Privacy Policy

1. Introduction

XM Textiles Polska Sp. z o.o. (“we”, “us”, “our”) respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy (“Policy”) explains how we collect, use, store and disclose personal data in connection with the online store at eshop.xmtextiles.com (the “Store”).

This Policy applies whenever you visit, register on or purchase Products from the Store. It does not apply to third-party websites linked from the Store.

2. Data controller

The controller of your personal data is:

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Polish Personal Data Protection Act of 10 May 2018 and other applicable Polish and EU data-protection law.

3. Personal data we collect

Depending on how you use the Store, we collect:

• Account data — name, company name, email address and password (stored only as a cryptographic hash), together with the delivery addresses you save to your address book;
• Order and transaction data — products ordered, delivery and invoice details, VAT number, order history and payment status. We do not store payment-card numbers — where card payment is offered, it is processed by Stripe under PCI-DSS;
• VAT status data — EU VAT numbers you provide are validated against VIES, the European Commission’s VAT Information Exchange System — the number is transmitted to that service to confirm your business status;
• Communication data — messages sent through the contact form and correspondence by email or telephone (see Section 9 on call recording);
• Technical data — minimal server logs (IP address, time, requested page) kept for security and diagnostics.

Providing personal data is voluntary; however, certain services — such as placing an order — cannot be provided without it.

4. Purposes and legal bases of processing

We process personal data only for clearly defined purposes and only on the legal bases set out in the GDPR:

• Performance of a contract — to register your account, conclude and execute the sales contract, deliver Products, issue invoices, send order confirmations and handle returns and complaints (GDPR Art. 6(1)(b));
• Legal obligations — to comply with our accounting, tax and reporting obligations under Polish and EU law (GDPR Art. 6(1)(c));
• Legitimate interests — to manage receivables and prevent fraud, to ensure the quality and security of the Store, and to defend or pursue legal claims (GDPR Art. 6(1)(f));
• Consent — for any purpose for which we explicitly ask you to opt in. You may withdraw consent at any time (GDPR Art. 6(1)(a) / Art. 7).

We do not use automated decision-making or profiling. Marketing e-mails (our newsletter about new fabrics, stock and offers) are sent only with your explicit opt-in, which you can withdraw at any time in your account or via the unsubscribe link in any newsletter.

5. Recipients of personal data

We do not sell or rent your personal data. We disclose data to third parties only when necessary and on a lawful basis. Recipients may include:

• couriers and logistics companies that deliver your order;
• payment service providers (Stripe Payments Europe Ltd.), where card payment is offered;
• our internal ERP and accounting systems, to which order data flows for fulfilment and invoicing;
• IT, hosting and email providers operating our infrastructure (acting as our processors under GDPR Art. 28);
• auditors, legal and tax advisors;
• banks;
• public authorities and law-enforcement agencies, where required by law.

All processors are bound by written agreements that require them to apply appropriate technical and organisational measures to protect personal data.

6. International data transfers

Where any of our processors transfer personal data outside the European Economic Area, we rely on appropriate safeguards under Chapter V of the GDPR, in particular the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. Data retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• order and accounting data — for the period required by Polish tax and accounting law (currently five years from the end of the relevant tax year);
• account data — for the duration of your account, plus the period required to handle any claims;
• telephone-call recordings — three months from the date of the call (other call-related metadata: six months);
• server logs — for a short rotation period;
• cookies and local storage — as set out in Section 8.

8. Cookies and local storage

The Store does not use tracking, analytics or marketing cookies today, and none will run unless you allow them in the cookie banner. Day to day we use only what is strictly necessary for the Store to function:

• xm_at — an httpOnly authentication cookie holding your short-lived sign-in token. It is set only when you sign in and expires after about 15 minutes;
• xm_rt — an httpOnly authentication cookie used to renew your session, valid for up to 30 days. It is set only when you sign in and is not readable by scripts;
• cart (local storage) — the contents of your shopping cart are stored locally in your browser and are not transmitted to us until you place an order.

Blocking these in your browser will prevent signing in and keeping a cart. No third party receives data from them.

The full list of cookies and browser storage we use — and the controls to change your choice at any time — is in our Cookie Policy.

9. Recording of telephone calls

For the purposes of internal administration, staff training, quality assurance and the prevention or resolution of disputes, we may record telephone calls to and from our customer-service line. We record calls only with the caller’s consent at the start of the call; metadata about calls (number, date, time, service requested) is collected on the basis of our legitimate interest in maintaining service quality. Recordings are stored for three months; other call metadata for six months. If you do not want a call to be recorded, please contact us by email at [email protected].

10. Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Access — to obtain confirmation of whether we process your data and to receive a copy (Art. 15);
• Rectification — to have inaccurate or incomplete data corrected (Art. 16);
• Erasure — (the “right to be forgotten”) — to have your data deleted where one of the grounds in Art. 17 applies;
• Restriction — of processing, in the circumstances set out in Art. 18;
• Data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller (Art. 20);
• Objection — to processing carried out on the basis of legitimate interest (Art. 21);
• Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
• Complaint — to lodge a complaint with the supervisory authority (see Section 11).

11. How to exercise your rights — and complaints

To exercise any of the above rights, please write to [email protected] or to our postal address (see Section 2). Where required to verify your identity, we may ask for additional information. We will respond within one month of receiving your request, in accordance with GDPR Art. 12(3).

You also have the right to lodge a complaint with the Polish supervisory authority:

12. Third-party websites

The Store may contain links to third-party websites. We are not responsible for the privacy policies or data-handling practices of those websites. Please review their policies before providing any personal data.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the Store or applicable law. The most recent version is always available at this URL, with the “Last updated” date at the top. Material changes will be communicated by email to registered account holders.

14. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

See also our Terms & Conditions and Returns & Refunds Policy.