Documents
Privacy policy
Effective from 1 November 2026 · version 1.0In short: we only collect the data needed to prepare a quote, handle your orders and invoice our services. We do not sell data. We process the data of buyers from your shop solely on your instructions.
This is a translation. The Polish version is binding: Polityka prywatności.
1. Controller
The controller of your data is Shopvil sp. z o.o., ul. Semaforowa 67/1, 52-115 Wrocław, Poland, NIP 8993068437, KRS 0001267119 – the company that owns the fulfil.pl brand and website. Contact regarding your data: info@fulfil.pl, phone +48 791 040 688 or by post to the registered office address.
2. What data we collect
- Quote form: full name, company, tax ID (NIP), email, phone, description of your needs.
- Email and phone contact: the data you give us.
- Cooperation: data of the client’s contact persons and client panel users (first name, last name, email, role).
- Calculator: calculates in your browser and does not store any data unless you send the result yourself.
- Emails sent by the website: information on delivery and opening of the message and on clicks on links (time, IP address, type of email client) – recorded by Brevo, our email delivery provider. For this purpose the message contains an invisible image and links go through Brevo’s server. We use this information only to check whether the message has arrived – not for marketing or profiling.
- Website: technical data and cookies (section 8).
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | How long |
|---|---|---|
| Preparing a quote and responding to an inquiry | steps taken prior to entering into a contract (Art. 6(1)(b) GDPR) | up to 12 months from the last contact |
| Concluding and performing the fulfillment contract, client panel | contract (Art. 6(1)(b) GDPR) | for the duration of the contract |
| Settlements, invoices, accounting | legal obligation (Art. 6(1)(c) GDPR) | 5 years from the end of the tax year |
| Checking email delivery (Brevo) | legitimate interest (Art. 6(1)(f) GDPR) | up to 1 month |
| Establishing and defending claims | legitimate interest (Art. 6(1)(f) GDPR) | until the claims become time-barred |
4. Data of buyers from our clients’ shops
When handling orders, we process the data of parcel recipients (full name, address, phone, email, order contents). The controller of this data is the shop – our client. We are the processor and act solely on the basis of a data processing agreement concluded with the shop. We retrieve orders from the shop’s Base or Apilo account, with its consent, and handle them in our warehouse management system, Shopvil 3PL (which also powers the client panel). Please direct any questions about this data to the shop you bought from.
5. Who we share data with
- Google Cloud Platform and Firebase (Google) – website and server hosting, data storage (inquiries in the Warsaw region, in the European Union),
- Google Workspace (Google) – company email, including correspondence with clients,
- Brevo (Sendinblue SAS, France) – sending emails from the website and recording their delivery, opening and link clicks,
- Cloudflare, Inc. (Turnstile) – protecting the website forms against bots,
- wFirma.pl – invoicing and accounting software of Shopvil sp. z o.o.,
- courier companies – to the extent needed to deliver the parcel.
We have data processing agreements with our service providers (except courier companies).
By law, invoice data is received by the National e-Invoicing System (KSeF, Polish Ministry of Finance) – this applies to invoices issued by Shopvil sp. z o.o..
6. Transfers outside the EEA
Google Cloud, Firebase, Google Workspace and Cloudflare may process data outside the European Economic Area. Such transfers comply with the GDPR and are based on:
- standard contractual clauses (SCC),
- the European Commission’s decision on the EU-US Data Privacy Framework – for entities certified under it,
- the providers’ technical and organisational safeguards.
7. Your rights
- access to your data and a copy of it, rectification, erasure, restriction of processing,
- data portability (where the basis is a contract or consent),
- objection to processing based on legitimate interest,
- withdrawal of consent at any time – without affecting the lawfulness of earlier processing,
- a complaint to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).
Providing data in the form is voluntary, but without it we cannot prepare a quote. We do not make decisions based solely on automated processing and we do not profile.
9. Changes to this policy
We will announce material changes on this page and also notify our clients by email. Previous versions are available on request.