Privacy Policy

In force as of 22 May 2026.

This Privacy Policy describes the rules for processing personal data in the SendItNow service available at https://senditnow.online, and the rights of data subjects, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and national legislation.

1. Data controller

The controller of your personal data is Łukasz Wicenciak, a sole proprietor with its registered office at ul. Sarnia 2/84, 61-058 Poznań, Poland, Tax ID (NIP): 7822386443, REGON: 302410980 (hereinafter: the "Controller"). Warehouse (fulfilment centre) address: ul. Jasińska 13, 62-020 Swarzędz, Poland.

Contact with the Controller on matters relating to the protection of personal data: kontakt@senditnow.online.

2. Scope of data collected

The Controller processes the following categories of personal data:

• Identification and contact data: first and last name, company name, Tax ID (NIP), REGON, registered address, e-mail address, telephone number.
• Account access data: login (e-mail address) and password in encrypted form (hash).
• Billing data: payment history, Wallet transaction history, invoicing data, transaction identifiers with the Payment Operators.
• Technical data: IP address, session identifier, device and browser information, system and security event logs.
• Integration data: access tokens for sales platforms connected to the Account, and the scope of permissions.
• Business data entered into the Service: offers, products, orders, data of the User's contractors, data of the User's end customers (processed on an entrustment basis — see point 10).
• Communication data: the content of correspondence conducted with the Controller (e-mail, contact forms, chat).

3. Purposes and legal bases of processing

Purpose of processing	Legal basis	Retention period
Provision of services by electronic means (maintaining the Account, providing Service features)	Article 6(1)(b) GDPR — performance of a contract	for the duration of the contract and until the limitation periods for claims expire
Processing payments and settlements (PayNow, Stripe, Wallet)	Article 6(1)(b) GDPR — performance of a contract; Article 6(1)(c) GDPR — legal obligations (including the Accounting Act)	up to 5 years from the end of the financial year in which the invoice was issued
Handling complaints and support requests	Article 6(1)(b) and (f) GDPR — performance of a contract and the legitimate interest of the Controller	up to 3 years from the end of the complaint procedure
Issuing and storing invoices and accounting records	Article 6(1)(c) GDPR — legal obligations	5 years from the end of the financial year (Tax Ordinance, Accounting Act)
Ensuring the security of the Service, detecting abuse, event logging	Article 6(1)(f) GDPR — legitimate interest	up to 12 months
Pursuing and defending claims	Article 6(1)(f) GDPR — legitimate interest	until the limitation periods for claims expire
Marketing communication regarding our own services	Article 6(1)(f) GDPR; for e-mail marketing — Article 10 of the Act on the Provision of Services by Electronic Means (consent)	until consent is withdrawn or an objection is raised

4. Data recipients

Your personal data may be shared with the following categories of recipients:

• Payment Operators — to the extent necessary to process transactions:
  • mElements S.A. (PayNow), ul. Prosta 18, 00-850 Warsaw, Poland;
  • Stripe Payments Europe, Ltd. with its registered office in Ireland.
• Operators of sales platforms integrated with the Service (including Allegro, Shopify, eBay, Empik, Kinguin, G2A, Eneba) — solely to the extent and for the purpose for which the User uses the integration.
• Providers of infrastructure and IT services — hosting provider, cloud services, monitoring tools, e-mail delivery tools, backup service provider.
• Providers of communication services — e-mail operators, providers of push and notification services (including Pusher).
• Accounting office and advisers — to the extent necessary for accounting, tax and legal services.
• State authorities — where the obligation to disclose data arises from the provisions of law.

A data processing agreement in accordance with Article 28 GDPR is concluded with every entity processing data on behalf of the Controller.

5. Transfers of data outside the EEA

In connection with the use of certain IT services (including cloud providers, analytics tools, Stripe), your data may be transferred to third countries outside the European Economic Area. In such a case, the transfer takes place on the basis of:

• a European Commission decision finding an adequate level of protection, or
• standard contractual clauses approved by the European Commission, or
• other mechanisms provided for in Chapter V of the GDPR.

You may obtain a copy of the safeguards applied by contacting the Controller.

6. Your rights

In connection with the processing of your personal data, you have the following rights:

• the right of access to your data and to obtain a copy of it (Article 15 GDPR);
• the right to rectification of inaccurate data or completion of incomplete data (Article 16 GDPR);
• the right to erasure ("the right to be forgotten") — in the situations set out in Article 17 GDPR;
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability — to receive your data in a structured, commonly used format (Article 20 GDPR);
• the right to object to processing based on legitimate interest (Article 21 GDPR);
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
• the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

To exercise the above rights, contact the Controller at kontakt@senditnow.online.

7. Voluntary nature of providing data

Providing personal data is voluntary but necessary to conclude the contract and use the Service. Failure to provide the required data will make it impossible to register an Account or to perform selected Services.

8. Profiling and automated decision-making

Your data is not used for automated decision-making that produces legal effects concerning you or similarly significantly affects your situation, within the meaning of Article 22 GDPR. The Service may use mechanisms for the automatic detection of abuse (e.g. unusual login attempts) — detecting them does not result in an automated legal decision, but may lead to verification by the Controller.

9. Cookies and similar technologies

1. The Service uses cookies and similar technologies (local storage, session storage) in order to:
   • ensure the proper functioning of the Service (necessary cookies, including session, authorisation and CSRF cookies);
   • remember the User's preferences (functional cookies, including language selection and theme);
   • analyse traffic and the way the Service is used (analytics cookies — only with the User's consent);
   • marketing purposes (marketing cookies — only with the User's consent).
2. Necessary cookies are installed without the User's consent, pursuant to Article 173(3) of the Polish Telecommunications Law.
3. Other cookies require consent, which can be withdrawn at any time by changing browser settings or using the mechanisms made available within the Service.
4. Restricting or disabling cookies may affect the operation of certain Service features.

10. Entrustment of data processing

To the extent that the User enters into the Service the personal data of third parties (e.g. their end customers, contractors, employees), the User remains the controller of that data, and the Controller (Łukasz Wicenciak) acts as a processor within the meaning of Article 28 GDPR. The rules of entrustment are set out in a separate data processing agreement concluded with the User or made available within the Service.

11. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access, in particular:

• encryption of data transmission using the TLS protocol;
• encryption of user passwords (hash + salt);
• access control based on roles and permissions;
• regular backups and event monitoring;
• updating software and infrastructure components.

12. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy. Users will be informed of any material changes in advance by electronic means or via a notice within the Service. The current version of the Policy is always available at https://senditnow.online/polityka-prywatnosci.

← Back to home page