Privacy policy

ONIVELLE™ PRIVACY POLICY

Online store: https://onivelle.pl
Last updated: 17 October 2026

§ 1. General information

This Privacy Policy sets out the rules for processing personal data and using cookies and similar technologies in connection with the ONIVELLE™ online store at https://onivelle.pl.

ONIVELLE™ sells women's clothing wholesale exclusively to verified business customers (B2B).

This policy covers people visiting the website, registering business accounts, placing orders, contacting ONIVELLE™ and using our communication channels. Personal-data protection applies to natural persons, including sole traders and people representing businesses.

§ 2. Data controller

The controller of personal data processed by ONIVELLE™ is:

ONIVELLE Edyta Ostrowski
ul. Michała Kajki 10/12
10-547 Olsztyn, Poland
NIP: 8491405815
REGON: 543635270
Email: biuro@onivelle.pl
Phone: +48 532 518 869
Website: https://onivelle.pl

Showroom and wholesale premises:
ONIVELLE™ Showroom
ul. Rzemieślnicza 35
Hala S, Box 131
95-030 Rzgów, Poland

For matters concerning personal-data processing, contact the controller directly at the email address above.

§ 3. Scope of personal data processed

Depending on how you use our services, we may process the following categories of data:

  • First and last name;
  • Business name and details of its representatives;
  • NIP, EU VAT number or other business identifiers;
  • Registered-office, business and delivery addresses;
  • Email address and telephone number;
  • B2B account and verification details;
  • Orders, invoices, payments and deliveries;
  • Correspondence and complaints;
  • Technical website-use data, including IP address, device identifiers and browser information;
  • Marketing consents and privacy preferences.

We process data to the extent appropriate for the particular purpose and legal basis.

§ 4. Purposes and legal bases of processing

1. B2B account registration and verification

Business-customer data are processed to confirm business activity, verify registration details and grant access to the wholesale offer.

The legal basis is Article 6(1)(b) GDPR where the data concern a person who is party to the contract, or Article 6(1)(f) GDPR where processing is necessary for the controller's legitimate interest in verifying business partners and preventing abuse.

2. Order fulfilment

Data are processed to accept and fulfil orders, prepare products, handle payments and shipping, and communicate about purchases. The legal basis is Article 6(1)(b) or (f) GDPR, depending on whether the person is party to the contract or represents a business.

3. Accounting and legal obligations

Data are processed for invoicing, accounting, tax obligations and other legal requirements. The legal basis is Article 6(1)(c) GDPR.

4. Inquiries and complaints

We process data to answer inquiries, consider complaints, handle returns and clarify disputes. The legal basis is Article 6(1)(b), (c) or (f) GDPR, as applicable.

5. Marketing and commercial communications

Data may be used to send information about products, collections, promotions and business cooperation where there is an appropriate legal basis and the requirements for consent to electronic communications have been met. The legal basis for personal-data processing may be Article 6(1)(a) or (f) GDPR, depending on the activity.

6. Analytics and security

Technical data may be used to secure the store, detect abuse and maintain functionality. Where analytics use technologies requiring consent, the user's appropriate consent is obtained.

§ 5. Shopify platform

The ONIVELLE™ store runs on Shopify. Shopify provides the technical infrastructure for displaying products, operating customer accounts, placing orders and managing sales.

Shopify and entities supporting Shopify's services may process data in connection with use of the store. The scope of processing, the parties' roles and international data-transfer arrangements are governed by the applicable Shopify terms of service and privacy policies.

Information about Shopify's data processing is also available at https://www.shopify.com/legal/privacy.

§ 6. Electronic payments

The ONIVELLE™ store offers electronic payment methods, including Paynow and PayPal.

Paynow

ONIVELLE™ has agreements for the Paynow service with:

  • mBank S.A., ul. Prosta 18, 00-850 Warszawa, Poland;
  • mElements S.A., ul. Prosta 18, 00-850 Warszawa, Poland.

Depending on the current payment configuration and service terms, data necessary to handle a transaction may be processed by the relevant payment-service provider.

PayPal Business

The store also uses PayPal. If PayPal is selected, necessary transaction information may be transferred to the relevant PayPal service provider. PayPal may process data as a separate controller to the extent defined by law and its own privacy policy.

PayPal privacy information: https://www.paypal.com/pl/legalhub/home.

Other payment methods

Depending on the store configuration, BLIK, instant online bank transfers, card payments, Google Pay, Apple Pay, Click to Pay and PayPo may be available.

Individual payment providers may process data necessary for transaction authorisation, settlement, complaints handling and abuse prevention.

ONIVELLE™ does not receive complete payment-card details to the extent that these are entered and processed directly by an independent payment provider.

§ 7. Deliveries and logistics companies

To fulfil orders, data needed to deliver parcels may be shared with courier and logistics companies, particularly:

  • InPost;
  • DHL;
  • FedEx;
  • DPD Polska;
  • UPS.

The data may include the business name, contact person's name, delivery address, telephone number, email address and shipment identifiers.

The information shared is limited to what is necessary for the particular delivery.

§ 8. Accounting and invoicing

ONIVELLE™ uses inFakt software and related services supporting invoicing and accounting.

Business-customer, invoice, order and payment data may be processed to meet accounting and tax obligations.

Data may also be disclosed to authorised accounting firms, advisers and public institutions where an appropriate legal basis exists.

§ 9. Google Workspace and Google services

ONIVELLE™ uses Google Workspace and other Google services for business operations, communications and its online presence.

Data may be processed through business email, document exchange, correspondence handling and management of business information.

ONIVELLE™ also maintains a presence in Google services, including Google Business Profile.

If Google Analytics, Google Ads or other analytics or advertising tools are used in the store, processing follows the required legal bases and consent settings.

Use of Google Workspace alone does not mean that all customer data are sent to Google's advertising tools.

§ 10. Social media and communications

ONIVELLE™ carries out communications and marketing activities using external online platforms, including:

  • Facebook;
  • Instagram;
  • TikTok;
  • YouTube;
  • Pinterest;
  • X (formerly Twitter);
  • Snapchat;
  • WhatsApp Business;
  • Twitch;
  • Apple Business and related Apple services.

Personal data may be processed when users send messages, post comments, follow profiles, participate in events, submit business inquiries or otherwise interact on these platforms.

Depending on the service, its provider may act as a separate data controller or in another role defined by applicable law and agreements.

Detailed processing rules are available in the platforms' own privacy policies. Using an ONIVELLE™ profile on a platform does not automatically mean that Shopify customer order data are shared with it.

§ 11. Forms, messages and customer service

The store may use registration forms, contact forms and communication tools, including Shopify Forms and Shopify Messaging.

Information submitted through forms and messages is used to handle the inquiry, contact the business customer, register an account or fulfil another stated purpose.

Providing data required for B2B account registration or order fulfilment is necessary to carry out those activities. Providing data in optional marketing forms remains voluntary.

§ 12. Cookies and similar technologies

The ONIVELLE™ store uses cookies and similar technologies. They may be used for:

  • Ensuring correct website operation and security;
  • Managing user sessions and login;
  • Remembering store preferences;
  • Operating the cart and checkout;
  • Statistics and analysis, where the relevant tools are used;
  • Advertising and measuring its effectiveness, where the relevant solutions have been enabled.

Cookies and technologies essential to provide the service may be used within the limits allowed by law. Other technologies requiring consent are used after that consent has been obtained.

Users can manage privacy settings through the mechanisms available in the store and their browser settings. Withdrawal of consent does not affect the lawfulness of activities performed before withdrawal.

The specific technologies used depend on the store's actual configuration and installed services.

§ 13. Recipients of personal data

Personal data may be disclosed, as appropriate, to:

  • Store infrastructure and hosting providers;
  • Payment providers;
  • Carriers and logistics companies;
  • Accounting software providers;
  • IT and technical service providers;
  • Email and communications providers;
  • Marketing and analytics providers, if used;
  • Legal, accounting and other professional advisers;
  • Public authorities where required by law.

Recipients receive data only to the extent justified by the disclosure's purpose and an appropriate legal basis.

§ 14. Transfers outside the European Economic Area

Some technology, communications and marketing service providers may process personal data outside the European Economic Area.

For international transfers, the controller applies the relevant requirements of Chapter V GDPR, including appropriate European Commission adequacy decisions or safeguards provided for by law, such as standard contractual clauses.

Information about specific transfers and the safeguards used may be requested from the controller.

§ 15. Data retention

Data are kept for a period appropriate to the purpose and legal basis of processing. In particular:

  • B2B account data: while the account is maintained and, after closure, to the extent necessary for legal obligations and the protection of claims.
  • Order and contract data: during contract performance and afterwards for the relevant claim limitation periods.
  • Tax and accounting records: for the periods required by applicable law, generally involving five-year periods whose calculation depends on the document and obligation concerned.
  • Correspondence: for the time necessary to handle the matter, then until the relevant period for pursuing or defending claims expires, where keeping the data is justified.
  • Consent-based marketing data: until consent is withdrawn or the specified purpose ends, with necessary consent evidence possibly retained for a period justified by law.
  • Technical data and cookies: for the period resulting from the technology's function and the store's actual configuration.

Data are not retained indefinitely merely because they have been provided to the controller.

§ 16. Rights of data subjects

Under the conditions specified in the GDPR, people whose personal data are processed have the right to:

  • Access their data;
  • Have data rectified;
  • Have data erased;
  • Restrict processing;
  • Data portability in the cases provided for by law;
  • Object to processing based on legitimate interests;
  • Withdraw consent where it is the basis of processing;
  • Lodge a complaint with the President of the Polish Personal Data Protection Office.

Requests to exercise these rights may be sent to biuro@onivelle.pl.

Certain rights may be restricted by applicable law, particularly legal duties concerning transaction records.

§ 17. Profiling and automated processing

ONIVELLE™ may use analytics and marketing features to assess interest in products and tailor communications to recipients, to the extent permitted by applicable law.

Use of marketing automation alone does not mean that ONIVELLE™ makes decisions producing legal effects concerning a user or similarly significantly affecting them.

Payment-service providers may independently make automated decisions concerning authorisation, security or the availability of particular payment methods, in accordance with their own terms.

§ 18. Data security

The controller uses appropriate organisational and technical measures to protect personal data against unauthorised access, loss, destruction and unlawful processing.

Access to data is limited to people and entities that need it to fulfil specific duties.

Users should also protect the passwords and access credentials for their B2B accounts.

§ 19. Changes to the Privacy Policy

This policy may be updated following changes to the law, the scope of the store's activities, services used or methods of processing data.

The current version is available at the appropriate address in the https://onivelle.pl store.

If the nature of a change requires separate notification to users or their consent, the controller will take the appropriate steps in accordance with applicable law.

§ 20. Contact

For matters concerning personal-data protection, privacy and cookies, please contact:

ONIVELLE
ul. Michała Kajki 10/12
10-547 Olsztyn, Poland
Email: biuro@onivelle.pl
Phone: +48 532 518 869
Website: https://onivelle.pl

Marketing communications: email, SMS and WhatsApp

Communication rules updated: 27 October 2026

ONIVELLE Edyta Ostrowski (ONIVELLE™) sends commercial information about its products, new collections, availability and offers only to recipients who have previously consented to marketing through the relevant channel, including B2B customers. Email consent does not include SMS or WhatsApp. Providing contact details, registering, purchasing, accepting the Terms or contacting us about an order does not constitute marketing consent.

Subscription is voluntary and free. It is not a condition of registration, company verification, wholesale prices or purchases. Recipients choose their marketing channels; consent boxes must not be preselected. SMS or WhatsApp marketing may start only after appropriate consent has been obtained and documented and an opt-out process is available. Describing a channel here does not mean it is already operating.

Recipients may withdraw consent at any time, free of charge and without giving a reason: for email, through the unsubscribe link in every marketing email; for SMS, through the opt-out link provided in the message; for WhatsApp, by replying STOP or clearly requesting that marketing stop. Opt-out requests for any channel may also be sent to biuro@onivelle.pl. No login or closure of the B2B account is required. A request to stop all marketing covers all channels. Further marketing within the scope of the withdrawal or objection is stopped. Withdrawal does not affect the lawfulness of earlier processing or prevent essential non-promotional messages about account verification, orders, payments, delivery and complaints.

For electronic marketing we process the email address or phone number and channel and consent information under Article 6(1)(a) GDPR, taking account of Articles 398 and 400 of the Polish Electronic Communications Law. Consent evidence may include its wording and version, date, source, scope and contact identifier; withdrawals are also recorded. Sending data is used until withdrawal or the end of its purpose. Necessary evidence and minimal suppression-list data may subsequently be retained only as long as needed to demonstrate compliance, protect against claims and honour opt-outs under Article 6(1)(f) GDPR. Suppression lists are not used for advertising. Recipients, international transfers and data-subject rights are described in the Privacy Policy.

Email and forms involve Shopify and email infrastructure providers, including Google Workspace, to the extent actually used. WhatsApp Business also involves its provider, WhatsApp Ireland Limited in the EEA, processing contact details and messages according to its role and terms. Any SMS sending provider must be included in the privacy information before the service starts.

Updating these documents does not subscribe anyone, renew withdrawn consent or broaden existing consent. Previously valid consents remain effective only within their original scope. People who did not consent, declined or unsubscribed remain excluded from the relevant marketing unless they give new voluntary consent. Questions, opt-outs and complaints about communications can be sent to biuro@onivelle.pl.