Privacy Policy
Privacy Policy
Effective from: 04.10.2026
This Policy explains how Batida Group sp. z o.o. processes your personal data when you use the batida.pl store, the b2b.batida.pl store for businesses, your customer account and the "My Account" panel, forms, the newsletter and the loyalty programme, and when you contact us by e-mail or by phone. It fulfils the information obligation under Art. 13 and 14 GDPR (Regulation (EU) 2016/679).
1. Data controller and contact
- The controller of your data is Batida Group sp. z o.o. with its registered office in Warsaw, ul. Łowicka 58/13, 02-531 Warszawa, KRS 0001238720, NIP 5214163469, REGON 544631950 ("Batida", "we").
- For matters concerning personal data, write to sklep@batida.pl or by post to the correspondence address: Batida Group sp. z o.o., office, ul. Królewska 2, 00-065 Warszawa. Phone: +48 692 409 395 (Mon-Fri 9:00-17:00, Sat 9:00-11:00).
2. What data we collect and where from
- You provide data to us directly: when ordering (first and last name, e-mail, phone, delivery address or selected pick-up point, text of the inscription or letter, invoice details), in your account, in the "My Account" panel (e.g. important dates, date of birth for the birthday gift, invoice details, quiz answers), in forms, in reviews, in the loyalty programme (e.g. date of birth) and in correspondence.
- Data about the recipient of a gift (first and last name, phone) is provided to us by the person placing the order - see section 9.
- We collect technical data automatically when you use the Store: IP address, cookie identifiers, information about your device and browser, pages visited, referral source. The scope depends on your consents in the cookie banner (see the Cookie Policy).
- Company data from public registers: when you register a business account at b2b.batida.pl, and when you enter a NIP (Polish tax identification number) in the cart ("Company invoice") or in the "My Account" panel, we complete the company details on the basis of the NIP from the Ministry of Finance's register of VAT taxpayers.
3. Purposes, legal bases and retention periods
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Fulfilling the order: acceptance, preparation, pick-up or delivery, contact about the order, status e-mails (confirmation, "You're picking up today", "We're delivering today") | first and last name, e-mail, phone, address or pick-up point, order contents (including the inscription, letter), payment data (status, not the card number) | Art. 6(1)(b) GDPR (contract) | until the contract is performed, then until the limitation period for claims expires (as a rule 6 years from the end of the year in which the contract was concluded) |
| Receipts, invoices, accounting, taxes | order data, invoice details (including NIP) | Art. 6(1)(c) GDPR (obligations under the Accounting Act and tax law) | 5 years from the end of the tax year in which the tax obligation arose |
| Complaints, withdrawals from the contract, returns, establishing and defending claims | order data, content of the submission, photos | Art. 6(1)(c) GDPR (obligations under the Consumer Rights Act) and point (f) (our legitimate interest: defence against claims) | until the matter is closed, then until the limitation period for claims expires |
| Customer account and the "My Account" panel (login with a one-time code, order history and "Order again", upcoming order, saved addresses with the nearest boutique, "Your café", "Your year with Batida", newsletter consent status, view of points in the loyalty programme) | e-mail, first and last name, phone, addresses, order history (including pick-up locations), newsletter consent status, points balance and level | Art. 6(1)(b) GDPR (contract for the Account and the panel - Store Terms and Conditions § 4-5) | until the account is deleted; order data - as above. We calculate "Your café" and "Your year with Batida" from your order history at the moment the panel is displayed; the "Your year with Batida" graphic is created by your browser - we do not save it |
| "My Account" panel: saved invoice details and the "Always add an invoice to my order" option (filling in company details in the cart) | NIP, company name, company address (street, postcode, city), option setting | Art. 6(1)(b) GDPR (a panel service that you use at your own request) | until the company is removed in the panel or the account is deleted; data on an issued invoice - as in the "Receipts, invoices" row |
| Business account at b2b.batida.pl and service for business customers (contact persons) | first and last name, job title, e-mail, phone of the contact person; company data | Art. 6(1)(b) GDPR (a person running a business) or point (f) (contact persons of companies: our interest and the company's interest in performing the contract) | until the account is deleted or until we are notified that the person is no longer a contact person; order data - as above |
| Gift: handing over the order to another person | first and last name and phone number of the recipient | Art. 6(1)(f) GDPR (legitimate interest of ours and of the person placing the order: handing over the order to the right person) | together with the order data |
| Occasion reminders: "Remind me in a year" (one e-mail reminder about 7 days before the anniversary of the occasion, with what was in the order a year ago) and "Important dates" in the "My Account" panel (an e-mail reminder about 7 days before each saved date, every year, with suggestions from the current range) | e-mail, first name, type of occasion, date (day and month), the name or description of the person entered by you (e.g. "Mum"); for "Remind me in a year" also the products and the date of the order | Art. 6(1)(b) GDPR (a service you request: ticking "Remind me in a year" in the cart or saving a date in the panel - Store Terms and Conditions § 4(4)-(5)); we send the reminder at your request, therefore it does not require consent to the newsletter | "Important dates": until the date is deleted in the panel ("Important dates" tab) or by e-mail to sklep@batida.pl, or until the account is deleted. "Remind me in a year": until the reminder is sent (about 12 months after the order) or until it is cancelled - in the "My Account" panel, by replying to the message or by writing to sklep@batida.pl, and then we will not send the reminder. After it is sent, only a technical record remains in the Batida Connect app (order number, partially hidden e-mail address, type of occasion, status), so that the reminder is not sent a second time; the occasion and the name entered remain in your order and are stored like order data (first row) |
| Birthday gift: the "Sweetest wishes!" e-mail with a 10% discount code on your birthday (Store Terms and Conditions § 6) | day and month of birth, date on which the date was saved and changed, e-mail, first name, information on newsletter consent, code issued, its validity and use | Art. 6(1)(a) GDPR (consent: saving your date of birth in the "My Account" panel); we send the e-mail with the code only to people who have consented to commercial information (Art. 398 of the Act - Electronic Communications Law); record of codes issued - Art. 6(1)(f) GDPR (our legitimate interest: enforcing the "once a year" rule) | date of birth - until it is deleted in the "My Account" panel or by e-mail to sklep@batida.pl (withdrawal of consent), or until the account is deleted; unsubscribing from the newsletter suspends the gift, and the date remains saved until it is deleted. Record of codes issued - until the account is deleted; a code used in an order - like order data |
| The "How well do you know Batida?" quiz and the discount code from the quiz (Store Terms and Conditions § 6) | account identifier, quiz edition, questions drawn, your answers and score, code issued, its validity and use | Art. 6(1)(b) GDPR (participation in a promotion under the Store Terms and Conditions) | until the account is deleted - the record of participation is needed so that the quiz can be completed only once in a given edition; a code used in an order - like order data |
| Request for a review after a fulfilled order | e-mail, products purchased | Art. 6(1)(a) GDPR (consent) in conjunction with Art. 398 of the Act - Electronic Communications Law: we send the e-mail asking for a review only to people who have consented to receiving commercial information from us | once, within 30 days after the order is fulfilled |
| Publication of product reviews (Judge.me) | first name or pseudonym, content, rating, photo, e-mail (not published), information about the purchase | Art. 6(1)(b) GDPR (contract for the publication of the review, concluded by adding it) and point (f) (obligation to inform about the verification of reviews) | until the review is deleted by you or by us |
| Newsletter and other commercial information by e-mail | e-mail, first name (if you provide it), purchase history (to tailor the content) | Art. 6(1)(a) GDPR (consent) in conjunction with Art. 398 of the Act - Electronic Communications Law | until consent is withdrawn; then for up to 3 years in order to demonstrate that consent was given |
| Commercial information by SMS (Shopify Messaging) - only with a separate consent, independent of the consent to e-mails | phone number, first name (if you provide it), purchase history (to tailor the content) | Art. 6(1)(a) GDPR (consent) in conjunction with Art. 398 of the Act - Electronic Communications Law | until consent is withdrawn (e.g. by replying STOP); then for up to 3 years in order to demonstrate that consent was given |
| Loyalty programme (points, levels, rewards, codes, referrals, birthday bonus in points - separate from the birthday gift from the "My Account" panel) | e-mail, first and last name, purchase and points history, date of birth (day and month, optionally year), referral code | Art. 6(1)(b) GDPR (programme terms and conditions) | until you leave the programme or the programme ends; then until the limitation period for claims expires |
| Forms: Contact, HoReCa, Corporate catering, "Friday at the office", Custom cakes (cake designer), B2B enquiries | data provided in the form (first and last name, e-mail, phone, company, message, attachments, e.g. company logo or team birthday list) | Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) or point (f) (answering your enquiry) | until the matter is closed, no longer than 12 months from the last contact; if a contract is concluded - as for an order |
| Recruitment (Careers form, CV) | data from the form and from the CV | Art. 6(1)(c) GDPR in conjunction with Art. 22¹ of the Labour Code (data required by law) and point (a) (consent - other data you provide in your CV on your own initiative, and participation in future recruitment processes if you consent to it); civil-law contracts - point (b) | the CV is stored in a restricted-access resource and deleted automatically 180 days after it was submitted; earlier at your request |
| Handling correspondence and phone calls | contact details, content | Art. 6(1)(f) GDPR (legitimate interest: replying, documentation) | up to 12 months after the matter is closed, longer if the matter concerns a contract or claims |
| Store statistics and analytics (Google Analytics, Microsoft Clarity, Shopify statistics) | technical data, cookie identifiers, on-site behaviour (in Clarity - session recordings without form contents or payment data) | Art. 6(1)(a) GDPR (consent in the cookie banner); Shopify statistics to the extent necessary - point (f) | in line with the cookie retention periods (Cookie Policy), usually up to 26 months |
| Online marketing and ad measurement (Google Ads, Meta) | cookie and advertising identifiers, on-site events (e.g. purchase), encrypted e-mail for audience matching | Art. 6(1)(a) GDPR (consent in the cookie banner) | in line with the cookie retention periods; audience lists - until consent is withdrawn |
| Store security, prevention of abuse and payment fraud, server logs | IP address, technical data, order data | Art. 6(1)(f) GDPR (legitimate interest) and point (c) (payment regulations) | up to 12 months, longer in the event of proceedings |
| Internal sales and production reports (Batida Hub, boutique POS systems) | order data to the extent necessary for preparation and handover | Art. 6(1)(b) and (f) GDPR | like order data |
| Social media profiles (Facebook, Instagram, TikTok) | public profile data, content of comments and messages | Art. 6(1)(f) GDPR (communication with followers); the operators of the platforms are responsible for how the platforms operate | until the content is deleted by you or by us |
Where the basis is our legitimate interest (Art. 6(1)(f) GDPR), you may object on grounds relating to your particular situation; to direct marketing - at any time and without giving reasons.
4. Do you have to provide data
- Providing data is voluntary, but without the data marked as required we will not fulfil the order, create an account or answer an enquiry.
- A phone number is needed with an order so that the driver or the boutique can contact you; for a Wedding cake tasting - to arrange the date.
- Consents (newsletter, marketing SMS, analytics and marketing cookies, date of birth for the birthday gift, additional data in a CV) are voluntary and you can withdraw them at any time; withdrawal does not affect the lawfulness of earlier processing.
5. Data recipients
We share data only with entities that help us run the Store, to the extent necessary for their tasks, and on the basis of data processing agreements or as separate controllers where this follows from their role (e.g. payment operators, carriers). These are in particular:
| Recipient | Role | Notes |
|---|---|---|
| Shopify International Ltd. (Ireland) and Shopify group companies | store platform, customer accounts, order e-mails, newsletter (Shopify Email), marketing SMS with your consent (Shopify Messaging), statistics | data may also be processed in Canada and the USA (see section 6) |
| Payment operators available at checkout: Shopify Payments (Stripe, including Shop Pay), Klarna | handling payments by card, Shop Pay, Apple Pay, Google Pay, BLIK and Klarna; separate controllers with respect to payments | you provide payment data directly to the operator; we only see the payment status |
| DPD Polska sp. z o.o. | DPD Foods shipping (recipient's first and last name, address, phone, e-mail) | separate controller with respect to delivery |
| InPost sp. z o.o. | shipping of T-shirts by courier or to a Paczkomat parcel locker | separate controller with respect to delivery |
| Microsoft Ireland Operations Ltd. | hosting of the Batida Connect app (pick-ups, deliveries, e-mails to customers, loyalty programme, "My Account" panel: important dates, date of birth, invoice details, quiz and discount codes, as well as CVs from the Careers form) in the Azure cloud, and Microsoft 365 e-mail | the app runs in the West Europe region (the Netherlands) |
| Microsoft Clarity | behavioural analytics and session recordings (with consent) | |
| Google Ireland Ltd. | Google Analytics, Google Ads, Consent Mode | with consent in the cookie banner |
| Meta Platforms Ireland Ltd. | Meta pixel, ads on Facebook and Instagram | with consent in the cookie banner |
| Judge.me | product reviews | data of people adding reviews |
| Zapiet Ltd. | pick-up and delivery app (order date and location data) | until the full transition to Batida Connect |
| Essential Loyalty (Honeypop) | app running the loyalty programme (points, levels, discount codes) | |
| Cloudinary Ltd. | storage of files uploaded in forms (e.g. company logo for catering, cake inspiration) | |
| FoodSoft (POS sales system of the boutiques and the Pracownia pastry kitchen) | passing on orders for preparation and handover in the boutiques and the Pracownia pastry kitchen (first and last name, phone, order contents, date, pick-up location or delivery address) | POS system provider |
| Restimo | handling orders with our own delivery: passing on the address, phone number and delivery time window to the driver | delivery management system provider |
| Batida Hub (Supabase Inc.) | internal team app: overview of orders to be prepared and handed over | database in the EU region (Frankfurt) |
| Vercel Inc. | hosting of the b2b.batida.pl business account registration service | data of companies and contact persons |
| Accounting firm, law firm, providers of e-mail and office tools | accounting, advice, communication | to the extent necessary for their tasks |
We may also disclose data to public authorities where the law requires us to do so (e.g. the tax office, a court, the Police on an appropriate legal basis).
6. Transfers of data outside the European Economic Area
- Some of our providers (including Shopify, Microsoft, Google, Meta, Cloudinary, Judge.me, Supabase, Vercel) have their registered offices or servers also outside the EEA, mainly in the USA. In such cases the transfer takes place:
- on the basis of a decision of the European Commission finding an adequate level of protection (Art. 45 GDPR), including the EU-US Data Privacy Framework with regard to providers that have obtained certification, or
- on the basis of standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), with additional safeguards where needed.
- You can obtain a copy of the safeguards, or information on where they are available, by writing to sklep@batida.pl.
7. Your rights
- You have the following rights: access to your data and to a copy of it (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability of the data we process on the basis of a contract or consent (Art. 20), objection to processing based on legitimate interest, including marketing (Art. 21), and withdrawal of consent at any time (Art. 7(3)).
- To exercise your rights, write to sklep@batida.pl or by post. We will respond without undue delay, at the latest within one month; in complex cases we may extend this period by a further two months, and we will inform you of this. We may ask you to confirm your identity so that the data does not reach the wrong person.
- You can unsubscribe from the newsletter using the link in the footer of every message, and from marketing SMS - by replying STOP to any of them or by writing to sklep@batida.pl. You can change or withdraw your cookie consent at any time using the "Cookie settings" link at the bottom of every page of the Store - as easily as you gave it; you can also delete cookies in your browser (Cookie Policy). You can withdraw your consent to the processing of your date of birth by deleting the date in the "My Account" panel or by writing to sklep@batida.pl.
- You have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you believe that we process your data unlawfully.
8. Profiling and automated decisions
- We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.
- With your consent (newsletter, marketing cookies) we may tailor content and ads to your purchases and your behaviour in the Store (e.g. product reminders, audience segments). This is simple marketing profiling, to which you can object or for which you can withdraw your consent.
- The loyalty programme calculates points and levels automatically in accordance with the programme terms and conditions; this is not a decision with legal effects.
- The "My Account" panel calculates "Your café" and the "Your year with Batida" summary from your order history solely in order to show them to you in the panel; this does not produce any legal effects for you.
9. Data of gift recipients and other third parties (Art. 14 GDPR)
- If an order from Batida reached you as a gift, the person who placed the order may have given us your first and last name and phone number. We used them solely to hand over the order to you and to contact you during delivery. The source of the data is the person who placed the order. We store them together with the order data (section 3). You have the rights described in section 7.
- We treat in the same way the names and descriptions of people entered in the "Remind me in a year" service and in "Important dates" in the "My Account" panel (e.g. "Mum", "Kasia"; the source is the person who entered them, and we store them for as long as the reminder - section 3), as well as the data of people listed in team birthday lists in the "Friday at the office" service - we use them only to perform the service ordered by the customer.
10. Cookies
Information about cookies and similar technologies, their categories, purposes and how to manage your consent can be found in the Cookie Policy.
11. Security
- We apply technical and organisational measures appropriate to the risk: an encrypted connection (HTTPS), login with a one-time code, limited employee access to data, data processing agreements with providers, backups. We do not have access to full card numbers - they are handled by the payment operators.
- You are responsible for the security of your e-mail inbox to which we send login codes.
12. Children
The Store is intended for adults. We do not direct our services at children and do not knowingly collect their data.
13. Changes to the Policy
We may update this Policy when our services, providers or the law change. The current version is always available at batida.pl/pages/polityka-prywatnosci. We will inform you of significant changes in the Store or by e-mail.
