§1 Data Controller
The controller of personal data of loyalty programme participants is:
SZAŁ spółka z ograniczoną odpowiedzialnością
ul. Warszawska 1
31-155 Kraków
KRS 0001143284
NIP 6762683118
REGON 540388055
For matters related to the processing of personal data, please contact us at: [email protected]
§2 Purpose of Data Processing
Personal data of Programme participants is processed for the purpose of:
- operating the Loyalty Programme,
- calculating points and discounts,
- identifying Programme participants,
- communication related to participation in the Programme.
§3 Joint Controllers and Data Recipients
In connection with the implementation of the Loyalty Programme and marketing activities (newsletter), personal data of participants is processed by two joint controllers: 1) SZAŁ sp. z o.o. with its registered office in Kraków, 2) Szał dla plastyków sp. z o.o. with its registered office in Nowa Wieś Szlachecka. The joint controllers jointly determine the purposes and means of processing personal data, in particular with regard to the operation of the Loyalty Programme and the sending of the newsletter.
The joint controllers have agreed on the scope of their respective responsibilities for fulfilling obligations arising from the GDPR, in particular with regard to the exercise of data subjects' rights.
Data is processed by the joint controllers for the purpose of managing the newsletter and marketing activities. A Programme participant may exercise their rights against either of the joint controllers.
The scope of processed data includes in particular:
- first name
- last name
- e-mail address
- date of birth (providing a date of birth is voluntary and may be used, for example, to grant birthday benefits)
information on the value and history of purchases made within the Programme.
Personal data may also be transferred to entities providing technical and IT services to the Controller, to the extent necessary for the operation of IT systems and the loyalty programme.
§4 Legal Basis for Processing
The legal basis for processing personal data is: • Art. 6(1)(b) GDPR – performance of a contract for participation in the Loyalty Programme, • Art. 6(1)(a) GDPR – the participant's consent to receive the newsletter.
§5 Participant's Rights
Every data subject has the right to:
- access to their data,
- rectification of their data,
- erasure,
- restriction of processing,
- data portability,
- objection to the processing of data.
Where data is processed on the basis of consent, the participant has the right to withdraw it at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.
§6 Newsletter Unsubscription
A participant may at any time unsubscribe from the newsletter via the unsubscribe link included in every e-mail message. Unsubscribing from the newsletter will result in the loss of access to the Loyalty Programme.
§7 Data Retention Period
Personal data of Programme participants will be stored for the duration of participation in the Loyalty Programme and until the withdrawal of consent to receive the newsletter, and thereafter for the period necessary to pursue or defend any potential claims in accordance with applicable law.
§8 Right to Lodge a Complaint
A data subject has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of their personal data infringes the provisions of the GDPR.
§9 Voluntary Nature of Data Provision
Providing personal data is voluntary, however it is necessary for participation in the Loyalty Programme.
Last update of the privacy policy – 4 May 2026.