• creating or activating a B2B Account;
• verifying the entrepreneur;
• verifying the required authorisations;
• acceptance and fulfilment of the order;
• issuing an invoice;
• delivery of goods;
• granting specific payment terms;
• handling of complaints;
• responding to the enquiry.

Providing data for marketing purposes is voluntary.

11. Automated decision-making

We do not make decisions concerning users based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect the person within the meaning of Article 22 GDPR.

We may use automated technical mechanisms related to the security of the Website, Account management, fraud prevention and functionality testing, provided they do not lead to the decisions referred to above.

12. Cookies and similar technologies

The website uses cookies and similar technologies.

Essential cookies may be used to the extent necessary for the proper functioning of the Website, security, session maintenance, logging in, handling forms and remembering essential settings.

Other cookies are used after obtaining the required consent.

The Website may use, in particular:

Name	Purpose	Lifetime
sessionid	keeping you logged in to the panel and customer zone; after analytics consent also assigning a stable A/B test variant to unauthenticated guests (session created only after that consent)	12 hours
csrftoken	protecting forms against CSRF attacks	12 months
shop_age_verified	age verification (age gate for alcohol-related content)	12 months
shop_consent	storing your cookie decision by category (necessary / analytics) — versioned JSON; so we do not ask on every visit and you can change your decision (link “Cookies” in the footer)	12 months
shop_language	remembering the selected interface language (PL/EN/IT/ES)	12 months
ab_hero	assignment of the A/B test variant of the page layout — set ONLY after your analytics consent (effectiveness measurement)	90 days

The user can manage cookie consents through the settings available on the Website and the settings of their browser.

Withdrawal of consent should be as easy as giving it.

Blocking essential cookies may cause some functionalities to malfunction, in particular logging in or placing orders.

13. Confirmation of legal age

Due to the nature of the products offered, the Website may require confirmation of legal age.

Information about confirmation may be stored in a relevant cookie so that the user does not have to repeat this action on each visit.

This mechanism does not replace other verification methods required by applicable law.

14. Electronic marketing

Commercial information and direct marketing via electronic or telecommunications channels are conducted in accordance with applicable regulations.

If consent is required for a particular method of communication, marketing communication begins after it has been obtained.

Consent may be withdrawn at any time, in particular by:

• the unsubscribe link in the message, if available;
• Account settings;
• message sent to demo@koryto.coolcatsof.dev.

Withdrawal of marketing consent does not result in deletion of the Account and does not affect the fulfilment of orders.

The controller may retain information about the withdrawal of consent or objection to the extent necessary to demonstrate compliance with the user's decision and to prevent unwanted communication from being sent again.

15. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction, alteration or disclosure.

The website uses an encrypted HTTPS connection.

Access to data is granted only to persons and entities that need it to perform their duties.

We apply appropriate access control mechanisms, Account security measures, backups and logging of events relevant to security.

For security reasons, detailed information on infrastructure configuration and applied protective mechanisms is not publicly disclosed.

16. Receivables, claims and disputes

If a payment arrears, dispute, suspected abuse or the need to protect the rights of ART WIN-EX Sp. z o.o. arises, the Controller may retain and process documentation concerning the cooperation to the extent necessary to protect its rights.

This may include, in particular:

• orders;
• invoices;
• payment confirmation;
• history of order statuses;
• correspondence;
• complaints;
• delivery documents;
• carrier documentation;
• information regarding the Account;
• logs and operation history relevant to the case;
• licence documents;
• other information needed to demonstrate the course of the transaction.

Data may be stored for the period necessary to pursue receivables or defend against claims, including for the relevant limitation period.

If proceedings are initiated, the data may be stored until their final conclusion and the performance or settlement of the obligations arising from them.

17. Account deletion

Deletion or deactivation of the Account does not automatically mean deletion of all data relating to the Customer.

Data may continue to be stored where this is necessary to:

• fulfilling tax or accounting obligations;
• order settlement;
• recovering receivables;
• handling existing complaints;
• performance of legal obligations;
• establishing, pursuing or defending against claims;
• demonstrating proper performance of the contract;
• ensuring security and preventing abuse.

Data whose further storage has no legal basis will be erased or anonymised.

18. Changes to the Privacy Policy

The privacy policy may be updated in particular in the event of:

• changes in legal regulations;
• changes to the functioning of the Website;
• introducing new functionalities;
• changes of service providers;
• changes in the method of processing orders or payments;
• changes in the technologies used;
• the need to increase security.

Each version of the document has a number and an effective date.

The current version of the document is numbered 2026-10-v1, which we record together with the date of your acceptance when creating your Account. This makes it clear what content you received at any given time.

We may inform you of significant changes via the Website, Account or email.

If a particular change requires obtaining new consent, it will be obtained before processing requiring such consent begins.

19. Final provisions

This Privacy Policy is effective from 2026-10-01.

The current version of the document is available on the Website in a way that allows it to be saved and reproduced later.

If the Privacy Policy is provided in several language versions, the Polish version is the source version.

Contact regarding personal data: demo@koryto.coolcatsof.dev.