Privacy Policy of the TobiPaczka service

Effective Date: 06.07.2026. Last updated: 06.07.2026.

1. General Provisions

1.1. This Privacy Policy (hereinafter — the "Policy") describes what personal data is collected, how it is used, stored and protected by the international logistics company "TobiPaczka" (hereinafter — the "Operator", "we", "us", "our") when providing goods purchasing and international delivery services through the website tobipaczka.com (hereinafter — the "Website"), as well as describes the rights of users regarding their data.

1.2. The Policy is developed in accordance with:

The Constitution of Ukraine (in particular, Article 32);
The Law of Ukraine "On Personal Data Protection" No. 2297-VI;
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) and the Additional Protocol thereto;
Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter — "GDPR") and Directive 2002/58/EC (ePrivacy) — regarding the processing of data of individuals located in the European Union and cross-border data transfers.

1.3. Since the service involves the movement of goods and data between the territory of the European Union (in particular, Poland) and Ukraine, both the legislation of Ukraine and the GDPR apply to the processing of personal data.

1.4. By using the Website, placing an order, or otherwise providing us with your data, the user confirms that they have read this Policy. Consent to data processing for purposes that require consent (e.g., for marketing mailings or non-essential cookies) is requested separately and is voluntary.

2. Definitions

Personal Data — any information relating to an identified or identifiable natural person (e.g., name, phone number, address, email, identification and payment data).
Processing — any operation with personal data (collection, storage, use, transfer, alteration, deletion, etc.).
Data Subject / User / Customer — a natural person who uses the Website and/or orders services.
Recipient (Consignee) — the final recipient of the goods (who may be the Customer or a different person), whose data is provided by the Customer for delivery purposes.
Operator (Manager) — the entity determining the purposes and means of data processing, specified in clause 3.
Administrator — a person who processes data on behalf of the Operator (e.g., delivery service, payment service, hosting provider).
Cookies — small text files placed on the user's device when visiting the Website (see Section 12).

3. Who Processes Your Data

Data is processed by us directly, through our website, and by our managers.

For any questions related to the processing of personal data and to exercise your rights, you can contact us at info@tobipaczka.com.

4. What Data We Collect

We collect only the data necessary to provide services, and to the extent corresponding to the purposes of processing (data minimization principle). Depending on how you use the Website, we may process:

4.1. Data you provide yourself:

Identification and contact data of the Customer: first name and last name, phone number, email address, messenger identifiers (e.g., Viber, Telegram) and other contact information.
Data of the Goods Recipient: first name and last name, phone number, delivery address of the final recipient (if different from the Customer).
Order data: information about purchased goods (links, store/seller name, characteristics, cost), invoices, order history and correspondence on orders.
Data for customs clearance: the taxpayer registration number (RNOKPN/IPN) of the Recipient and, if required by customs regulations, identity document data, as well as other information necessary for declaring and clearing shipments through customs.
Payment data: information about the payment method and payment confirmation. We do not store full payment card details — payments are processed by certified payment providers (see Section 6).
Communications: messages, support requests, reviews, comments and ratings.

4.2. Data collected automatically:

IP address, device and browser data, operating system type;
visit data: pages viewed, time and duration of session, traffic source, actions on pages;
cookies and similar technologies (see Section 12).

We do not intentionally collect special (sensitive) categories of data (about health, religious or political views, etc.) and ask you not to provide us with such information unless it is necessary to provide the service.

5. Purposes and Legal Bases for Processing

We process data only when there is a legal basis. Below are the purposes of processing and the corresponding bases (Art. 11 of the Law of Ukraine "On Personal Data Protection" and Art. 6 of the GDPR):

Conclusion and performance of a contract (purchase of goods, arrangement and implementation of delivery, settlements, Customer support, informing about the order status) — basis: contract performance.
Customs clearance and tax/accounting, responses to requests from state authorities — basis: compliance with a legal obligation.
Ensuring the security of the Website, preventing fraud and abuse, maintaining internal reporting, improving service quality, basic analytics — basis: the Operator's legitimate interest, which does not override the rights of data subjects.
Marketing mailings, news and promotions; installation of non-essential (analytical and marketing) cookies — basis: consent of the data subject, which can be withdrawn at any time.

6. To Whom We Transfer Data

Providing purchasing and international delivery services requires transferring certain data to a limited number of recipients. We transfer data only to the extent necessary for the relevant purpose, and require recipients to ensure their confidentiality and protection. Data may be transferred:

to delivery services, courier and postal operators — for carrying out delivery;
to customs and other state authorities — for customs clearance and in cases provided for by law;
to sellers and stores — when purchasing goods on behalf of the Customer, to the extent necessary for placing and receiving the order;
to payment systems and payment service providers — for conducting and confirming payment;
to IT service providers — hosting and the Website platform (Cloudflare — see Section 8), email services, CRM, web analytics;
to professional consultants — lawyers, accountants, auditors, to the necessary extent;
to legal successors — in the event of reorganization, sale or transfer of business, subject to maintaining the data protection regime.

We do not sell personal data and do not transfer it to third parties for their own marketing purposes. Transfer of data not on the specified grounds is possible only with the consent of the data subject or in cases directly provided for by law.

7. Processing of Third-Party Data (Recipients)

If the Customer provides data of another person (Goods Recipient), the Customer confirms that they have a legal basis for transferring such data and undertakes to inform that person about the processing of their data in accordance with this Policy. The Operator is not liable to third parties for the unlawful provision of their data by the Customer.

8. Hosting and Cross-Border Data Transfer

8.1. The Website is hosted on the Cloudflare platform, which provides online infrastructure for the Website's operation and the provision of services. Data may be stored in the storage systems and databases of Cloudflare on secure servers.

8.2. The provision of services involves cross-border transfer of data between the EU territory (in particular, Poland) and Ukraine, as well as possible transfer to service providers in other countries (for example, when using Cloudflare and web analytics services).

8.3. When transferring data from the EU to third countries, we ensure adequate protection guarantees in accordance with Chapter V of the GDPR (in particular, standard contractual clauses (SCC) or other mechanisms provided by law). Please note that as of the publication date, the European Commission has not adopted an adequacy decision on the level of data protection in Ukraine; however, Ukraine recognizes the adequate level of protection in the states parties to Convention 108.

9. Data Retention Periods

9.1. We store personal data no longer than necessary for the purposes of their processing, as well as within the periods established by law.

9.2. Approximate periods:

order data, settlements and primary documents — for the period provided for by the tax and accounting legislation of Ukraine (typically at least 1095 days), after which they are deleted or anonymized;
account and profile data — until the account is deleted or the data subject requests it;
data for marketing mailings — until consent is withdrawn;
data collected using cookies — during the lifetime of the corresponding cookies (see Section 12).

9.3. Upon expiration of the retention period, data is deleted or anonymized, except in cases where the law requires their further storage.

10. Rights of Data Subjects

In accordance with the Law of Ukraine "On Personal Data Protection" and the GDPR, you have the right:

to access your data and information about its processing;
to rectify inaccurate or incomplete data;
to erasure of data ("right to be forgotten"), if there are no grounds for its further processing;
to restrict processing in cases provided by law;
to data portability — to receive data in a structured, machine-readable format or transfer it to another controller (where applicable);
to object to processing based on legitimate interest, as well as against direct marketing;
to withdraw consent at any time — this does not affect the lawfulness of processing carried out before the withdrawal;
not to be subject to a decision based solely on automated processing, which produces legal or other significant effects for you;
to lodge a complaint with a supervisory authority (see Section 16).

To exercise your rights, send a request to info@tobipaczka.com. We respond within the deadlines established by law (generally, within 30 days; in complex cases, the period may be extended with notification). We may request additional information to verify your identity.

11. Data Security

11.1. We apply reasonable technical and organizational measures to protect data from unauthorized access, alteration, disclosure or destruction: connection encryption (SSL/TLS), role-based access control, use of secure provider infrastructure, data storage on servers behind a firewall.

11.2. No method of data transmission or storage is absolutely secure, so we cannot guarantee unconditional protection. In the event of an incident involving a high risk to the rights of data subjects, we notify the relevant persons and supervisory authorities in the manner and within the deadlines provided by law.

11.3. Responsibility for the accuracy of the provided data lies with the data subject (Customer). The Operator is not responsible for the consequences of the Customer providing false or incomplete data.

12. Cookie Policy

12.1. What cookies are. Cookies are small files that are stored in the browser when visiting the Website and allow recognizing the device, remembering settings and analyzing the use of the Website. We also use similar technologies (pixels, local storage).

12.2. Legal bases. Strictly necessary cookies are set on the basis of the necessity to ensure the operation of the Website. All other categories (analytical, functional, marketing) are set only with your consent, which is requested through the cookie banner on your first visit to the Website. Consent can be changed or withdrawn at any time in the cookie settings on the Website or in the browser.

12.3. Categories of cookies we may use:

Strictly necessary. Ensure the basic operation of the Website, security, order placement. Example — session cookies, Cloudflare platform cookies.
Functional. Remember user choices (language, region, settings). Example — preference cookies.
Analytical / Statistical. Help understand how the Website is used to improve the service. Example — Google Analytics.
Marketing. Display of relevant advertising, evaluation of its effectiveness. Example — Meta Pixel, Google Ads.

12.4. How to manage cookies. You can disable or delete cookies in your browser settings. Please note that disabling strictly necessary cookies may lead to incorrect operation of certain functions of the Website. You can also manage analytical and marketing cookies through the tools of the respective services and the cookie banner settings on the Website.

12.5. "Do Not Track" signal. The standards for processing "Do Not Track" browser signals are not uniformly established, so the Website may not respond to such signals; however, you can always manage cookies using the methods described above.

13. Links to Third-Party Resources

The Website may contain links to third-party websites (e.g., stores, payment services). This Policy does not apply to such resources. We recommend that you read the privacy policies of third-party websites; we are not responsible for their content and data processing practices.

14. Data of Minors

The Website and services are not intended for persons under 18 years of age. We do not knowingly collect data of minors. If we become aware that a minor's data has been obtained without a proper legal basis, such data will be deleted.

15. Automated Decision-Making

We do not make decisions that have legal or other significant effects for you solely on the basis of automated data processing, without human involvement.

16. Contacts and Appeal to Supervisory Authorities

16.1. For questions regarding personal data processing, please contact: info@tobipaczka.com.

16.2. If you believe your rights have been violated, you have the right to contact a supervisory authority:

in Ukraine — the Ukrainian Parliament Commissioner for Human Rights (Ombudsman), who exercises control over compliance with personal data protection legislation;
in the European Union — the data protection supervisory authority of the country of your residence, work or place of the alleged violation.

17. Changes to the Policy

We have the right to periodically update this Policy. The current version is always posted on the Website with the effective date indicated. In the event of significant changes, we will take reasonable measures to notify users (for example, by a notice on the Website or by email). We recommend that you periodically review the Policy.

18. Applicable Law

This Policy is governed by the legislation of Ukraine; with respect to the processing of data of persons located in the EU, the norms of the GDPR also apply. The invalidity of a particular provision of the Policy does not entail the invalidity of the remaining provisions.