Limited runs — made in PolandGrand Tour SS26 — now available
byCabo
Cart

Privacy policy

Last updated: 19 June 2026

This is an English translation provided for convenience. In the event of any discrepancy, the Polish-language version is legally binding.

Principles of the privacy policy

  1. This Privacy Policy sets out the principles for the processing of personal data obtained through the online shop operating in the bycabo.com domain, hereinafter referred to as the “Online Shop”.
  2. The owner of the Online Shop and, at the same time, the controller of personal data is byCabo Beata Stańczak, with its registered office in Gdańsk, 80-280 Gdańsk, ul. Norwida 4 lok. 207, NIP (tax identification number): 5832205318, REGON (statistical number): 221222710, e-mail: info@bycabo.com, hereinafter referred to as the “Controller” or “byCabo”.
  3. Personal data collected by byCabo through the Online Shop is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter referred to as the “RODO” (the General Data Protection Regulation, GDPR), and in accordance with the applicable provisions of law on the protection of personal data.
  4. byCabo takes particular care to respect the privacy of Customers and of the users visiting the Online Shop.
  1. byCabo processes the personal data of persons using the Online Shop, in particular Customers, persons placing orders, persons holding a Customer Account, Newsletter subscribers, persons contacting the Controller, persons submitting complaints and persons using the withdrawal form available on the “Right of withdrawal” page.
  2. Customers’ personal data is processed in particular for the following purposes:
    1. registering and maintaining a Customer Account in the Online Shop – the legal basis for the processing is that it is necessary for the performance of the contract for the provision of the Customer Account service, pursuant to Article 6(1)(b) of the RODO;
    2. accepting and fulfilling an order and concluding and performing a contract of sale – the legal basis for the processing is that it is necessary for the performance of the contract of sale, pursuant to Article 6(1)(b) of the RODO;
    3. handling payments, delivery, refunds and settlements relating to an order – the legal basis for the processing is the performance of the contract, pursuant to Article 6(1)(b) of the RODO, as well as compliance with the legal obligations incumbent on the Controller, pursuant to Article 6(1)(c) of the RODO;
    4. handling complaints, statutory warranty claims, the non-conformity of the Goods with the contract and other notifications concerning the Goods purchased – the legal basis for the processing is the fulfilment of obligations arising from the provisions of law, pursuant to Article 6(1)(c) of the RODO, and the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the RODO;
    5. handling declarations of withdrawal from the contract, including those submitted by means of the form available on the “Right of withdrawal” page at https://bycabo.com/odstapienie-od-umowy/ – the legal basis for the processing is the fulfilment of obligations arising from the provisions of law, pursuant to Article 6(1)(c) of the RODO, and the performance of activities connected with exercising the Customer’s rights arising from the contract of sale, pursuant to Article 6(1)(b) of the RODO;
    6. sending the Customer confirmation of receipt of the declaration of withdrawal from the contract on a durable medium, in particular to the e-mail address provided by the Customer – the legal basis for the processing is compliance with the legal obligations incumbent on the Controller, pursuant to Article 6(1)(c) of the RODO;
    7. handling the contact form and correspondence addressed to the Controller – the legal basis for the processing is the legitimate interest of the Controller consisting in conducting correspondence and replying to enquiries, pursuant to Article 6(1)(f) of the RODO;
    8. sending the Newsletter and marketing information, if the Customer has consented thereto – the legal basis for the processing is the consent of the data subject, pursuant to Article 6(1)(a) of the RODO;
    9. keeping accounts, issuing and storing accounting documents and fulfilling tax obligations – the legal basis for the processing is compliance with the legal obligations incumbent on the Controller, pursuant to Article 6(1)(c) of the RODO;
    10. establishing, pursuing or defending against claims – the legal basis for the processing is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the RODO;
    11. ensuring the security of the operation of the Online Shop, preventing abuse and carrying out technical and statistical analyses – the legal basis for the processing is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the RODO.
  3. When registering a Customer Account, the Customer may provide in particular the following data:
    1. first name and surname;
    2. e-mail address;
    3. telephone number;
    4. residential address or delivery address, including the street, house or flat number, postal code, town and country;
    5. the password to the Customer Account, stored in a secured form.
  4. When placing an order in the Online Shop, the Customer may provide in particular:
    1. first name and surname;
    2. e-mail address;
    3. telephone number;
    4. delivery address;
    5. billing address, if different from the delivery address;
    6. the data necessary to issue a sales document;
    7. in the case of Entrepreneurs, also the business name, the address at which the business is conducted and the NIP number.
  5. When using the withdrawal form available on the “Right of withdrawal” page, the Customer may provide in particular:
    1. the order number;
    2. the e-mail address used when placing the order;
    3. first name and surname, if required or provided voluntarily in order to facilitate identification of the request;
    4. information about the Goods to which the withdrawal from the contract relates;
    5. the content of the declaration of withdrawal from the contract;
    6. the data necessary to make a refund, if required in the given case;
    7. the date and time at which the declaration was submitted and the technical data connected with its transmission, if recorded by the Online Shop system.
  6. When using the contact form, the Customer may provide in particular their first name and surname, e-mail address, telephone number and the content of the message.
  7. When using the Newsletter, the Customer provides at least an e-mail address and, depending on the form, may also provide a first name or other data indicated in the subscription form.
  8. When the Shop’s Website is used, additional technical information may be collected automatically, in particular the IP address, the type of device, the type and version of the browser, the type of operating system, the date and time of the visit, the subpages visited, the source of entry to the site and other data connected with the use of the Online Shop.
  9. Navigational data may also be collected from users, including information about the links and references the user chooses to click on, or about other actions taken in the Online Shop. This data may be used in order to improve the functionality of the Online Shop, for statistical analysis, to ensure security and to optimise marketing activities.
  10. The provision of personal data is voluntary; however, failure to provide the data required in the forms may make it impossible to create a Customer Account, to place and fulfil an order, to handle a complaint, to handle a withdrawal from the contract, to contact the Controller or to use selected functionalities of the Online Shop.

§ 2 To whom is the data disclosed or entrusted and for how long is it stored?

  1. The Customer’s personal data may be transferred to entities whose services the Controller uses in operating the Online Shop, solely to the extent necessary to achieve the specified processing purposes.
  2. The recipients of personal data may in particular be:
    1. providers of hosting and server services;
    2. providers of the online shop system, plugins, technical tools and website maintenance services;
    3. electronic payment operators, banks and other payment service providers;
    4. courier and postal companies and entities handling the delivery of orders;
    5. entities providing accounting, tax, legal or advisory services;
    6. providers of systems for sending e-mail messages, handling forms, the Newsletter and communication with Customers;
    7. providers of analytical and marketing tools, if such tools are used in the Online Shop;
    8. entities supporting the Controller in handling complaints, returns and withdrawals from contracts;
    9. competent public authorities, where the obligation to disclose the data arises from the provisions of law.
  3. The service providers to whom personal data is transferred may, depending on the nature of the cooperation, act as processors processing the data on the Controller’s instructions or as separate controllers of personal data.
  4. In the event of a purchase being made in the Online Shop, personal data may be transferred to a courier company or a postal operator for the purpose of delivering the Goods ordered.
  5. Where electronic payment is selected, personal data may be transferred to the payment operator to the extent necessary to handle the payment, confirm the transaction and make any refund.
  6. Where payment via PayU is selected, personal data may be transferred, to the extent necessary to process the payment, to PayU S.A., with its registered office in Poznań, 60-166 Poznań, ul. Grunwaldzka 186, entered in the register of entrepreneurs of the KRS (National Court Register) under number 0000274399, NIP: 7792308495, REGON: 300523444.
  7. Where the Controller uses other payment operators, such as PayPal, card payments, BLIK or online transfers, personal data may be transferred to the relevant operators of those payments to the extent necessary to carry out the transaction.
  8. Personal data may be processed using tools supplied by third parties, in particular analytical, advertising or communication tools such as Google Analytics, Meta, Pinterest, Microsoft/Bing or other tools currently used in the Online Shop, provided that they have been implemented in the Online Shop and operate in accordance with the user’s consent settings.
  9. As a rule, personal data is processed within the territory of the European Economic Area. If, in connection with the use of particular tools or services, data is transferred outside the European Economic Area, the Controller applies the appropriate safeguards required by the provisions of the RODO, in particular standard contractual clauses or other mechanisms provided for by law.
  10. Customers’ personal data is stored for the following periods:
    1. data connected with the Customer Account – for the period during which the Customer Account is used and, after its deletion, for the period necessary to pursue or defend against claims;
    2. data connected with the fulfilment of an order and a contract of sale – for the period necessary to perform the contract and thereafter for the period required by the provisions of tax and accounting law and for the limitation period of any claims;
    3. data contained in accounting documents – for the period required by the relevant provisions of tax and accounting law;
    4. data connected with complaints, statutory warranty claims, the non-conformity of the Goods with the contract, returns and withdrawals from contracts – for the period necessary to handle the request and thereafter for the limitation period of claims or the period required by the provisions of law;
    5. data processed on the basis of consent, in particular for the purpose of sending the Newsletter – until the consent is withdrawn and, after its withdrawal, for the period necessary to demonstrate that the consent was given and withdrawn in accordance with the law;
    6. data processed on the basis of the legitimate interest of the Controller – for the period necessary to pursue that interest or until an effective objection to the processing is raised;
    7. technical data and data connected with the security of the operation of the Online Shop – for the period necessary to ensure security, detect abuse, carry out technical analysis and protect claims.
  11. Where a request is made by a competent public authority, the Controller may disclose personal data to such authorities, in particular to the courts, the public prosecutor’s office, the Police, the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), the Prezes Urzędu Ochrony Konkurencji i Konsumentów (President of the Office of Competition and Consumer Protection) or other authorities empowered under the provisions of law.
  1. The Online Shop uses cookie files and similar technologies. Cookies are small text files saved on the user’s terminal device, if the browser settings or the consents given so permit.
  2. Cookie files may be used in particular for the purpose of:
    1. ensuring the correct operation of the Online Shop;
    2. maintaining the user’s session after logging in;
    3. remembering the contents of the basket;
    4. handling the order placement process;
    5. remembering the user’s preferences;
    6. keeping statistics and analyses of the use of the Online Shop;
    7. carrying out marketing and remarketing activities, if the user has consented thereto;
    8. ensuring the security of the Online Shop.
  3. The Online Shop may use session cookies, which are deleted once the browser session ends, and persistent cookies, which remain on the user’s device for a specified time or until they are deleted.
  4. The Controller may use its own cookies and third-party cookies, in particular those of providers of analytical, advertising, social and payment tools.
  5. Analytical or marketing tools may be used in the Online Shop, such as Google Analytics, Meta Pixel, Pinterest Tag, Microsoft Advertising/Bing or other similar solutions, if they have been implemented in the Online Shop. These tools may use cookies or similar technologies in accordance with the user’s consent settings.
  6. The user may manage cookie files through the settings of their web browser. Restricting or disabling cookies may affect the operation of certain functions of the Online Shop, in particular the basket, logging in, placing an order or remembering preferences.
  7. The user may also manage consents relating to cookies by means of the consent management mechanism, if one has been made available in the Online Shop.
  8. The Controller may collect users’ IP addresses. The IP address may be used in particular to diagnose technical problems, ensure the security of the Online Shop, detect abuse, compile statistics and administer the Online Shop.
  9. The Online Shop may contain links and references to other websites. The Controller is not liable for the privacy protection principles applied by the owners of those websites.

§ 4 Rights of data subjects

  1. The data subject has the rights set out in the RODO, in particular:
    1. the right of access to personal data;
    2. the right to receive a copy of the personal data;
    3. the right to rectification of personal data;
    4. the right to erasure of personal data, that is to say the so-called right to be forgotten;
    5. the right to restriction of the processing of personal data;
    6. the right to data portability;
    7. the right to object to the processing of personal data;
    8. the right to withdraw consent at any time, where the data is processed on the basis of consent;
    9. the right to lodge a complaint with the supervisory authority.
  2. The withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal.
  3. Where data is processed on the basis of the legitimate interest of the Controller, the data subject has the right to object at any time to the processing of their personal data on grounds relating to their particular situation.
  4. Where personal data is processed for the purposes of direct marketing, the data subject has the right to object at any time to such processing. Raising an objection to direct marketing results in the processing of the data for that purpose being discontinued.
  5. A request for the erasure of personal data does not always mean the immediate erasure of all data. The Controller may retain data to the extent that its processing is necessary in order to comply with a legal obligation, to establish, pursue or defend against claims, or to maintain accounting, tax, complaint-related or other documentation required by the provisions of law.
  6. In order to exercise their rights, the data subject may contact the Controller by electronic mail at: info@bycabo.com or in writing at the Controller’s address.
  7. The Controller replies to a request without undue delay and no later than within one month of the date of its receipt. Where the request is complex in nature or where there is a large number of requests, that period may be extended by a further two months, of which the Controller will inform the data subject, stating the reasons for the extension.
  8. The data subject has the right to lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office) if they consider that the processing of their personal data infringes the provisions of the RODO or other provisions on the protection of personal data.

§ 5 Security management and the password

  1. The Controller applies appropriate technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
  2. The Online Shop uses an encrypted connection, in particular an SSL certificate, in order to increase the security of the transmission of data between the user and the Online Shop.
  3. The password to the Customer Account should be kept confidential and should not be disclosed to third parties. The Customer is obliged to keep the password confidential and to secure access to their Customer Account.
  4. In the event of the loss of the password, the Customer may use the password reset function available in the Online Shop. The Controller does not send requests for the password or other login details in e-mail messages.
  5. The Controller never asks the Customer to send the password to the Customer Account or the full details of a payment instrument.

§ 6 Amendments to the Privacy Policy

  1. The Privacy Policy may be amended, in particular in the event of a change in the provisions of law, a change in the functionality of the Online Shop, a change in the technical tools used or a change in the manner in which personal data is processed.
  2. The new text of the Privacy Policy will be published on the Shop’s Website.
  3. In matters connected with the Privacy Policy or with the processing of personal data, the Controller may be contacted at: info@bycabo.com.
  4. Date of last modification: 18.06.2026.
Back to top