by PEPEUROPEPrivacy policy
Last updated: 5 September 2026
This policy explains what personal data we collect when you use bacteriowater.shop, why we collect it, and what rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is:
PEPEUROPE LTD
182–184 High Street North, East Ham
London E6 2JA, United Kingdom
Email: support@bacteriowater.shop
2. What we collect
| Data | When | Why |
|---|---|---|
| Name, email, delivery and billing address, phone number | When you place an order | To process and deliver your order, and to issue an invoice |
| Order history | When you buy | To handle returns, refunds and support, and to meet accounting law |
| Email address | If you subscribe | To send you the newsletter you asked for |
| Message content | When you contact us | To answer your question |
| IP address, browser, pages viewed | Automatically | Security, fraud prevention and, with your consent, analytics |
We never see your card details. Payments are handled by our payment provider, who receives them directly. We only receive confirmation that a payment succeeded or failed.
3. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR) — processing and delivering your order.
- Legal obligation (Art. 6(1)(c) GDPR) — keeping invoices and accounting records.
- Consent (Art. 6(1)(a) GDPR) — the newsletter and non-essential cookies. You can withdraw consent at any time.
- Legitimate interests (Art. 6(1)(f) GDPR) — preventing fraud and keeping the shop secure.
4. Who we share it with
We share only what is necessary, and only with:
- Shopify Inc. — the platform this shop runs on.
- Our payment provider — to take payment and handle refunds and chargebacks.
- Delivery carriers — your name, address and phone number, so they can deliver.
- Our accountant — invoice data, as required by law.
We do not sell your data and we do not share it for anyone else’s marketing.
5. Transfers outside the EEA
Some of our providers process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
- Order and invoice data — 5 years from the end of the tax year, as Polish accounting law requires.
- Account data — until you delete your account.
- Newsletter — until you unsubscribe.
- Support emails — 2 years.
- Analytics — 14 months.
7. Your rights
Under the GDPR you have the right to:
- access the data we hold about you;
- have inaccurate data corrected;
- have your data erased, where no legal duty requires us to keep it;
- restrict how we process it;
- receive your data in a portable, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting processing done before you withdrew it.
To exercise any of these, email support@bacteriowater.shop. We respond within 30 days.
You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
8. Cookies
We use:
- Essential cookies — to keep your cart and session working. These cannot be switched off and do not need consent.
- Analytics cookies — to understand how the shop is used. These are set only if you accept them.
You can change your choice at any time through the cookie banner, or by clearing cookies in your browser.
9. Automated decision-making
We do not make decisions about you by purely automated means that produce legal effects. Our payment provider may run automated fraud checks on a transaction; if a payment is declined on that basis you can contact us and a person will review it.
10. Changes
If we change this policy we will update the date at the top. Material changes will be announced on this page.