Privacy policy
Privacy and Cookies Policy for www.gabriellab2b.com
Effective from 7 September 2026.
This Policy explains what personal data we process in connection with the gabriellab2b.com wholesale website (including the account panel and login), why we do so and what rights you have. We have prepared it in accordance with the GDPR and the Electronic Communications Law.
The website is a B2B shop. Personal data mainly comprises the data of contact persons and persons logging in on behalf of a company, rather than the data of consumers using the gabriella.pl shop. The retail shop has a separate policy.
1. Data controller
The controller is:
- Gabriella D.B. Krajda Spółka jawna, ul. Brukowa 13, 91-341 Łódź,
- KRS: 0000485443, NIP: 9471983202, REGON: 101692400.
Contact regarding data: hello@gabriellab2b.com, tel. +48 500 257 259.
2. Your rights
You have the right to request:
- access to your data, including a copy (Article 15 GDPR),
- rectification (Article 16 GDPR),
- erasure (Article 17 GDPR),
- restriction of processing (Article 18 GDPR),
- transfer of data to another controller (Article 20 GDPR).
You also have the right to object:
- on grounds relating to your particular situation — to processing based on our legitimate interests (Article 21(1) GDPR),
- to direct marketing, including profiling (Article 21(2) GDPR).
Requests: hello@gabriellab2b.com. If you believe that we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office.
We cannot erase some data immediately if we are required to retain it (invoices, accounts, disputes).
3. What data we process
Depending on how you use the Website, we may process:
- the Business Customer’s company data: name, NIP tax identification number, registered address, delivery addresses, commercial terms (these identify the business; some of them are not personal data);
- data of contact persons and persons logging in: first name, surname, email address, telephone number, position;
- account and login data: email address used for the one-time code, login history, settings;
- order data: items, quantities, prices, delivery address, notes, history;
- payment and invoice data: due date, status, document numbers (we do not store full card numbers — the payment provider does so if you use a card);
- the contents of correspondence and enquiries;
- technical data: IP address, browser and device type, logs, cookies.
Sources: data provided by you or your company; data from our business customer records (we create the company account following verification); data collected automatically when the Website is used; service providers (e.g. the ecommerce platform).
4. Purposes, legal bases and retention periods
a) Creating and maintaining the company Account and logging in
Purpose: access to the Website, Price List and account panel.
Legal basis: a contract / steps taken before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest — managing the B2B relationship (Article 6(1)(f) GDPR), where the data subject is an employee or associate of the company.
Period: for the duration of the business relationship and until the limitation period for claims expires.
Consequence of not providing the data: inability to log in and make purchases on the Website.
b) Orders, delivery and invoices
Purpose: accepting and fulfilling an order, dispatch, invoicing (including KSeF) and accounts.
Legal basis: a contract (Article 6(1)(b) GDPR) and legal obligations, including tax and accounting obligations (Article 6(1)(c) GDPR).
Period: the duration of the contract, followed by the periods required by law (in particular, accounting documents — usually 5 years from the end of the year) and the period for pursuing claims.
c) Contact (questions, complaints, commercial terms)
Purpose: responding to and handling the matter.
Legal basis: a contract or steps taken before entering into a contract (Article 6(1)(b) GDPR), or a legitimate interest — B2B communication (Article 6(1)(f) GDPR).
Period: until the matter is concluded and the limitation period expires, or until an objection is upheld.
d) Commercial information (where consent has been given or we have an established B2B relationship)
Purpose: information about the range, new products and terms.
Legal basis: consent (Article 6(1)(a) GDPR) and Article 360 of the Electronic Communications Law, or a legitimate interest in communicating with an existing business customer (Article 6(1)(f) GDPR), within the limits of the law.
Period: until consent is withdrawn or an objection is made.
Withdrawal: using the link in the message or by emailing hello@gabriellab2b.com. This does not affect order handling.
e) Website analytics and marketing (cookies)
Purpose: statistics and — if enabled — advertising.
Legal basis: consent given through the cookie banner / cookie settings (Article 6(1)(a) GDPR), except for essential cookies.
Period: until the cookies expire, are deleted or consent is withdrawn.
f) Security and claims
Purpose: protecting the Website, preventing misuse, and establishing and defending claims.
Legal basis: Article 6(1)(f) GDPR.
Period: until the limitation period expires or an objection is upheld.
5. Profiling and automated decisions
We do not make decisions about you that produce legal effects solely by automated means. Prices are determined by the Price List assigned to the company, rather than by profiling behaviour on the Website.
If you consent to marketing cookies, we may tailor advertising messages. You can disable this in the cookie settings.
6. Recipients of data
Our employees and associates, as well as entities that process data on our behalf or to which we are required to disclose it, may access the data to the extent necessary:
- ecommerce platform and hosting provider (Shopify) — shop, checkout, code-based login, account panel;
- payment providers (if electronic payment is used for a given order);
- carriers and logistics providers;
- invoicing and KSeF systems;
- our internal systems for handling orders, stock and accounts;
- email and IT tool providers;
- analytics / advertising tools (e.g. Google Tag Manager / Google Analytics — if enabled on the Website);
- public authorities — where we are required to do so.
We do not sell personal data.
7. Transfers of data outside the EEA
Some providers (in particular Shopify) may process data outside the European Economic Area, including in Canada or the United States. We use mechanisms provided for by the GDPR: an adequacy decision or Standard Contractual Clauses (SCCs).
Information about processing by Shopify: https://www.shopify.com/legal/privacy and https://privacy.shopify.com/pl.
8. Security
We use organisational and technical measures appropriate to the risk, including connection encryption (SSL/TLS) and login using a one-time code instead of a permanent password. No security measure provides an absolute guarantee.
9. Cookies
1. The Website uses cookies and similar technologies. They do not change the device’s settings.
2. Cookies other than essential cookies require consent (GDPR and the Electronic Communications Law). You give consent through the banner displayed upon entry and can change it in the cookie settings, provided these are available on the Website.
3. Categories:
- essential — operation of the Website (session, basket, login, security); no consent required;
- analytics — how you use the Website (e.g. Google Analytics / GTM);
- marketing — tailoring messages, if enabled.
4. A detailed list (name, provider, purpose, duration) is available in the cookie settings panel if the Website displays it.
5. You can also restrict cookies in your browser. Blocking essential cookies may prevent you from logging in or placing an order.
10. Children’s data
The Website is intended for businesses and their employees. It is not directed at children. We do not knowingly collect data concerning minors.
11. Relationship with the retail shop
gabriella.pl (Gabriella Shops Sp. z o.o.) is a separate shop and a separate controller. This Policy applies exclusively to the wholesale business (gabriellab2b.com) and Gabriella D.B. Krajda Spółka jawna.
12. Changes to the Policy
We may update the Policy following changes in the law or tools. The current version, together with its effective date, is available on the Website.
13. Contact
Questions about data and the exercise of rights: hello@gabriellab2b.com, tel. +48 500 257 259, by post: Gabriella D.B. Krajda Spółka jawna, ul. Brukowa 13, 91-341 Łódź.
