Privacy policy

1. Controller

Gjafaland ehf., Aðalstræti 24, 400 Ísafjörður, Iceland, registration no. (kennitala) 460519-1280. Email: kontakt@plugg.pl. Plugg is the controller of data about its customers (merchants) and users of plugg.pl.

2. Data about merchants

Email and password (stored hashed), company name, NIP and address, store domains, module settings, payments and their status, and messages you send us, e.g. module requests.

To fill in and verify company details we look up the NIP in the Polish Ministry of Finance VAT white list and check the store's public pages.

3. Data about store visitors

Modules in stores may process data about store visitors: email addresses in the popup and back-in-stock modules (with product and language), chat messages and details a visitor gives there, cookie choices and statistics on cart add-ons. IP addresses are only stored as an irreversible code (hash) to prevent abuse.

For this the store is the controller and Plugg the processor under the data processing agreement in section 11 of the terms. Visitors who want to exercise their rights should contact the store.

4. Purposes and legal basis

To provide the service and collect payments (contract, Art. 6(1)(b) GDPR).

To meet legal obligations, e.g. bookkeeping and tax (Art. 6(1)(c)).

To keep the service secure, prevent abuse and verify companies (legitimate interests, Art. 6(1)(f)).

5. Sub-processors and recipients

Supabase (database and login), Vercel (hosting), Google (Gemini, AI chat answers), Teya (card payments for modules) and an email delivery service (SMTP). If a store connects its own mail server, that server is used for its emails.

Iceland is part of the European Economic Area, so the GDPR applies. Transfers outside the EEA rely on the European Commission's standard contractual clauses or equivalent safeguards.

6. Retention

Merchant data is kept while the account is active. Bookkeeping records are kept for 7 years under the Icelandic Bookkeeping Act no. 145/1994.

Store visitor data is deleted when the store or module is deleted, or earlier at the store's request.

7. Cookies

plugg.pl only uses necessary cookies for login. Modules in stores use the browser's local storage for functionality, e.g. to remember that a popup was closed or which currency was chosen. Plugg does not use tracking or advertising cookies.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing. Send requests to kontakt@plugg.pl.

You can lodge a complaint with the Polish data protection authority (UODO, uodo.gov.pl) or the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).

9. Changes

This policy may change. Material changes are announced to merchants by email.