Privacy notice
Information under articles 13 and 14 GDPR. Version of 6 September 2026.
Controller
THE BILL BOYS spółka z ograniczoną odpowiedzialnością, ul. Borówkowa 8, 58-500 Jelenia Góra, Poland, KRS 0001203795. Contact for data matters: hello@thebillboys.pl. We have not appointed a data protection officer; we are not required to.
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone (optional), company and VAT ID (optional), billing address — entered on our checkout page | Concluding and performing the contract, provisioning and support, tax-correct payment processing, responding to complaints | Art. 6(1)(b) GDPR; art. 6(1)(c) for accounting records | Term of the service plus the statutory accounting retention period (5 years from the end of the tax year) |
| Order record (plans, amounts, time, order reference) | Order page, customer support, accounting | Art. 6(1)(b), (c) | As above |
| Technical data of your environment (server names, IPs, access logs) | Operating, securing and monitoring the service | Art. 6(1)(b), (f) | Term of the service plus 30 days; security logs up to 12 months |
| Messages sent through the contact form or the chat panel (name, email, message, IP address) | Answering your question | Art. 6(1)(f) — our legitimate interest in replying | 12 months after the last exchange |
| Session identifier (cookie) | Keeping your cart and protecting forms | Art. 6(1)(f); strictly necessary | Until the browser is closed |
| Remembered address (cookie, only if you tick the box) | Pre-filling the checkout next time | Art. 6(1)(a) — consent | 180 days or until you click “forget” |
| Website server logs (IP, time, page) | Security and error diagnosis | Art. 6(1)(f) | Up to 30 days |
Recipients
We collect your billing details ourselves and pass them to our payment service provider, which acts as merchant of record, processes the payment, applies the correct tax and issues the receipt; it is an independent controller for the payment and its own notice applies on its payment page. Your card or bank details are entered only on that page and never reach our servers. Other recipients are the data-centre operator that houses our equipment (within the EU) and, where legally required, tax and other authorities. Payment-method logos and the photographs on the site are loaded from two public content-delivery networks, which see your IP address when an image loads.
Data you store on the services
Personal data that you or your users place on a hosted environment is processed by us only on your instructions, as processor. A data-processing agreement under art. 28 GDPR is available on request.
Transfers outside the EEA
The payment provider may process data in the United States under the EU–US Data Privacy Framework or standard contractual clauses. We do not otherwise transfer data outside the EEA.
Your rights
You may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest; consent may be withdrawn at any time. Write to hello@thebillboys.pl. You can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or with the authority of your own country.
Automated decisions
We make no automated decisions with legal effect. The payment provider may use automated fraud screening on its own page.