Privacy policy
This document explains which personal data we process on b2b.bioshi.pl, why, on what legal basis and for how long, who receives it and what rights you have. The site is addressed to businesses: suppliers of raw materials and producers of finished products. We process personal data when you are a sole trader or the contact person of your company.
1. Who is the controller
The controller is BIOSHI S.A., ul. Jasnogórska 1, 31-358 Kraków, Poland, KRS 0001053787, NIP (VAT) PL6762649713, REGON 526170605.
For data protection matters write to purchases@bioshi.pl (subject: "personal data") or call +48 781 494 806. You can also write to the company address.
2. What we process, why and on what basis
a) Producer application for selection (BIOSHI Marketplace)
Data: company name, VAT number, country, website, name of the contact person, e-mail, phone, product category and number of products, organic certificate number (if any), sales channels, description, catalogue link or PDF file, date of the application and consent, IP address, browser information, and the address of the page you came from to the form plus campaign parameters (utm), if they were in the address.
Purpose: assessment of the application by our purchasing team, contact about the application and, after a positive decision, preparing the cooperation. We store the IP address and browser information to protect the form against abuse (submission limits, spam); the referring page and campaign parameters - to know which activities bring producers to us (ad click identifiers in the address are removed).
Basis: your consent given in the form (Art. 6(1)(a) GDPR) and steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); protection against abuse and possible claims are our legitimate interest (Art. 6(1)(f) GDPR).
Applications are accepted or rejected by people, not by an algorithm.
b) Supplier Zone account (raw-material suppliers and accepted producers)
Data: company details (name, VAT number, address and its location on the map), first and last name, e-mail, phone, password stored as a hash, preferred language, selected categories and notification settings, certificates and documents you upload, submitted offers (prices, dates, terms) and submitted products, IP address at login (abuse protection).
Purpose: running the account, receiving and comparing offers, product submissions and sales settlements, account-related notifications (new demands, deadlines, decisions), security of the site, settlements and accounting, establishing or defending claims.
Basis: performance of the contract for using the site and of commercial contracts (Art. 6(1)(b) GDPR), legal obligations, in particular tax and accounting (Art. 6(1)(c) GDPR), and our legitimate interest: security, contact with persons designated by the company, and claims (Art. 6(1)(f) GDPR).
c) Contacting us
When you write or call, we process the data from your message to reply and handle the matter (Art. 6(1)(f) GDPR, or (b) where it concerns a contract).
d) Measuring ad performance (Meta pixel and Conversions API) - only with your consent
On the BIOSHI Marketplace page we ask for consent to ad measurement. Until you click "I agree", nothing is sent to Meta - neither from your browser nor from our server.
After consent: the Meta pixel (Facebook, Instagram) stores cookies in your browser and tells Meta about your visit, about starting the form and about a submitted application, together with your IP address and browser data. We also send the information about a submitted application to Meta from our server (Conversions API): it contains the e-mail, phone and country from the form only as an irreversible hash (SHA-256), the IP address, browser information and identifiers from Meta cookies. We do not send the company name, VAT number, your name or the content of the application.
Purpose: finding out which ads bring producers to us and targeting ads better. Basis: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law).
For the collection of this data and its transmission to Meta we are joint controllers with Meta Platforms Ireland Limited; Meta carries out further processing as an independent controller under the Meta Privacy Policy. Meta may combine this information with your Facebook or Instagram account.
You can change or withdraw your consent at any time: the "Privacy settings" link is at the bottom of the BIOSHI Marketplace page. Withdrawing consent removes the Meta cookies from this browser and stops further transmission; it does not affect the lawfulness of earlier processing. Consent is voluntary - the site and the form work the same without it.
e) Server logs
The server keeps standard logs (IP address, time, page address, browser information). They serve security and error diagnosis (Art. 6(1)(f) GDPR).
3. Cookies and browser storage
| Name | What it is for | How long | Type |
|---|---|---|---|
PHPSESSID | Session: login, form protection, returning entered data after an error | until the browser is closed | necessary |
bioshi_lang | Remembers the selected language | 90 days | necessary (a feature you chose) |
lp_zgoda (cookie and browser storage) | Remembers your decision about ad measurement | consent: 6 months, refusal: 30 days | necessary |
lp_cicho (browser storage) | Remembers the "Stop motion" choice (animations) | until you remove it | necessary (a feature you chose) |
_fbp, _fbc | Meta pixel: recognising the browser and the ad click | 90 days | marketing - only after consent |
Necessary cookies are stored without asking for consent because the site does not work without them. You can also delete or block cookies in your browser settings - blocking the necessary ones makes logging in impossible.
4. Who receives the data
Data is seen by authorised BIOSHI employees and associates. We also use providers who process data on our behalf under data processing agreements: hosting and e-mail providers, Google (cloud and office services), Slack (internal notifications about offers: company name and offer terms) and IT support providers. Meta Platforms Ireland Limited receives data only to the extent described in section 2d and only after your consent. We do not sell data.
We do not share your data with other suppliers or producers.
5. Transfers outside the European Economic Area
Some of our providers (Google, Slack, Meta) may process data in the United States. This is based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or, where a provider is not covered by it, on standard contractual clauses. You can obtain a copy of the safeguards by writing to us.
6. How long we keep the data
- Producer applications: during the assessment; after a negative decision no longer than 12 months (so that we can return to the conversation and recognise a repeated application); after acceptance - as account data.
- Supplier Zone account: while the account is in use and, after its deletion, for the limitation period of claims (as a rule 3 years); accounting documents - 5 years from the end of the year in which the tax obligation arose.
- Correspondence: up to 3 years after the matter is closed.
- Server logs: as a rule no longer than 12 months.
- Ad measurement: cookies as in the table; data sent to Meta - for the period set out in Meta's rules.
If you withdraw consent or request erasure, we will delete the data earlier unless we must keep it because of a legal obligation or claims.
7. Your rights
You have the right to: access your data and receive a copy, rectification, erasure, restriction of processing, data portability, object to processing based on our legitimate interest, and withdraw consent at any time. To exercise them, write to purchases@bioshi.pl. We reply within one month at the latest.
You can also lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl) or with the supervisory authority in your country.
8. Whether you must provide data and where we get it from
Providing data is voluntary, but without the data marked as required we cannot assess an application or create an account. We have the data from you or from the company that designated you as its contact person.
9. Automated decisions and profiling
We do not make decisions about you based solely on automated processing. Offers in the panel are compared using transparent criteria (price, date, terms) and the choice is made by an employee. If you consent to ad measurement, Meta may use the information it receives for ad profiling under its own rules.
10. Changes to this policy
We update the policy when the way we process data changes (for example a new tool). The current version is always on this page, with the effective date at the top.
