At a glance
- Who controls your data: Bison Gear Sp. z o.o., ul. Ciepła 16, 05-800 Pruszków, Poland.
- How to reach us about privacy: contact@bison-gear.com. We have not appointed a Data Protection Officer.
- We do not sell your personal data and we do not use it to make automated decisions with legal effects for you.
- Marketing and analytics cookies run only if you accept them in our cookie banner. You can change your choice at any time.
- Your rights: access, rectification, erasure, restriction, portability, objection, and the right to complain to the Polish supervisory authority.
On this page
This policy explains what we do with personal data when you visit bison-gear.com, place an order, create an account, subscribe to our newsletter, leave a product review or contact us. It is written to meet the requirements of the General Data Protection Regulation (GDPR).
1. Who we are
The controller of your personal data is:
BISON GEAR Spółka z ograniczoną odpowiedzialnością
ul. Ciepła 16, 05-800 Pruszków, Poland
KRS 0001074441, District Court for the Capital City of Warsaw, XIV Commercial Division of the National Court Register
NIP / EU VAT: PL5342672188 · REGON: 527156636 · Share capital: PLN 74,500.00, paid up in full
Email: contact@bison-gear.com · Phone: +48 505 642 981
We have not appointed a Data Protection Officer, because we are not required to do so under Article 37 GDPR. For any matter concerning your personal data, write to contact@bison-gear.com and your message will reach the people responsible for privacy at Bison Gear.
2. What we process and why
We only process data for the purposes listed below, and each purpose has its own legal basis. Where a purpose relies on your consent, you can withdraw that consent at any time without affecting what we did lawfully before you withdrew it.
| What you do | Data we process | Why | Legal basis |
|---|---|---|---|
| Place an order | Name, delivery and billing address, email, phone, order contents, payment status, vehicle details you give us | To conclude and perform the sales contract, deliver the goods, issue invoices and keep accounting records | Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (accounting and tax obligations) |
| Create an account | Name, email, password (stored hashed), order history | To provide the account as a digital service | Art. 6(1)(b) GDPR (contract) |
| Subscribe to the newsletter | Email, and optionally vehicle make and model | To send the newsletter and to measure whether our messages are opened and useful | Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (our interest in measuring effectiveness) |
| Leave a product review | Name or nickname you choose, email, review content, photos you upload, whether the order was verified | To publish reviews and to show other customers which reviews come from confirmed purchases | Art. 6(1)(a) GDPR (consent) and Art. 6(1)(c) GDPR (duty to state whether reviews are verified) |
| Contact us or file a complaint | Email, name, order number, the content of your message and any photos | To answer you and to handle returns, complaints and warranty claims | Art. 6(1)(b) GDPR if it concerns your order, otherwise Art. 6(1)(f) GDPR (our interest in replying) |
| Browse the shop with analytics cookies accepted | Pseudonymous identifiers, pages viewed, device and browser data, approximate location from IP | To understand how the shop is used and improve it | Art. 6(1)(a) GDPR (consent given in the cookie banner) |
| Browse the shop with marketing cookies accepted | Pseudonymous identifiers, interactions with products and campaigns | To show relevant ads and measure campaigns | Art. 6(1)(a) GDPR (consent given in the cookie banner) |
| Any situation that may lead to a claim | The data relevant to that claim | To establish, exercise or defend legal claims | Art. 6(1)(f) GDPR (our legitimate interest) |
Giving us your data is voluntary, but it is necessary for the purpose concerned. Without delivery data we cannot ship an order; without an email address we cannot send a newsletter or answer a question.
3. Cookies and similar technologies
Cookies are small files stored by your browser. Strictly necessary cookies are set as soon as you open the shop, because without them the shop cannot work: they keep your cart, your chosen country and currency, and your cookie choice itself. Analytics and marketing cookies are set only after you accept them in our cookie banner.
You can accept, decline or fine-tune cookies at any time from the cookie banner, and you can delete or block cookies in your browser settings. If you decline, the shop keeps working; we simply stop measuring and stop showing personalised ads.
The table below lists the main cookies used on bison-gear.com. Providers update their software, so exact names and lifetimes can change; the list shown in your cookie settings panel is always the current one.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| Strictly necessary – no consent required | |||
| _shopify_essential | Shopify | Core shop functionality | 1 year |
| _tracking_consent | Shopify | Remembers your cookie choice | 1 year |
| cart, cart_currency | Shopify | Keeps your cart and its currency | 2 weeks |
| localization | Shopify | Keeps your country and language | 1 year |
| discount_code | Shopify | Keeps a discount code from a campaign link | Session |
| _shopify_test | Shopify | Checks that cookies work in your browser | 1 minute |
| Analytics – only with your consent | |||
| _shopify_y, _shopify_analytics | Shopify | Recognises a returning browser for statistics | 1 year |
| _shopify_s | Shopify | Identifies a single visit | 30 minutes |
| _landing_page, _orig_referrer | Shopify | Records how you reached the shop | 2 weeks |
| _ga, _ga_<id> | Google Analytics | Traffic and behaviour statistics | Up to 2 years |
| Marketing – only with your consent | |||
| _shopify_marketing | Shopify | Measures marketing campaigns | 1 year |
| __kla_id | Klaviyo | Links site activity to newsletter and campaign messages | Up to 2 years, shorter in some browsers |
| _gcl_au | Measures ad conversions | 90 days | |
Our product review widget may additionally set functional cookies while you are writing or voting on a review.
4. Who we share data with
We do not sell personal data and we do not share it for anyone else’s independent marketing. We do use service providers who process data on our documented instructions under a data processing agreement. These are the ones that can come into contact with your data:
| Provider | What it does for us | Where it is established |
|---|---|---|
| Shopify International Ltd. and Shopify Inc. | Runs the shop platform, hosting and checkout, and provides the built-in analytics | Ireland and Canada |
| BaseLinker sp. z o.o. | Order management, invoicing and warehouse workflow | Poland |
| Gorgias Inc. | Customer support helpdesk that handles your emails and complaints | United States |
| Klaviyo Inc. | Newsletter and marketing messages, and their effectiveness | United States |
| Judge.me Ltd. | Collecting, verifying and publishing product reviews | United Kingdom |
| Google Ireland Ltd. | Google Tag Manager and Google Analytics, used only with your consent | Ireland |
| FedEx Express | International delivery of your parcel | Poland and United States |
| Alsendo sp. z o.o. | Shipping labels and carrier handover | Poland |
| Payment service providers | Processing the payment you choose at checkout. The provider handling your payment is shown to you at the payment step | Depends on the provider you choose |
| Our accounting office and IT support | Bookkeeping, invoices and technical maintenance | Poland |
In addition, we disclose data to public authorities where the law requires it, for example to tax or customs authorities.
5. Transfers outside the EEA
Most of your data stays inside the European Economic Area. Some of the providers listed above are established outside it, so a transfer takes place. In each case the transfer is covered by one of the safeguards allowed by Chapter V GDPR:
- Canada and the United Kingdom are covered by European Commission adequacy decisions, which means the Commission has confirmed they offer an adequate level of protection. This covers Shopify Inc. and Judge.me Ltd.
- The United States: the transfer is based on the provider’s participation in the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses together with the additional safeguards set out in that provider’s data processing agreement. This covers Gorgias Inc., Klaviyo Inc., FedEx and Google’s US infrastructure.
If you want to know which safeguard applies to a specific provider, or to receive a copy of the relevant clauses, write to contact@bison-gear.com and we will send it to you.
6. How long we keep data
| Data | Kept for |
|---|---|
| Order and invoice data | 5 years from the end of the tax year in which the invoice was issued, as Polish accounting law requires |
| Account data | For as long as the account exists; deleted when you delete the account |
| Newsletter data | Until you unsubscribe or withdraw your consent |
| Reviews | For as long as the review is published, unless you ask us to remove it |
| Correspondence and complaints | Until the matter is closed, and then for as long as claims relating to it can still be raised |
| Analytics and marketing data | Until the relevant cookie expires or you delete it, or until you withdraw consent |
Where a claim could still be brought, we keep the data relevant to that claim until the limitation period ends, even if the periods above are shorter.
7. Your rights
Under the GDPR you may ask us to:
- give you access to your data and a copy of it (Art. 15),
- correct data that is wrong or incomplete (Art. 16),
- erase your data (Art. 17),
- restrict how we process it (Art. 18),
- transfer it to another controller in a machine-readable format (Art. 20).
You may also object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21(1)), and you may object to direct marketing at any time, with no need to give a reason (Art. 21(2)). Where processing is based on consent, you may withdraw that consent at any time.
To exercise any of these, write to contact@bison-gear.com. We answer within one month; if a request is complex we may extend that by up to two further months and will tell you why. Exercising your rights is free of charge.
You can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live in another EU or EEA country, you may complain to your own national supervisory authority instead.
8. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (TLS) across the whole shop, access limited to the people who need it, and contracts with every provider that processes data for us. Payment card details are entered directly with the payment provider and never reach our systems.
9. Automated decisions and profiling
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. If you accept marketing cookies, we do group visitors by their interests in order to show more relevant offers; this is profiling for marketing purposes only, it has no legal effect on you, and you can object to it at any time.
10. Children
Our shop is intended for adults. We do not knowingly collect data from children. If you believe a child has given us personal data, write to contact@bison-gear.com and we will delete it.
11. Changes to this policy
If we change the way we process personal data, we update this policy and change the date below. Where a change is significant, we also tell you by email or by a notice in the shop before it takes effect.
Last updated: 9 September 2026. This version replaces the privacy policy dated 02.01.2024.