Privacy Policy

Effective from: 2026-10-07 · v1.1

§1 Data controller

This is an English translation provided for convenience. The Polish version of this Privacy Policy is the legally binding one.

The controller of the personal data of people using the chocoyeee.pl website (the “Website”) is TRUDERS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (Truders limited liability company), with its registered office in Olsztyn, ul. Marii Zientary-Malewskiej 55, 10-310 Olsztyn, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000631235, tax ID (NIP) 7393887474, REGON 365107318 (the “Controller” or “we”). The Website presents the CHOCOYEEE Croissant product, which we distribute.

For any matters relating to personal data, you can contact us by email at biuro@truders.pl, by phone at +48 604 571 026 or in writing at our registered office.

We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR. If this changes, we will add their contact details to this Policy.

§2 What this Policy covers

This Policy explains what personal data we process in connection with the Website, for what purpose, on what legal basis, who we share it with and how long we keep it. In short:

  • the Website does not require creating an account or logging in; the presentation and the product sheet can be downloaded without providing any data;
  • we collect personal data mainly when someone sends the “Become our partner” form or contacts us;
  • we do not use analytics or advertising tools (e.g. Google Analytics, Meta Pixel) and we do not track the behaviour of visitors to the Website;
  • we do not sell personal data, we do not profile and we do not take automated decisions.

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), and PKE means the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).

§3 The “Become our partner” form

Data: full name, company name, email address, industry (vending, gas stations, retail chains, wholesale or other) and, if provided, phone number and message. Together with the submission we record the language version of the form, the date and time it was sent and the submission identifier assigned by the Website.

Purpose: replying to the enquiry, preparing a trade offer and discussing cooperation.

Legal basis:

  • Article 6(1)(f) GDPR - our legitimate interest in handling enquiries and in business contact with the companies on whose behalf the people filling in the form act;
  • Article 6(1)(b) GDPR - where the enquiry is sent by a business that is a natural person (e.g. a sole trader) and aims at concluding a contract with them; processing is then necessary to take steps at their request prior to entering into a contract.

How the data flows: the submission is passed through the Website server directly to Truders CRM (crm.truders.pl), the system in which we manage business contacts. The Website server does not store the content of the submission; only the submission identifier and the delivery status remain in its technical logs. The CRM runs on DigitalOcean servers in the Frankfurt (Germany) region, and traffic to it passes through the Cloudflare network, which protects the system against attacks.

Voluntary nature: providing data is voluntary, but the enquiry cannot be sent without the required fields (full name, company name, email, industry). Phone and message are optional.

Retention: until the enquiry has been handled and, if we start cooperating, until the cooperation ends. After that we keep the data until the limitation period for claims expires (as a rule 3 years for claims related to business activity and 6 years for other claims, counted to the end of the calendar year) or for a shorter time - until an effective objection is raised.

Form protection: to limit spam and abuse, the form is protected by the following safeguards:

  • submission limit - the Website server checks the number of submissions sent from a given IP address (5 submissions within 10 minutes). The IP address is used for this only in the server's working memory, is not stored or passed to the CRM, and disappears at the latest when the limit window ends;
  • hidden field and timing - the form contains a hidden anti-spam field, and the browser tells the server how much time passed between displaying the form and sending it; we do not store this value;
  • Vercel BotID - when the form is sent, the browser runs an invisible check that uses technical characteristics of the browser and device and the IP address to tell a person from an automated program. The check is carried out by our hosting provider, Vercel Inc.;
  • Cloudflare Turnstile - when the user approaches the form, we load the Cloudflare Turnstile service (Cloudflare, Inc.), which checks in the background whether the form is being filled in by a person. This is usually invisible; only when in doubt will Cloudflare ask the user to tick a box. For this purpose Cloudflare processes the IP address, browser data (including the User-Agent header) and the page address, solely to detect bots and not for advertising or profiling.

A submission that does not pass these safeguards is not sent to the CRM; only the reason for rejection, without the content of the submission, remains in the technical logs. Legal basis: Article 6(1)(f) GDPR - our legitimate interest in keeping the Website secure and protecting it against spam.

§4 Consent to contact and commercial information

Below the form there is an optional consent checkbox. Ticking it is not a condition for sending the enquiry or for handling it. The consent wording:

“I agree to be contacted by phone regarding my request. I agree to receive commercial information from Truders Sp. z o.o. (the CHOCOYEEE brand, www.chocoyeee.pl) by electronic means, including email and SMS, and to the use of email and phone for marketing purposes. I can withdraw my consent at any time.”

Purpose: contacting you by phone about your enquiry and sending commercial information about CHOCOYEEE products and Truders' offer by email, SMS and phone.

Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 398 PKE, which requires consent to the use of email, SMS and phone for direct marketing.

Proof of consent: we record consent in the CRM consent register separately for each channel (email, SMS, phone), together with the exact wording of the clause, the date it was given and the identifier of the submission it came from. If the checkbox is not ticked, no consent is recorded, a note about the lack of consent is added to the submission in the CRM, and we only reply to the enquiry.

Withdrawing consent: at any time, by email to biuro@truders.pl or by replying to a message received from us. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, nor the handling of the enquiry itself.

Retention: we use the data for marketing until consent is withdrawn. Information about giving and withdrawing consent (proof of consent) is kept until the limitation period expires for claims in which we might need to prove that consent was given.

§5 Contact by email, phone and WhatsApp

If someone emails us, calls us or contacts us via WhatsApp, we process the data provided in that correspondence (e.g. name, company, email address, phone number, content of the message) in order to reply and continue the conversation. Legal basis: Article 6(1)(f) GDPR (legitimate interest - conducting correspondence) and, for a business that is a natural person where the contact aims at concluding a contract, Article 6(1)(b) GDPR. The retention period is the same as for form data (§3).

The WhatsApp button on the Website (visible on business days between 8:00 and 16:00) is a plain link to the messenger. The Website does not pass any data to WhatsApp - the conversation is started by the user. The messenger provider (WhatsApp Ireland Limited, part of the Meta group) is a separate controller of the data processed within its service, under the terms of its privacy policy.

§6 Register of cookie decisions

Every decision made in the cookie panel (“Accept all”, “Reject” or saving custom settings), as well as any later change, is recorded in the consent register.

Data: a random browser identifier assigned at the first decision (consentId), the choices in each cookie category, the policy version, the date and time of the decision, the language version of the Website, information about the browser and system (user agent) and a hash (SHA-256) of the IP address computed with a secret salt. We do not store the raw IP address. The register does not contain a name or email address.

Purpose: accountability - being able to demonstrate whether and when a given browser gave, refused or withdrew consent to non-essential cookies.

Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 5(2) and 7(1) GDPR (obligation to demonstrate consent) and, to the extent that this obligation does not arise directly from the law, Article 6(1)(f) GDPR (our legitimate interest in demonstrating compliance).

How the data flows: the record is passed through the Website server to the Make integration platform (servers in the European Union), which saves it in a Google Sheets spreadsheet kept by the Controller.

Retention: for as long as the decision is valid and, after it is changed or withdrawn, until the limitation period expires for claims in which we might need to demonstrate compliance (the register serves as evidence; a change of decision creates a new entry rather than overwriting the previous one).

§7 Hosting, technical logs and error monitoring

Hosting: the Website and its server functions run on Vercel Inc. infrastructure. Each time a page is displayed, the server automatically records technical request data, including the IP address, date and time, page address and browser information. Purpose: delivering the Website, its security and diagnosing failures. Legal basis: Article 6(1)(f) GDPR (legitimate interest in the smooth and secure operation of the Website). Logs are kept for a short period set by the hosting provider, no longer than 30 days.

Error monitoring: we use Sentry, which records information about technical errors on the Website: the error message and trace (stack trace), the page address, the browser and system type and version; an IP address may appear in the request metadata. Sentry does not record sessions, does not store cookies on the device and is not used for analytics or marketing. Purpose: detecting and fixing failures. Legal basis: Article 6(1)(f) GDPR (legitimate interest in the security and proper operation of the Website). Error reports are kept, as a rule, for 90 days.

Fonts displayed on the Website are served from our own server - the browser does not connect to Google Fonts or any other external server for this purpose.

§8 Data stored in the browser

The Website stores in the browser only the information necessary for it to work: your cookie decision (local storage, key chocoyeee-consent) and, in some cases, the selected language version (session cookie NEXT_LOCALE). We do not use analytics or marketing cookies. Details, including retention periods and how to change your decision, are set out in the Cookie Policy.

§9 Recipients of data

We share data only with entities that help us run the Website and handle enquiries, under data processing agreements, and with entities authorised by law:

  • Vercel Inc. (USA) - hosting of the Website and its server functions, and protection of the form against bots (Vercel BotID);
  • DigitalOcean, LLC (USA; CRM servers in the Frankfurt region, Germany) - the infrastructure on which Truders CRM runs;
  • Cloudflare, Inc. (USA) - protection of the form against bots (Cloudflare Turnstile) and protection and delivery of traffic to Truders CRM;
  • Make (Celonis) - integration platform forwarding cookie consent register records, servers in the European Union;
  • Google Ireland Limited (with the involvement of Google LLC, USA) - the Google Sheets spreadsheet in which we keep the cookie consent register;
  • Functional Software, Inc. (Sentry) (USA) - technical error monitoring;
  • IT and email service providers of the Controller - to the extent needed to maintain systems and handle correspondence;
  • public authorities and other entities authorised by law - where the law requires the data to be disclosed.

We do not sell personal data and we do not share it with other entities for marketing purposes.

§10 Transfers outside the European Economic Area

Some of our providers (Vercel, DigitalOcean, Cloudflare, Google LLC, Sentry) are based in the United States or may access data from the USA. Data is transferred on the basis of:

  • the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework - for providers that participate in that framework;
  • standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) - in all other cases.

You can obtain a copy of the safeguards applied by writing to biuro@truders.pl.

§11 Retention periods - summary

  • form and correspondence data - until the enquiry and any cooperation have ended, then until the limitation period for claims expires (as a rule 3 or 6 years, counted to the end of the calendar year) or until an effective objection;
  • data used on the basis of marketing consent - until consent is withdrawn;
  • proof of giving and withdrawing marketing consent - until the limitation period expires for claims in which consent may need to be proven;
  • IP address used for the submission limit - not stored; it disappears from the server's memory at the latest when the 10-minute limit window ends;
  • register of cookie decisions - for as long as the decision is valid and, after it is changed or withdrawn, until the limitation period for claims expires;
  • server logs - no longer than 30 days;
  • technical error reports - as a rule 90 days;
  • data in the browser - as described in the Cookie Policy.

§12 Rights of data subjects

Every person whose data we process has the right to:

  • access their data and obtain a copy (Article 15 GDPR);
  • rectification of inaccurate data or completion of incomplete data (Article 16 GDPR);
  • erasure of data (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability for data processed on the basis of consent or a contract (Article 20 GDPR);
  • object to processing based on legitimate interest (Article 21 GDPR) - on grounds relating to their particular situation, and to processing for direct marketing at any time and without giving reasons;
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR);
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority of the EU Member State of their habitual residence, if they consider that we process their data unlawfully.

To exercise these rights, simply write to biuro@truders.pl or to our registered office. We reply without undue delay and no later than one month after receiving the request; in particularly complex cases this period may be extended by a further two months, in which case we will let you know. We may ask for additional information needed to confirm the identity of the person making the request.

The register of cookie decisions does not contain data that would allow us to identify a person without additional information. In such a case, handling a request may require providing the consent identifier stored in the browser (Article 11 GDPR).

§13 Automated decisions and profiling

We do not take decisions based solely on automated processing, including profiling, that would produce legal effects concerning anyone or similarly significantly affect them.

§14 External services

The Website contains links to the sklep.truders.pl online shop, the truders.pl website, the WhatsApp messenger and the brand's Instagram and Facebook profiles. The Website does not embed widgets of these services, so it does not pass any data to them until the user goes to them. Once there, the data is processed by their operators under their own privacy policies - for the sklep.truders.pl shop, the rules are set out in its separate privacy policy.

§15 Changes to this Privacy Policy

We update this Policy when the law, the way the Website works or our providers change. Before launching any analytics or marketing tools, we will update this Policy and the Cookie Policy and will run the relevant scripts only after consent has been given. The current version is always available in the footer of the Website.

The Polish version of this Policy is the binding one. This Policy is effective as of 1 October 2026.