Privacy policy

Last updated: 27.09.2026

www.eltrike.eu — information on the processing of personal data (Articles 13 and 14 GDPR)

§ 1. Controller

1. The controller of your personal data is HService, ul. Jagodowa 13c, 44-109 Gliwice, Poland, Tax ID (NIP) 969-166-40-25 (“we” or the “Controller”).

2. For any matter concerning personal data you can write to office@hservice24.pl or to our registered address.

3. This policy covers www.eltrike.eu — the online store, blog, forum and gallery — and contact with us. “GDPR” means Regulation (EU) 2016/679.

§ 2. What data we process

1. Depending on what you use, we process:

account: username, e-mail address, password (only as a cryptographic hash), chosen language and two-step login settings;
orders: name, e-mail address, phone number and delivery address and, if you want an invoice, company name, tax ID and billing address; order and payment history (we never receive card details — the payment operator handles them);
forum: the threads, replies, photos and videos you publish, together with your username;
newsletter: e-mail address, the date and wording of the consent given and a hash of the IP address it was given from;
product availability alerts: e-mail address;
notices of illegal content and personal data requests: the data entered in the form;
proof of acceptance of the terms: document version, date and a hash of the IP address;
technical data: IP address, browser and device information, and records of security events (logins, failed login attempts, actions in the admin panel).

§ 3. Purposes and legal bases

1. We process data for the following purposes:

concluding and performing the sales contract, delivery, handling withdrawals and complaints — Article 6(1)(b) GDPR;
running your account and providing electronic services (cart, forum, availability alerts) — Article 6(1)(b) GDPR;
issuing invoices, bookkeeping and tax obligations — Article 6(1)(c) GDPR;
handling notices of illegal content and other obligations under the Digital Services Act — Article 6(1)(c) GDPR;
handling your GDPR rights and demonstrating consents given and documents accepted — Article 6(1)(c) GDPR;
sending the newsletter — your consent (Article 6(1)(a) GDPR), confirmed by clicking a link sent to the address given; you can withdraw it at any time using the link in every message;
security of the site and protection against abuse (attempt limits, temporary account lock after failed logins, security log, scanning of uploaded files) — our legitimate interest (Article 6(1)(f) GDPR);
forum moderation — performance of the terms (Article 6(1)(b) GDPR) and our legitimate interest (Article 6(1)(f) GDPR);
our own visit statistics (§ 8) — our legitimate interest (Article 6(1)(f) GDPR);
establishing, pursuing and defending claims — our legitimate interest (Article 6(1)(f) GDPR).

§ 4. Where your data comes from

1. You provide most data yourself in the site’s forms. Technical data is collected automatically by our server. We receive payment status information from the payment operator.

§ 5. Who receives your data

1. Your data is received only by those without whom we could not provide our services:

PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal payments;
Revolut Bank UAB (Lithuania) — Revolut payments; we pass on your name, e-mail address, phone number and delivery address;
DPD Polska sp. z o.o. — delivery of the parcel; we pass on your name, address, phone number and e-mail address;
OVH (OVHcloud) — provider of the server the site runs on; the server is located in Warsaw (Poland);
home.pl S.A. — sending e-mails;
cyber_folks S.A. — storage of encrypted backups;
providers of accounting and legal services to us, and public authorities where the law requires it.

2. The payment operators act as separate controllers, under their own privacy policies.

3. Content you publish on the forum, together with your username, is visible to everyone visiting the site.

§ 6. Transfers outside the European Economic Area

1. We do not transfer your data outside the European Economic Area ourselves. There are, however, three situations in which your browser connects directly to services of companies outside that area or belonging to their groups:

YouTube video thumbnails — on article and product pages with videos, thumbnails are loaded from Google’s servers when the page is displayed, without any click; your browser then passes your IP address and browser information to Google. The data may reach Google LLC in the USA, which participates in the EU-U.S. Data Privacy Framework (a European Commission adequacy decision);
video playback from YouTube (in privacy-enhanced mode), Vimeo, TikTok or Instagram starts only after you click; from then on the platform operator processes data under its own rules and may set cookies and transfer data outside the EEA;
the PayPal payment page loads the PayPal script; PayPal processes data as a separate controller and may transfer it outside the EEA under its own privacy policy.

§ 7. How long we keep data

order and invoice data — 5 years from the end of the calendar year in which the invoice was issued and, in the event of a dispute, until it is resolved;
account — until it is deleted; deletion takes place 7 days after the request (you can withdraw it in that time); data of orders in progress and data subject to tax obligations are kept for the periods stated above;
forum posts — until they are deleted; when an account is deleted, posts may remain on the forum with no link to you, and at your request we also delete their content;
newsletter — until consent is withdrawn; sign-ups not confirmed via the link are deleted after 30 days;
data of a person reporting illegal content — 180 days after the decision on the notice;
personal data requests not confirmed via the link — 30 days;
security log — 24 months;
technical logs of the application server — up to 90 days;
visit statistics — 425 days (§ 8);
proof of acceptance of the terms and of consents — as long as needed to demonstrate them, and no longer than the limitation period for claims;
backups — encrypted and replaced by newer ones; we keep the last fifteen or so.

§ 8. Visit statistics

1. We keep our own visit statistics, without cookies and without external tools (we do not use Google Analytics or similar services).

2. We record the page visited, the domain of the page you came from, campaign parameters in the address (UTM), the type of device, and a cryptographic hash of your IP address and browser. The hash changes every day, so it cannot be used to recognise you on later days. We do not share the statistics with anyone.

§ 9. Cookies

1. We use only cookies that are necessary for the site to work. We do not use analytics or advertising cookies.

session identifier — keeps you logged in and keeps your cart during a visit; expires when the browser is closed, and the session ends after 30 minutes of inactivity;
REMEMBERME — remembers your login, only if you tick “Remember me on this device”; 30 days; contains your account identifier;
shop_cart_state — contents of your cart; 7 days;
portal_consent — your choice in the cookie banner; 365 days;
form protection (a cookie with the __Host- prefix) — protects against requests forged in your name; until the end of the session.

2. Cookies may also be set by PayPal on the payment page and by video platforms after you click on a video (§ 6).

3. You can change your choice at any time with the “Cookie settings” link in the page footer. Details are in the Cookie policy.

§ 10. Forum and user content

1. Posts, photos and videos published on the forum are public and shown under your username. We check uploaded files with antivirus software and convert videos into a format that plays in the browser.

2. Posts with photos or videos may need a moderator’s approval before they appear. We may restrict content that breaches the law or the terms — the rules are set out in the procedure for reporting illegal content.

§ 11. Your rights

1. You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability and to object to processing based on our legitimate interest. You can withdraw consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

2. How to exercise your rights:

with an account — in the privacy centre in your account settings: you can download your data, ask for order data to be rectified or delete your account;
without an account (e.g. after a guest purchase) — using the data request form; you confirm the request via a link sent to the e-mail address you give;
restriction of processing, objection and anything else — by e-mail to office@hservice24.pl.

3. We reply without undue delay and at the latest within one month of receiving the request.

4. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority of the EU country where you live.

§ 12. Do you have to provide data

1. Providing data is voluntary, but the data marked as required in the forms is necessary to create an account or to conclude and perform the contract — without it we cannot fulfil the order. Invoice data is required by law if you want an invoice. Signing up for the newsletter is entirely voluntary.

§ 13. Automated decisions

1. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

§ 14. Security

1. The site works only over an encrypted HTTPS connection. We store passwords as cryptographic hashes, login can be protected with a code sent by e-mail, and after several failed login attempts the account is temporarily locked. We scan uploaded files with antivirus software, encrypt backups, and only authorised persons have access to the admin panel.

§ 15. Our social media profiles

1. We have profiles on Facebook, YouTube and TikTok — the links are in the page footer. They are ordinary links: no data reaches these services until you click them.

2. If you visit our profile, comment or write to us, we process your data to the extent visible to us on the profile, in order to run the profile and reply to messages — on the basis of our legitimate interest (Article 6(1)(f) GDPR). The operators of these services process data under their own rules; for Facebook page statistics, Meta Platforms Ireland Ltd is a joint controller.

§ 16. Changes to this policy

1. We update this policy when the way we process data or the law changes. The date of the last change is shown at the top of this page.

Privacy policy

We respect your privacy