Privacy policy

This document sets out the rules for processing personal data of online store users at ggmtools.eu, operated under the trade name GGM Tools by G&M KKA TRADING Sp. z o.o., in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Act on the Provision of Electronic Services.

1. Data Controller

G&M KKA TRADING Spółka z ograniczoną odpowiedzialnością, trading as GGM Tools
ul. Bukowa 18, 05-850 Szeligi, Poland
KRS: 0001171739  |  NIP: 1182305584  |  REGON: 541673616
e-mail: help@ggmtools.com
tel.: +48 791 743 533

GGM Tools has not appointed a Data Protection Officer (DPO), as it is not required to do so under Article 37 GDPR. All data protection enquiries should be directed to the contact details above.

2. Scope and Purposes of Data Processing

GGM Tools processes only the personal data that a user voluntarily provides through contact forms, when placing an order, or during communication with us. We do not collect data beyond what is necessary for the purposes described below.

We process personal data for the following purposes and on the following legal bases under Article 6 GDPR:

Purpose Legal basis (Art. 6 GDPR)
Processing and fulfilling orders, issuing invoices Art. 6(1)(b) — performance of a contract
Responding to enquiries and customer support Art. 6(1)(b) — performance of a contract / Art. 6(1)(f) — legitimate interests
Compliance with tax and accounting obligations Art. 6(1)(c) — legal obligation
Sending newsletter and marketing communications Art. 6(1)(a) — consent (given explicitly and may be withdrawn at any time)
Fraud prevention and security of the store Art. 6(1)(f) — legitimate interests
Statistical analysis and improvement of services Art. 6(1)(f) — legitimate interests

3. Data Retention Periods

Personal data is retained only for as long as necessary for the purpose for which it was collected:

  • Order and contract data — for the duration of the contract and for 5 years thereafter, in accordance with applicable accounting and tax law.
  • Customer support correspondence — for 3 years from the date of the last contact, or until the limitation period for potential claims has expired.
  • Newsletter / marketing consents — until consent is withdrawn. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
  • Cookie and analytics data — in accordance with the retention periods set by the respective service providers (see Section 7).

After the applicable retention period has expired, personal data is securely deleted or anonymised.

4. Recipients and Transfers of Personal Data

Personal data may be shared with the following categories of trusted recipients, solely to the extent necessary for the provision of services:

  • Logistics and courier companies — for the purpose of delivering orders.
  • Accounting and bookkeeping firms — for the fulfilment of tax and accounting obligations.
  • IT service providers and hosting companies — for the operation and maintenance of the online store (including Shopify Inc.).
  • Payment service providers — for the processing of payments.
  • Analytics providers — such as Google LLC (Google Analytics), for statistical analysis of store usage.

All processors are bound by data processing agreements ensuring an adequate level of data protection in accordance with GDPR requirements.

Transfers outside the European Economic Area (EEA): Some of the above service providers (e.g. Shopify Inc., Google LLC) are based in or transfer data to countries outside the EEA, including the United States. Such transfers are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards pursuant to Chapter V GDPR. You may request further information about these safeguards by contacting us at help@ggmtools.com.

5. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Right of access (Art. 15) — you may request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — you may request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17) — you may request deletion of your data where there is no legitimate ground for continued processing.
  • Right to restriction of processing (Art. 18) — you may request that we limit how we use your data in certain circumstances.
  • Right to data portability (Art. 20) — you may request your data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21) — you may object to processing based on legitimate interests, including profiling.
  • Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to lodge a complaint (Art. 77) — you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

To exercise any of the above rights, please contact us at help@ggmtools.com. We will respond within 30 days. In complex cases, this period may be extended by a further two months, of which you will be informed.

Providing personal data is voluntary; however, failure to provide data necessary for order fulfilment will prevent us from processing your order.

6. Data Security

GGM Tools has implemented appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include SSL encryption, access controls, and regular security reviews. Access to personal data is restricted to authorised personnel only, bound by confidentiality obligations. Data is stored on secured servers compliant with GDPR standards.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, GGM Tools will notify you without undue delay, in accordance with Article 34 GDPR.

7. Cookies and Tracking Technologies

The GGM Tools website uses cookies and similar tracking technologies for functional, analytical, and marketing purposes. Users may manage cookie preferences through their browser settings or our cookie consent tool.

We use the following categories of cookies:

  • Strictly necessary cookies — essential for the website to function. These cannot be disabled.
  • Session security cookies — ensure secure browsing and protect against fraud.
  • Analytical and statistical cookies (e.g. Google Analytics) — help us understand how visitors use the site. These are only placed with your consent.
  • Functional cookies — remember your preferences (e.g. language, currency). These are only placed with your consent.

Where cookies involve the transfer of data outside the EEA (e.g. Google Analytics), this is done on the basis of Standard Contractual Clauses. You may opt out of Google Analytics tracking via tools.google.com/dlpage/gaoptout.

Continuing to use the website after being presented with the cookie notice and without changing your settings constitutes consent to the use of non-essential cookies.

8. Automated Decision-Making and Profiling

GGM Tools does not use automated decision-making or profiling that produces legal effects or similarly significantly affects users, as referred to in Article 22 GDPR.

9. Changes to This Privacy Policy

GGM Tools reserves the right to update this Privacy Policy from time to time to reflect changes in law or our data processing practices. The current version will always be available at ggmtools.eu/policies/privacy-policy. We encourage you to review this policy periodically.

10. Contact

For any questions or requests relating to the processing of your personal data, please contact GGM Tools at:
e-mail: help@ggmtools.com
tel.: +48 791 743 533
G&M KKA TRADING Sp. z o.o. (GGM Tools), ul. Bukowa 18, 05-850 Szeligi, Poland