Privacy Policy

Last updated: 4 June 2026

1. Introduction

XM Textiles Polska Sp. z o.o. ("we", "us", "our", or the "Company") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy ("Policy") explains how we collect, use, store, and disclose personal data in connection with the online store available at eshop.xmtextiles.com and the corporate website at www.xmtextiles.com (together, the "Services").

This Policy applies whenever you visit, register on, or purchase products from our Services. It does not apply to third-party websites linked from our Services.

2. Data Controller

The controller of your personal data is:

• XM Textiles Polska Sp. z o.o.
• Kontenerowa 21, 80-601 Gdańsk, Poland
• Registration number (KRS): 0000834417
• REGON: 385867002
• VAT ID (NIP): PL7312067986
• Email: info@xmtextiles.com
• Phone: +48 58 585 99 35

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Polish Personal Data Protection Act of 10 May 2018 (Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych), the Polish Telecommunications Act of 16 July 2004 (Prawo telekomunikacyjne, as amended), and other applicable Polish and EU data-protection law.

3. Personal Data We Collect

Depending on how you use our Services, we may collect:

• Identification and contact data: first name, surname, company name, billing and delivery address, telephone number, email address;
• Order and transaction data: products ordered, invoice details, payment confirmation (we do not store card numbers — payments are processed by Stripe under PCI-DSS), date and amount of payment, your marketing-consent preferences;
• Technical data: IP address, browser type, device information, traffic data (time, duration, pages visited), data collected via cookies and similar technologies;
• Communication data: content and recordings of telephone conversations with our customer service (see Section 8) and correspondence sent through email or contact forms;
• Other data you choose to provide voluntarily (e.g., in the "Comment" field at registration) or that you consent to provide for a specific purpose.

Providing personal data is voluntary; however, certain Services (such as placing an order) cannot be provided without it.

4. Purposes and Legal Bases of Processing

We process personal data only for clearly defined purposes and only on the legal bases set out in the GDPR:

• Performance of a contract — to register your account, conclude and execute the sales contract, deliver products, issue invoices, and handle returns and complaints (GDPR Art. 6(1)(b));
• Legal obligations — to comply with our accounting, tax, and reporting obligations under Polish and EU law (GDPR Art. 6(1)(c));
• Legitimate interests — to manage receivables and prevent fraud, to assess customer creditworthiness, to ensure the quality and security of our Services, to defend or pursue legal claims, and to inform existing customers about similar products (GDPR Art. 6(1)(f));
• Consent — for direct marketing via email and SMS, for non-essential cookies, and for any other purpose for which we ask you to opt in. You may withdraw consent at any time (GDPR Art. 6(1)(a) / Art. 7).

5. Recipients of Personal Data

We do not sell or rent your personal data. We disclose data to third parties only when necessary and on a lawful basis. Recipients may include:

• Couriers and logistics companies that deliver your order;
• Payment service providers (Stripe Payments Europe Ltd. is our payment processor);
• Auditors, legal and tax advisors;
• IT, hosting, email, and CRM/marketing-automation providers (acting as our processors under GDPR Art. 28);
• Newsletter and analytics providers (e.g., Google Ireland Ltd. for Google Analytics, only with your consent);
• Banks;
• Public authorities and law-enforcement agencies, where required by law;
• Debt-collection companies, where applicable.

All processors are bound by written agreements that require them to apply appropriate technical and organisational measures to protect personal data.

6. International Data Transfers

Where any of our processors transfer personal data outside the European Economic Area, we rely on appropriate safeguards under Chapter V of the GDPR, in particular the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• Order and accounting data — for the period required by Polish tax and accounting law (currently five years from the end of the relevant tax year);
• Account data — for the duration of your account plus the period required to handle any claims;
• Direct-marketing data — until you withdraw consent or object;
• Telephone-call recordings — three months from the date of the call (other call-related metadata: six months);
• Cookies — as set out in Section 8.

8. Use of Cookies

When you visit our Services we use cookies and similar technologies to deliver functionality (such as your shopping basket, login session, language and currency preferences), to analyse traffic, and — only with your consent — for marketing.

You can manage your cookie preferences at any time through our cookie banner (link "Cookie settings" in the footer) or through your browser settings. Blocking strictly necessary cookies may prevent parts of the Services from working.

The cookies we use:

For general information about cookies you may consult allaboutcookies.org.

9. Phone Calls Recording

For the purposes of internal administration, staff training, quality assurance, and the prevention or resolution of disputes, we may record telephone calls to and from our customer-service line. We record calls only with the caller's consent at the start of the call; metadata about calls (number, date, time, service requested) is collected on the basis of our legitimate interest in maintaining service quality. Recordings are stored for three months; other call metadata for six months. If you do not want a call to be recorded, please contact us by email at info@xmtextiles.com.

10. Direct Marketing

You can subscribe to our newsletter by entering your email address in the form at the bottom of any page of our Services. The legal basis is your consent (GDPR Art. 6(1)(a)). For existing customers, we may also send information about similar products on the basis of our legitimate interest (GDPR Art. 6(1)(f)). You can unsubscribe at any time by clicking the "unsubscribe" link in any of our emails or by writing to info@xmtextiles.com. We retain marketing data for up to five years from your last interaction or until you withdraw consent, whichever comes first.

11. Your Rights

You have the following rights under the GDPR in relation to your personal data:

• Access — to obtain confirmation of whether we process your data and to receive a copy (Art. 15);
• Rectification — to have inaccurate or incomplete data corrected (Art. 16);
• Erasure ("right to be forgotten") — to have your data deleted where one of the grounds in Art. 17 applies;
• Restriction of processing — in the circumstances set out in Art. 18;
• Data portability — to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller (Art. 20);
• Object to processing carried out on the basis of legitimate interest, including direct marketing (Art. 21);
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
• Lodge a complaint with the supervisory authority (see Section 12).

12. How to Exercise Your Rights — and Complaints

To exercise any of the above rights, please write to info@xmtextiles.com or to our postal address (see Section 2). Where required to verify your identity, we may ask for additional information. We will respond within one month from receipt of your request, in accordance with GDPR Art. 12(3).

You also have the right to lodge a complaint with the Polish supervisory authority:

• Urząd Ochrony Danych Osobowych (UODO)
• ul. Stawki 2, 00-193 Warszawa, Polska
• Tel: +48 22 531 03 00
• Email: kancelaria@uodo.gov.pl
• Website: https://uodo.gov.pl

13. Third-Party Websites

Our Services may contain links to third-party websites. We are not responsible for the privacy policies or data-handling practices of those websites. Please review their policies before providing any personal data.

14. Intellectual Property

All articles, descriptions, trademarks, brand names (including XM Textiles, XM FireLine, XM SilverLine, XM Accessories), logos, photographs, technical specifications, and other materials published on www.xmtextiles.com and eshop.xmtextiles.com are the intellectual property of XM Textiles Polska Sp. z o.o. or its licensors and are protected in accordance with the laws of Poland, EU intellectual-property law, and applicable international agreements. Reproduction, distribution, public display, or any other use without the prior written consent of XM Textiles Polska Sp. z o.o. is prohibited.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. The most recent version is always available at this URL, with the "Last updated" date at the top. Material changes will be communicated by email to registered account holders.

16. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• XM Textiles Polska Sp. z o.o.
• Kontenerowa 21, 80-601 Gdańsk, Poland
• Email: info@xmtextiles.com
• Phone: +48 58 585 99 35

See also our Terms & Conditions and Returns & Refunds Policy.