This is an English translation provided for convenience. In case of discrepancies, the Polish version prevails.

Privacy Policy

Effective from: 1 June 2026

1. Data controller

The controller of your personal data is Strevos sp. z o.o., with its registered office in Łódź at ul. Prezydenta Gabriela Narutowicza 40 lok. 1, 90-135 Łódź, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Łódź-Śródmieście in Łódź under KRS number 0001242944, NIP 7252367241, REGON 544824369.

Contact for personal data enquiries: privacy@strevos.com.

Clubs using the Platform are not controllers of the data of Customers making purchases in the Club Store — Strevos remains the sole controller.

2. Purposes, legal bases and retention periods for data processing

Purpose of processing	Scope of data	Legal basis	Retention period
Conclusion and performance of a sales contract	first name, surname, delivery address, email, telephone number, order details	performance of a contract (Article 6(1)(b) GDPR)	6 years from the end of the year of fulfilment
Conclusion and performance of a licence agreement with a club	business name or first name and surname, NIP or PESEL, EU VAT number, address, bank account number, tax residence certificate, contact details	performance of a contract and legal obligation – for tax purposes and pursuing claims (Article 6(1)(b) and (c) GDPR)	duration of the agreement and 6 years after it ends
Issuing invoices and bills and tax settlements	Customer or Club identification data and settlement details	legal obligation under tax and accounting legislation (Article 6(1)(c) GDPR)	5 years from the end of the tax year
Handling complaints under a statutory warranty or commercial guarantee	order details, complaint content, correspondence, documentation	performance of a contract and legal obligation (Article 6(1)(b) and (c) GDPR)	3 years from the end of the procedure
Processing payments, fraud prevention, handling payment disputes	transaction details, card metadata (excluding the full card number), IP address, device data	performance of a contract and legitimate interest in preventing abuse (Article 6(1)(b) and (f) GDPR)	6 years
Verification of the Club in public registers (register of entrepreneurs, EU VAT number verification system, trademark registers)	Club registration data	legitimate interest in protecting the Platform and consumers (Article 6(1)(f) GDPR)	duration of the agreement and 6 years after it ends
Handling enquiries and correspondence	email address, message content	performance of a contract and legitimate interest in handling enquiries (Article 6(1)(b) and (f) GDPR)	3 years
Newsletter	email address	consent (Article 6(1)(a) GDPR)	until consent is withdrawn
Statistics and analytics (Google Analytics 4, Microsoft Clarity)	anonymous identifier, truncated IP address, browser events, session recordings	consent (Article 6(1)(a) GDPR)	up to 14 months (Analytics); up to 3 months (session recordings)
Pursuing and defending claims	data necessary to conduct proceedings	legitimate interest in defending the Controller's rights (Article 6(1)(f) GDPR)	until the proceedings end and for 3 years afterwards

We process only the data necessary for the stated purposes.

Providing the data necessary to conclude a contract is voluntary but essential — without it, we cannot fulfil an order or launch a club store. Subscribing to the newsletter and accepting cookies other than essential cookies are entirely voluntary.

Please note that we may analyse how the Platform is used in order to optimise it and improve service quality.

3. Data recipients

We share your data only to the extent necessary for the purposes stated in section 2 and on the basis of data processing agreements or legal provisions.

Entities processing data on our behalf:

Stripe Payments Europe, Ltd. (Ireland) — payment processing, fraud prevention,
Sport Increase sp. z o.o. S&P sp. j. (Poland) — logistics and fulfilment partner and an entity processing data on behalf of Strevos under a data processing agreement, limited to the minimum data necessary to produce and ship the Product. It receives only the order number and production specification. The delivery address is provided only in the form of an automatically generated shipping label. We do not share the Customer's email address or telephone number,
Hetzner Online GmbH (Germany) — infrastructure hosting,
Resend, Inc. (USA) — sending emails (order confirmations, notifications),
Google Ireland Ltd. — Platform visitor statistics (Google Analytics 4), with your consent,
Microsoft Corporation — user experience analysis and session recordings (Microsoft Clarity), with your consent,
Front App, Inc. (USA) — handling Customer enquiries and correspondence.

Independent controllers:

courier companies carrying out deliveries,
the Tax Office, courts and other public authorities — solely under applicable law,
law firms, accounting firms and debt collection agencies — to the extent necessary to support our operations,
banks holding Strevos accounts.

4. Transfers of data outside the European Economic Area

Some of our providers (Stripe, Resend, Google, Microsoft, Front) may process data in the United States. We use mechanisms ensuring an adequate level of data protection — primarily the EU-U.S. Data Privacy Framework and Standard Contractual Clauses approved by the European Commission. We will provide details of the safeguards used on request: privacy@strevos.com.

5. Your rights

In connection with the processing of your personal data, you have the right to:

access your data and receive a copy,
rectify inaccurate or incomplete data,
have data erased,
restrict processing,
data portability,
object to processing based on a legitimate interest,
withdraw consent at any time (without affecting the lawfulness of processing before withdrawal),
lodge a complaint with the President of the Personal Data Protection Office (ul. Moniuszki 1A, 00-014 Warszawa).

Please send requests concerning your rights to privacy@strevos.com. Strevos has not appointed a data protection officer — GDPR enquiries should be sent directly to the address above. We will respond within 1 month of receiving your request; in particularly complex cases, we may extend this period by a further 2 months, informing you of this and giving specific reasons for the extension.

We do not make decisions producing significant legal effects for you based solely on automated data processing.

6. Cookies

The rules for using cookies and similar technologies are described in the separate Cookie Policy. You can manage your consent in the cookie banner and via the “Cookie settings” link in the website footer.

7. Data security

We apply technical and organisational measures appropriate to the risks associated with processing — in particular transmission encryption, role-based access control, data processing agreements with our providers and a procedure for reporting personal data breaches within the time limits required by law. Processing is based exclusively on a prior risk assessment.

8. Children

The Platform is not intended for persons under 16 years of age. We do not knowingly collect data from persons below this age without the consent of their legal representative. If you notice that a child has provided us with data without such consent, please write to privacy@strevos.com — we will delete it promptly.

9. Changes to the Policy

We may update this Policy — in particular following changes in the law, new Platform features or changes in our providers. We will notify you of material changes in advance via a banner on the website or by email.

10. Governing law and jurisdiction

The processing of personal data by Strevos is governed by Polish law and the GDPR. The Consumer has the right to pursue claims before the court with jurisdiction over their place of residence [Article 458¹⁴ § 4 of the Act of 17 November 1964 — Code of Civil Procedure (consolidated text: Journal of Laws of 2026, item 468, as amended).]