Privacy Policy

Last updated: 12 October 2026

This policy explains what personal data we process, why, on what legal basis and for how long, and what rights you have. It applies to the online shop at gtg.com.pl (in all language versions), purchases of our products on Allegro, communication with us and our social media profiles.

This is an English translation of the Polish-language Privacy Policy. If there is any discrepancy between the two versions, the Polish version prevails.

1. Data controller and contact details

The controller of your personal data is Daniel Rausz, running a business under the name GINGER'S TACTICAL GEAR DANIEL RAUSZ, registered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. gen. Bora-Komorowskiego 24, 80-377 Gdańsk, Poland, VAT ID (NIP) PL5842753406, REGON 365466678 ("GTG", "we", "us").

For any matters relating to personal data, you can contact us:

• by email: gtg@gtg.com.pl,
• by phone: +48 58 742 48 48,
• by post: at the address above, preferably marked "Personal data".

2. What data we process, for what purposes and on what legal basis

The data we process depends on how you use the shop or contact us. We process only the data needed for a given purpose. Retention periods for each purpose are listed in section 6. "GDPR" means Regulation (EU) 2016/679.

2.1. Customer account

Purpose: creating and maintaining your account, giving you access to your order history and letting you manage your data. Data: first name, last name, email address, login details and any data you add to your account (e.g. delivery addresses). Legal basis: Article 6(1)(b) GDPR – performance of the account service agreement.

2.2. Orders, payments, delivery and after-sales service

Purpose: accepting and fulfilling your order, handling payment and delivery, contacting you about your order, withdrawals, returns, exchanges, complaints and warranty claims. Data: first and last name, email address, phone number, delivery address, order details, payment information (e.g. payment method and status) and information needed to handle your request. We do not have access to your full payment card details – these are processed by the payment provider. Legal basis: Article 6(1)(b) GDPR – performance of the sales contract; Article 6(1)(c) GDPR – compliance with legal obligations, in particular under consumer law.

If you choose deferred payment with Klarna, Klarna processes your data as a separate controller, including to assess your creditworthiness, as described in its own privacy policy.

2.3. Invoices and tax obligations, including KSeF

Purpose: issuing and storing invoices and other accounting documents, tax settlements. Data: data required by law to issue an invoice, e.g. name or company name, address, VAT ID. Legal basis: Article 6(1)(c) GDPR – compliance with tax and accounting obligations.

Invoices for businesses are issued in the Polish National e-Invoicing System (KSeF), operated by the Head of the National Revenue Administration. Invoices for consumers may be issued outside KSeF. Invoices submitted to KSeF are stored in that system for the period required by Polish VAT law.

2.4. Enquiries and correspondence

Purpose: responding to messages sent by email, phone, contact form or messenger, and handling correspondence. Data:contact details and the content of your message. Legal basis: Article 6(1)(f) GDPR – our legitimate interest in responding to enquiries; where the message concerns entering into or performing a contract – Article 6(1)(b) GDPR.

2.5. Discount for uniformed services

Purpose: verifying eligibility for and granting the discount under the terms of the "Discount for uniformed services" promotion. Data: first and last name, email address, information about your service and a document confirming your membership of it. Legal basis: Article 6(1)(b) GDPR – steps taken at your request in connection with the promotion.

Please send only the information needed for verification. Before sending a document, cover any data we do not need, such as your photo, national ID number and document number.

2.6. Newsletter and email marketing

Purpose: sending a newsletter with news about new products, promotions and events at GTG. Data: email address and, if you provide it, your first name; information about email opens and clicks, which helps us tailor our content. Legal basis:Article 6(1)(a) GDPR – your consent. We send commercial information by electronic means only with the consent required by the Polish Electronic Communications Law.

You confirm your subscription by clicking the activation link in the email we send you. You can withdraw your consent at any time using the "unsubscribe" link in every newsletter or by writing to gtg@gtg.com.pl. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

2.7. Back-in-stock notifications

Purpose: notifying you by email when a selected product is available again. Data: email address and product information. Legal basis: Article 6(1)(b) GDPR – providing the service you requested.

2.8. Purchases on Allegro

If you buy our products on Allegro, Allegro provides us with the data needed to fulfil your order: name, delivery address, email address, phone number and, if you request an invoice, your invoicing details. We process this data for the purposes and on the legal bases described in sections 2.2–2.4. Allegro processes your data as a separate controller under its own privacy policy.

2.9. Wholesale customers, institutions and distributors

Purpose: business communication, preparing offers, entering into and performing contracts with companies and institutions. Data: name, job title, business email address and phone number of contact persons. We receive this data from you or from the organisation you represent. Legal basis: Article 6(1)(f) GDPR – our legitimate interest in communicating with business partners and performing contracts; where you enter into the contract in your own name – Article 6(1)(b) GDPR.

2.10. Social media

We run profiles on Facebook, Instagram and YouTube. If you follow our profile, comment or message us, we process your profile name, the content of your comments and messages, and publicly available information from your profile. Purpose:running our profiles, communicating with followers, replying to messages and profile statistics. Legal basis: Article 6(1)(f) GDPR – our legitimate interest in promoting our brand and communicating with our audience.

For Page Insights on Facebook and Instagram, we are joint controllers with Meta Platforms Ireland Ltd. Social media platforms also process your data for their own purposes, as described in their privacy policies.

2.11. Legal claims, security and fraud prevention

Purpose: establishing, pursuing and defending legal claims, detecting fraud and abuse, protecting the shop and its users. Data: order data, correspondence and technical data relevant to the matter. Legal basis: Article 6(1)(f) GDPR – our legitimate interest in protecting our rights and keeping the shop secure.

2.12. Technical data, analytics and advertising

When you use the shop, we process technical data such as your IP address, cookie identifiers, browser and device information, pages visited and traffic source.

• Shop operation and security (e.g. session, cart, login, language and currency) – Article 6(1)(f) GDPR, our legitimate interest in keeping the shop running and secure.
• Analytics and statistics (Google Analytics, Shopify analytics) – Article 6(1)(a) GDPR, your consent.
• Advertising and remarketing (Google Ads, Meta Pixel) – Article 6(1)(a) GDPR, your consent.

We activate analytics and advertising tools only after you give consent in the cookie banner. See section 7 for details.

3. Do you have to provide your data?

Providing data is voluntary. However, without the data marked as required in our forms, we cannot create an account, fulfil an order, issue an invoice or grant a discount. If providing data is required by law (e.g. invoicing details), we will tell you in the form or while handling your request.

4. Who we share your data with

We share data only to the extent necessary for a given purpose. The recipients of your data are:

• Shopify International Limited (Ireland) – shop platform and hosting provider;
• payment service providers handling payments in the shop (cards, BLIK, Przelewy24, Apple Pay, Google Pay and other methods available at checkout) and the bank that holds our account;
• Klarna – for deferred payments, as a separate controller;
• courier and logistics companies: DPD Polska sp. z o.o., InPost sp. z o.o. and, for international shipments, the carriers delivering your parcel;
• Allegro.pl sp. z o.o. – for purchases on Allegro;
• our accounting firm and providers of accounting and invoicing systems;
• IT service providers, including email, newsletter and file storage services;
• Google Ireland Limited and Meta Platforms Ireland Ltd – for analytics, advertising and social media, if you have given consent or use our profiles;
• legal advisers – where needed to protect our rights;
• public authorities, e.g. tax authorities, courts and law enforcement – where required by law.

We sign data processing agreements with providers that process data on our behalf.

If you use Shop Pay or the Shop app, Shopify also processes your data as a separate controller. For details, see Shopify's privacy policy.

5. Transfers of data outside the European Economic Area

Some of our providers (e.g. Shopify, Google, Meta) may process data outside the European Economic Area (EEA), in particular in Canada and the United States. We transfer data only with the safeguards required by Chapter V GDPR, in particular on the basis of:

• an adequacy decision of the European Commission (e.g. Canada and, for certified organisations in the US, the EU-U.S. Data Privacy Framework),
• standard contractual clauses adopted by the European Commission.

If you order delivery to a country outside the EEA, we share the data needed to deliver your parcel with the carrier and recipient in that country. In that case, the transfer is necessary for the performance of the contract (Article 49(1)(b) GDPR).

You can obtain a copy of, or information about, these safeguards by contacting us.

6. How long we keep your data

We keep data only for as long as necessary for the relevant purpose, taking into account our legal obligations and limitation periods for legal claims.

Purpose

Retention period

Customer account

Until the account is deleted. Data from orders placed through the account is kept as described in the rows below.

Orders and after-sales service

For the duration of the contract, then until any claims become time-barred – generally 6 years, counted to the end of the calendar year.

Invoices and accounting documents

5 years from the end of the calendar year in which the tax payment deadline expired.

Enquiries and correspondence

Until the matter is closed; if it may give rise to claims – until they become time-barred.

Discount for uniformed services

Documents confirming eligibility – until verification is complete, and no longer than 7 days afterwards. Information that a discount was granted – until the promotion ends or you opt out.

Newsletter

Until you withdraw consent. Records of consent and its withdrawal – until any related claims become time-barred.

Back-in-stock notifications

Until the notification is sent or you cancel the service.

Business contacts

For the duration of the business relationship, then until any claims become time-barred.

Social media

Comments – until you or we delete them; messages – until the matter is closed.

Cookies and analytics data

For the period shown in the cookie banner for each tool, or until you withdraw consent.

Legal claims

Until proceedings are finally concluded and claims become time-barred.

7. Cookies and similar technologies

Cookies are small files or identifiers stored on or read from your device. We use them in four categories:

Category

What it is used for

Consent required

Strictly necessary

Running the shop: session, cart, login, saving your cookie choices, security

No

Preferences

Remembering settings such as language and currency

Yes, unless needed for a service you requested

Analytics

Visit and usage statistics (e.g. Google Analytics, Shopify analytics)

Yes

Marketing

Tailoring ads and measuring their effectiveness (e.g. Google Ads, Meta Pixel)

Yes

We store and read cookies other than strictly necessary ones only after you give consent in the cookie banner shown on your first visit. Refusing consent does not prevent you from shopping.

You can change or withdraw your consent at any time – as easily as you gave it – in the privacy settings linked in the website footer. You can also restrict cookies in your browser settings, but this may affect how the shop works.

8. Your rights

Under the conditions set out in the GDPR, you have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict processing;
• data portability – where we process your data by automated means on the basis of consent or a contract;
• object to processing based on our legitimate interest, on grounds relating to your particular situation;
• object to processing for direct marketing purposes – at any time and without giving a reason;
• withdraw consent at any time – without affecting the lawfulness of processing before the withdrawal.

Some rights are subject to limitations. For example, we cannot delete invoices that we must keep under tax law.

To exercise your rights, email us at gtg@gtg.com.pl or write to our registered address. We will respond without undue delay and no later than within one month. In justified cases, we may extend this period by a further two months – we will then tell you why. If we have reasonable doubts about your identity, we may ask for additional information.

You also have the right to lodge a complaint with a data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also complain to the authority in the EU/EEA country where you live or work, or where the alleged infringement took place.

9. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

If you consent to marketing cookies, Google and Meta tools may analyse your activity in the shop to show you tailored ads. This does not produce legal effects for you. You can withdraw consent in the privacy settings.

For deferred payments, Klarna may make an automated decision on whether to offer financing. For details, see Klarna's privacy policy.

10. Data security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (SSL), access control and data processing agreements with our providers. These measures protect data against unauthorised access, loss, destruction and disclosure.

11. Changes to this Privacy Policy

We update this policy when laws, the way our shop operates or the tools we use change. We publish the current version on this page with the date of the latest update. We will inform account holders and newsletter subscribers of significant changes by email.

12. Legal basis

This policy takes into account in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR),
• the Polish Electronic Communications Law of 12 July 2024,
• the Polish Consumer Rights Act of 30 May 2014,
• Polish tax and accounting regulations, including the Act of 11 March 2004 on Value Added Tax with regard to KSeF.