Privacy Policy

This Privacy Policy defines how VIN-KON S.A. processes the personal data of users of the vinkon.pl website (hereinafter referred to as the “Website”), including persons visiting the Website, persons using contact forms, persons submitting commercial inquiries, Buyers using the Store, representatives of contractors, potential contractors, suppliers, recipients and business partners.

The Privacy Policy also applies to the use on the Website of cookies and similar technologies, including files necessary for the operation of the website and the Store, session and cart management, remembering age confirmation, and analytical, functional or marketing files.

The Website is informational, promotional, contact-oriented and image-building in nature, and after the Store functionality is launched, it will also have a sales function. Orders may be placed and sales agreements may be concluded through the Store on the terms specified in the General Terms of Sale.

The Website may contain content available to all users as well as content available only after meeting additional conditions, in particular after confirming legal age or positively verifying an entrepreneur to the extent required for purchasing Alcoholic Goods.

With regard to the processing of personal data directly related to sales in the Store, the Company may also provide a separate Store Privacy Policy. Such a document supplements this Policy and, to the extent relating exclusively to a specific sales function, constitutes a special document.

The personal data controller is VIN-KON S.A., with its registered office in Konin, ul. Dąbrowskiego 35, 62-500 Konin, entered in the register of entrepreneurs of the National Court Register under KRS number 0000137693, NIP 6650001036, REGON 310288490, hereinafter referred to as „the Company” or „the Controller”.

The Controller can be contacted:
a) in writing: VIN-KON S.A., ul. Dąbrowskiego 35, 62-500 Konin;
b) by email: vinkon@vinkon.pl;
c) by telephone: +48 63 246 41 00;
d) via the contact form available on the Website.

This Privacy Policy applies to the processing of personal data in connection with the use of the Website, in particular in connection with:
a) browsing publicly available content;
b) using content available after age confirmation;
c) using the contact form;
d) sending commercial, quotation, product or organisational enquiries;
e) conducting correspondence with the Company;
f) using the Store, including placing and fulfilling orders, payments, delivery, issuing sales documents, withdrawing from the agreement, returns and complaints;
g) verifying entrepreneurs applying for the possibility of purchasing Alcohol Products;
h) ordering the newsletter;
i) handling reports, questions, complaints or claims concerning the operation of the Website;
j) ensuring the security of the Website and Store;
k) conducting statistics, analytics and marketing activities if the user has given the required consent or there is another appropriate legal basis.

The Policy does not apply to websites, services or tools of third parties to which links placed on the Website may lead or to which the user may be redirected, e.g. in connection with payment processing. After accessing an external website, the user should read the privacy policy applicable to that website or service.

If the Store function is active, the Controller processes the personal data necessary to handle the purchasing process, conclude and perform the sales agreement, process payments and deliveries, issue sales documents, handle cases of withdrawal from the agreement, returns and complaints, and fulfil obligations arising from legal regulations.

Depending on the type of Buyer and the method of order fulfilment, the following may be processed in particular:
a) first name and surname;
b) name of the company or other entity;
c) residential, registered office, delivery or correspondence address;
d) email address and telephone number;
e) NIP, REGON, KRS or other registration details, if necessary;
f) details of the person representing the entrepreneur or the contact person;
g) order number, information about the Goods ordered, their quantity and value;
h) information about the selected delivery method;
i) payment-related information, in particular payment status, amount, date and transaction identifier, whereby payment instrument details may be processed directly by the payment operator;
j) data necessary to issue an invoice or other sales document;
k) correspondence history and information concerning withdrawal from the agreement, return, complaint or claim;
l) photographs of the product, packaging, label or shipment provided as part of a complaint.

The data of a Buyer who is a natural person are processed for the purpose of taking steps prior to entering into an agreement and entering into and performing the agreement pursuant to Article 6(1)(b) of the GDPR. The data of persons representing entrepreneurs or acting as contact persons may be processed pursuant to Article 6(1)(f) of the GDPR, i.e. the Controller’s legitimate interest consisting in conducting sales, communicating with the counterparty and properly performing the agreement.

Data related to accounting and tax documents, product safety obligations and other legal obligations are processed pursuant to Article 6(1)(c) of the GDPR. Data necessary to pursue claims or defend against claims are processed pursuant to Article 6(1)(f) of the GDPR.

Alcohol products are available in the Store exclusively to entrepreneurs holding valid and appropriate permits required to purchase and further trade in alcoholic beverages, following positive verification by an authorized employee of VIN-KON S.A.

In connection with the verification, the Administrator may process, in particular:
a) the entrepreneur’s name and registration details;
b) the details of the person acting on behalf of the entrepreneur or the contact person;
c) the number, type and scope of the permit;
d) the name of the authority that issued the permit;
e) the date of issue and validity period of the permit;
f) information on the categories of alcoholic beverages covered by the permit;
g) information on the place of business, point of sale or warehouse, if relevant for the verification;
h) a copy, scan or other reproduction of the permit, if necessary;
i) a document or information confirming the fulfilment of obligations related to the use of the permit, if its presentation is required;
j) the result and date of the verification and the history of any re-verification.

The data may come directly from the entrepreneur or the person acting on their behalf, as well as, to the extent permitted by law, from publicly available registers, records or other reliable sources used to confirm the data.

The legal basis for processing is Article 6(1)(c) of the GDPR to the extent that the verification is necessary to fulfil the legal obligations incumbent on the Administrator, and Article 6(1)(f) of the GDPR to the extent of the Administrator’s legitimate interest consisting in preventing the sale of Alcohol products to unauthorized entities, documenting the correctness of sales and protecting against claims and legal risk.

Verification of the entitlement to purchase Alcohol products is not carried out exclusively by automated means. The final assessment of the documents and the entrepreneur’s status is made by an authorized employee of VIN-KON S.A.

Depending on how the Website is used, the Administrator may process data of various categories of users.

An individual user is a natural person using the Website for informational, contact, educational or purchasing purposes not directly related to representing an entrepreneur or institution.

An institutional user is an entrepreneur, legal person, organizational unit or natural person acting on behalf of such an entity, in particular a contractor, potential contractor, distributor, wholesaler, store, representative of a retail chain, representative of the food service industry, supplier, recipient, business partner or person making purchases on behalf of an entrepreneur.

The contact person is a natural person contacting the Company on their own behalf or on behalf of another entity, in particular as an employee, associate, attorney-in-fact, member of a body, sales representative or person responsible for purchasing, sales, logistics, quality, marketing or another area of cooperation.

During ordinary use of the Website, i.e. without completing forms or sending messages, the Controller may process technical data transmitted automatically by the user’s browser or device. These may include, in particular:
a) the device’s IP address;
b) the date and time of accessing the website;
c) the address of the subpage visited;
d) information about the web browser;
e) information about the operating system;
f) the address of the website from which the user accessed the Website;
g) information about errors and technical events;
h) identifiers of cookies or similar technologies.

This data is processed to ensure the proper functioning of the Website and the Store, maintain security, diagnose errors, protect against abuse, compile basic statistics and administer the Website.

The legal basis for processing this data is the Controller’s legitimate interest consisting in ensuring the operation, security and stability of the Website and the Store, as well as the proper administration of the Website and the Store.

If the user uses the contact form, sends an e-mail, contacts the Company by telephone or directs an inquiry to the Company in another way, the Controller may process the data necessary to handle such communication, in particular:
a) first name and surname;
b) e-mail address;
c) telephone number;
d) the name of the company or institution;
e) the position or function, if provided;
f) the content of the message;
g) the data contained in attachments, if sent;
h) correspondence history.

This data is processed for the purpose of handling the inquiry, providing a response, conducting correspondence, providing information about products, activities or cooperation, identifying the contact person, as well as defending against claims or pursuing claims, if necessary.

The legal basis for processing the data is the legitimate interest of the Controller, consisting in communicating with persons contacting the Company, handling inquiries and documenting the course of contact. If the contact is aimed at concluding a contract with a natural person, the legal basis for processing may also be taking steps prior to entering into a contract or performing a contract. If the data is processed in connection with obligations arising from legal provisions, the legal basis for processing is compliance with a legal obligation incumbent on the Controller.

In the case of inquiries submitted by institutional users, potential contractors, suppliers, recipients, distributors or other entities interested in cooperation, the Controller may process in particular:
a) the contact person’s data;
b) the data of the represented entity;
c) business e-mail address;
d) business telephone number;
e) position or function;
f) the entity’s registration data, including NIP, REGON or KRS;
g) registered office address, correspondence address or place of business;
h) information about the type of business activity;
i) information about interest in specific products, packaging, quantities, logistical or commercial terms;
j) information concerning the required documents, permits or authorizations, if they are relevant to the given cooperation;
k) history of contacts and commercial arrangements.

The data are processed for the purpose of handling inquiries, preparing responses, presenting information about the offer, verifying the contractor, determining the terms of potential cooperation, conducting negotiations, concluding and performing the agreement, settlements, handling complaints, and pursuing claims or defending against claims.

In the case of persons representing contractors or potential contractors, the basis for processing is the legally justified interest of the Controller consisting in conducting business activity, maintaining business relations, communicating with contractors, verifying the authorizations of persons acting on behalf of the contractor, and documenting commercial arrangements.

Some content on the Website may be available exclusively to persons who have reached the age of 18. This applies in particular to content relating to alcoholic products or other content whose availability the Company restricts due to legal provisions, the nature of the products, or the principles of responsible communication.

In order to enable access to such content, the Controller may process information confirming adulthood, the date or year of birth, if required, as well as technical information allowing the user’s choice to be remembered during a given session or for a specified period.

The data are processed for the purpose of restricting access to specific content by minors, ensuring that the Website operates in compliance with legal provisions, and protecting the Company’s legally justified interests. The basis for processing is the legally justified interest of the Controller consisting in making content available responsibly and restricting access to content intended exclusively for adults.

Confirmation of adulthood used to access content is not equivalent to verification of an entrepreneur authorized to purchase alcoholic Goods. This verification is carried out separately, in accordance with the rules described in Article 5.

If age verification is remembered using a cookie or similar technology, the user receives appropriate information as part of the cookie mechanism. To the extent required by law, such technology is used when the user has given consent to it or when it is necessary to provide the requested service.

If the user subscribes to the newsletter or consents to receiving commercial information, the Controller may process the data necessary to conduct such communication, in particular the e-mail address, first name, company name, communication preferences, and information about the consents given.

The data are processed for the purpose of sending the newsletter, information about products, news, events, the offer, the Company’s activities, commercial cooperation, or other content related to the Company’s activities.

The basis for processing the data is the user’s consent, if required. The user may withdraw consent at any time by using the link in the message, contacting the Controller, or in another manner indicated in the content of the communication. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

If marketing communication is directed to representatives of current contractors as part of an existing business relationship, the Controller may also process the data on the basis of a legally justified interest consisting in maintaining commercial relations and providing information about the offer related to previous cooperation, taking into account the provisions concerning electronic communications, including the Electronic Communications Law.

In the event of submitting a complaint concerning the operation of the Website or Store, a complaint concerning the Goods or delivery, a statement of withdrawal from the agreement, a return request, a grievance, or another submission, the Controller may process the data provided in the submission and the data related to its consideration.

These may include, in particular, identification and contact details, the order number, details of the represented entity, a description of the matter, documents, photographs of the product, packaging, or shipment, information about payment and the refund of funds, correspondence, and technical information related to the submission.

The data are processed for the purpose of reviewing the submission, performing obligations arising from the agreement and legal provisions, processing payment refunds, taking explanatory actions, demonstrating how the matter was handled, and pursuing claims or defending against claims.

The basis for processing is Article 6(1)(b) GDPR where processing is necessary for the performance of the agreement, Article 6(1)(c) GDPR where it results from a legal obligation, and Article 6(1)(f) GDPR to the extent of the Controller’s legitimate interest consisting in handling submissions and securing claims.

If, as part of a complaint concerning product safety, the user voluntarily provides health data, the Controller will process them exclusively to the extent necessary to handle the specific matter and only where an appropriate condition under Article 9(2) GDPR applies, in particular on the basis of the explicit consent of the data subject (Article 9(2)(a) GDPR), or where processing is necessary for the establishment or pursuit of claims or the defence against claims (Article 9(2)(f) GDPR).

If the Website contains links to the Company’s social media profiles or enables the use of social media plugins, the user should remember that the operators of these services may process personal data according to their own rules.

If the user contacts the Company through social media, comments on content, sends messages or interacts with the Company’s profile, the Controller may process the data visible on the relevant service and the data provided in the message. This data is processed for the purpose of communication, handling inquiries, promoting the Company’s activities, building relationships with recipients and protection against abuse.

Detailed information on data processing by social media operators can be found in the privacy documents applied by these entities.

The Website may use cookies and similar technologies. Cookies are small files saved on or read from the user’s device in connection with the use of the Website.

The following categories of cookies may be used on the Website:
a) necessary cookies, required for the proper operation of the Website and Store, session handling, security, forms, the shopping cart, the purchasing process or other basic functions;
b) functional cookies, enabling the user’s settings to be remembered, such as language preferences, interface choices or age confirmation;
c) analytical cookies, used to create statistics concerning the use of the Website, analyse visits, measure the popularity of subpages and improve the operation of the service;
d) marketing cookies, used to conduct marketing activities, measure campaign effectiveness, personalise content or link the user’s activity with advertising tools;
e) third-party cookies, originating from providers of tools used by the Controller, in particular analytical tools, maps, video players, marketing systems, payment systems or systems supporting the operation of the Website and Store.

Necessary cookies may be used without the user’s consent if they are necessary to ensure the operation of the Website, Store or a function explicitly requested by the user. Other cookies are used after obtaining the user’s consent if consent is required by law.

The user may manage their consents using the mechanism available on the Website, as well as through their web browser settings. Restricting or blocking certain cookies may affect the operation of selected functions of the Website or Store, in particular forms, the shopping cart, the payment process, remembering age confirmation, language preferences or security mechanisms.

The Controller processes personal data only when an appropriate legal basis exists. Depending on the situation, this may be:
a) consent of the data subject, in particular in the case of newsletters, certain cookies, marketing communications or other activities based on consent;
b) performance of a contract or taking steps prior to entering into a contract, in particular when placing and fulfilling an order by a Buyer who is a natural person;
c) compliance with a legal obligation to which the Controller is subject, in particular with regard to taxes, accounting, sales documentation, obligations concerning products and the trade in alcoholic beverages, responding to requests from authorised bodies or other obligations arising from legal regulations;
d) the legitimate interest of the Controller, in particular conducting correspondence, handling enquiries, maintaining business relations, performing contracts with businesses by contacting their representatives, verifying contractors, ensuring the security of the Website and Store, protection against abuse, conducting statistics, pursuing claims and defending against claims.

Personal data may be transferred to entities that support the Controller in operating the Website, Store and business activities. These may include, in particular:
a) hosting and IT infrastructure providers;
b) providers of the Store system, software and maintenance services;
c) email and form system providers;
d) payment operators, banks or financial institutions;
e) transport, logistics and courier companies, postal operators, parcel locker and collection point operators;
f) providers of analytical and marketing tools;
g) entities providing IT and security services;
h) accounting firms, auditors, tax advisers and legal advisers;
i) insurers, suppliers or manufacturers of products, where necessary to handle a complaint or claim;
j) entities authorised under legal regulations, in particular courts, public administration authorities, inspection authorities, law enforcement authorities or tax authorities.

Some recipients, in particular banks, payment operators, carriers or public authorities, may act as separate data controllers to the extent that they independently determine the purposes and means of processing data as part of their services or obligations.

Processors processing data on behalf of the Controller do so on the basis of appropriate agreements and in accordance with the Controller’s instructions, unless applicable law provides otherwise.

As a general rule, the Controller strives to ensure that users’ personal data is processed within the territory of the European Economic Area.

If, in connection with the use of IT, analytical, marketing, hosting, payment or other service providers, data is transferred outside the European Economic Area, the Controller will ensure appropriate legal grounds for such transfer, in particular a European Commission decision confirming an adequate level of protection, standard contractual clauses or another mechanism provided for by personal data protection regulations.

Personal data is stored for the period necessary to achieve the purpose for which it was collected, and subsequently for the period required by law or justified by the need to secure claims.

In particular:
a) Technical data and server logs may be stored for the period necessary to administer the Website and Store, ensure security and detect abuse, usually no longer than 12 months, unless longer storage is necessary in connection with a security incident or claims.
b) Data from the contact form is stored for the duration of handling the inquiry, and subsequently for the period necessary to demonstrate the course of communication, usually no longer than 5 years from the conclusion of the matter.
c) Data concerning commercial inquiries and business relationships is stored for the duration of discussions, cooperation or negotiations, and subsequently for the limitation period of any potential claims.
d) Data related to the processing of orders in the Store is stored for the time necessary to perform the agreement, process payment, delivery, returns and complaints, and subsequently for the period resulting from legal, accounting and tax obligations, as well as the limitation periods for claims.
e) Data and documents related to verifying an entrepreneur’s eligibility to purchase alcoholic Goods are stored for the period necessary to maintain verified status, complete sales and demonstrate the correctness of transactions, and subsequently for the period required by law or justified by the limitation period for claims and the risk of an inspection.
f) Data processed on the basis of consent is stored until consent is withdrawn, unless another legal basis exists for further processing.
g) Data concerning complaints, withdrawals from agreements, returns, reports and claims is stored for the duration of handling the matter, and subsequently for the limitation period for claims or the period required by law.
h) Data related to age verification is stored for the period resulting from the technical settings of the relevant function, in particular for the duration of the session or the validity period of the relevant cookie file.

After the relevant period has elapsed, the data is deleted, anonymized or archived to the extent required by law.

The data subject has the rights specified in personal data protection regulations, in particular:
a) the right to access the data;
b) the right to receive a copy of the data;
c) the right to rectify the data;
d) the right to erase the data;
e) the right to restrict processing;
f) the right to data portability;
g) the right to object to the processing of data based on the Administrator’s legitimate interest;
h) the right to withdraw consent at any time if the processing is based on consent;
i) the right to lodge a complaint with the President of the Personal Data Protection Office.

To exercise these rights, you may contact the Administrator using the contact details indicated in this Privacy Policy.

The Administrator may request additional information enabling confirmation of the identity of the person submitting the request if this is necessary to protect the data against disclosure to an unauthorized person.

Providing data during ordinary browsing of the Website is not required, except for technical data necessary to connect to the Website and ensure its proper operation.

Providing data in the contact form is voluntary, but necessary to send a message and receive a response.

Providing data in a commercial inquiry is voluntary, but may be necessary to respond, identify the represented entity, verify the nature of the inquiry or initiate further discussions.

Providing data marked as required during the purchasing process is voluntary, but necessary to place and fulfill an order, deliver the goods, process payment or issue a sales document.

An entrepreneur intending to purchase alcoholic Goods must provide the data and documents necessary to verify its eligibility. The absence of such data or a negative verification result makes it impossible to purchase alcoholic Goods in the Shop.

Providing data for the purpose of ordering the newsletter is voluntary. However, failure to provide the data will make it impossible to receive the newsletter.

Age verification is voluntary, but failure to verify may prevent access to content intended exclusively for adults.

The Controller does not make decisions concerning users based solely on automated processing of data that would produce legal effects concerning them or similarly significantly affect them.

In particular, the decision to allow an entrepreneur to purchase Alcoholic Goods is not made solely automatically; verification is carried out by an authorised employee of VIN-KON S.A.

The Controller may use basic statistical or marketing analytics if the user has given the required consent to the relevant cookies or similar technologies. Such activities may involve analysing the use of the Website and Store, the popularity of subpages or products, sources of visits, campaign effectiveness or interest in specific content, but they are not used to make decisions producing legal effects concerning the user.

The Controller applies technical and organisational measures aimed at protecting personal data against unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing.

These measures may include, in particular, access control to systems, authorisations for persons processing data, IT infrastructure security, backups, transmission encryption, monitoring of technical events, software updates and agreements with entities processing data on behalf of the Controller.

Access to data and documents used to verify entrepreneurs purchasing Alcoholic Goods should be limited to persons who need it in connection with their duties.

The User should also take care of the security of their data, in particular by using up-to-date software, avoiding the transmission of unnecessary personal data and not entering into forms data that are not needed to handle the matter.

The Controller may change the Privacy Policy, in particular in the event of changes in the law, changes to the functions of the Website or Store, implementation of new tools, changes to forms, payment or delivery methods, the newsletter, the cookie system, analytical or marketing tools, as well as changes to the method of data processing.

The current version of the Privacy Policy is published on the Website. If the change is significant for persons remaining in a permanent contact relationship with the Company, Buyers or newsletter subscribers, the Controller may also inform them of the change electronically, if appropriate and possible.

In matters relating to the protection of personal data, the exercise of the rights of data subjects, cookies, the newsletter, data related to the Store or other privacy-related matters, the Controller may be contacted at:

VIN-KON S.A.
Dąbrowskiego Street 35
62-500 Konin
e-mail: vinkon@vinkon.pl
tel.: +48 63 2464100

This Privacy Policy is effective as of 1 September 2026.