Privacy policy
This is a translation for convenience; the Polish version is binding.
Effective from: 30.10.2026
1. Data controller
The controller of your personal data is TULSI spółka z ograniczoną odpowiedzialnością, registered office in Opole, Rynek 2/1A, 45-015 Opole, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0001031706, NIP (tax ID) 7543359163, REGON 525075951 (the “Controller”). The Controller runs the Bali 16 shop, Oleska 16, 45-052 Opole, and the website bali16.pl.
Contact on personal data matters: bali16vibes@gmail.com or by post to the registered office address. The Controller has not appointed a data protection officer.
2. What data we collect
When you send a product request through the form, we process: your full name, phone number, e-mail address and the list of products you ask about. Providing the data is voluntary, but without a name and contact details we cannot answer the request.
While you use the website, technical data is also collected automatically: IP address, browser and device type, pages visited and cookies (details in the Cookie policy).
3. Purposes and legal bases of processing
- Handling your request (checking availability, preparing products for pickup, contacting you) – Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract – until the request is handled, then 12 months.
- Providing the form service under the Terms – Art. 6(1)(b) GDPR, performance of a contract for services provided electronically – for as long as you use the service.
- Establishing, pursuing or defending claims – Art. 6(1)(f) GDPR, the Controller’s legitimate interest – until the limitation periods expire.
- Visit statistics (Google Analytics) – Art. 6(1)(a) GDPR, your consent – until consent is withdrawn, at most 14 months.
- Measuring ad performance (Google Ads) – Art. 6(1)(a) GDPR, your consent – until consent is withdrawn, at most 13 months.
- Keeping the website secure and working – Art. 6(1)(f) GDPR, the Controller’s legitimate interest – up to 12 months.
A sales contract is concluded only in the shop, at pickup and payment. Data given in the form is not used to issue sales documents.
4. Recipients of data
Your data may be received only by entities that help us run the website, under data processing agreements or as separate controllers:
- hosting provider: SEOHost (website and server hosting),
- e-mail provider: Google Ireland Limited (Gmail),
- Google Ireland Limited – Google Analytics and Google Ads, only if you give consent,
- entities authorised by law, at their request.
5. Transfers outside the EEA
Because we use Google services, data may be transferred to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, on the basis of which the European Commission has found an adequate level of data protection. Standard contractual clauses approved by the European Commission are also applied.
6. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify your data,
- erase your data,
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal; you can withdraw cookie consent through the “Cookie settings” link in the footer.
To exercise your rights, write to bali16vibes@gmail.com. We will reply within one month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.
7. Automated decisions
We do not make decisions about you based solely on automated processing, and we do not use profiling that produces legal effects. Google Ads may use cookie data to tailor ads, only after you give consent.
8. Changes to this policy
We may update this policy, e.g. when the law or the website’s features change. The current version, with its effective date, is always available at bali16.pl/privacy.