Velipet Privacy Policy
This Privacy Policy describes how we process the personal data of users of the velipet.com website and of Customers of the velipet.com online shop, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
1. Data controller
The controller of your personal data is: Proteine Resources Sp. z o.o. ul. Jesionowa 11, Masłomiąca, 32-091 Michałowice (Małopolskie Voivodeship), Poland NIP (tax ID): 5130251192, REGON: 368033566 KRS: 0000690446, District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register For any matters relating to personal data protection, you can contact us at: hello@velipet.com. The controller has not appointed a Data Protection Officer (DPO).
2. Purposes and legal bases of processing
We process personal data for the following purposes and on the following legal bases: • Creating and maintaining the Account, authentication (passwordless sign-in via a one-time link, or sign-in with Google): Article 6(1)(b) GDPR (performance of a contract). • Fulfilling one-off orders and Subscriptions (order acceptance, payment, delivery, customer service): Article 6(1)(b) GDPR. • Selecting Products in the Configurator: Article 6(1)(b) GDPR (steps taken with a view to concluding/performing a contract). • Issuing and storing invoices, accounting and tax settlements: Article 6(1)(c) GDPR (legal obligation). • Handling complaints and withdrawals, and establishing or defending legal claims: Article 6(1)(c) and (f) GDPR. • Sending transactional messages: Article 6(1)(b) and (f) GDPR. • Our own marketing, newsletter and offers: Article 6(1)(a) GDPR (consent) and (f) (direct marketing). • Analytics and improving the operation of the Shop: Article 6(1)(a) and/or (f) GDPR. • Ensuring security and preventing abuse: Article 6(1)(f) GDPR.
3. Scope (categories) of data processed
Depending on how you use the Shop, we may process: • Account and contact data: e-mail address, first and last name, telephone number, country. • Google sign-in data (if you choose that method): e-mail address, first name, and Google account identifier. We receive these from Google in the standard scope (openid, e-mail, profile) and use them solely to authenticate and identify your Account. We never receive your Google password. • Pet (dog) data: e.g. name, breed, age, weight, activity level, food intolerances/preferences, provided in the Configurator for the purpose of selecting food. • Personalisation data: grammatical (declension) forms of your dog's name and of your first name, generated and stored so that we can address you in correct Polish. Only the dog's name is shown on the website; the owner's name forms are not displayed publicly. We store them for future personalisation of e-mail messages. Recognition of a returning customer is described in the Cookie Policy. • Addresses: delivery and billing addresses. • Order and Subscription data: order history, Subscription composition and status, frequency, Cycle dates, amounts. • Payment data: information about the payment and its status (we do not store full payment card details). • Invoicing data: buyer details, including the NIP (tax ID) number in the case of business invoices. • Consent and communication data: consents given and communication preferences. • Technical data collected automatically (details in the Cookie Policy).
4. Data recipients / processors
We entrust data to trusted service providers who process it on our behalf, solely to the extent necessary to provide the given service. The categories of recipients, with example providers, are listed below (this list may change): • Payment operators: handling online payments (such as Stripe, Tpay). • Courier companies and logistics operators: carrying out deliveries, including deliveries to parcel lockers (such as DHL, InPost, Omnipack). • Invoicing system / accounting: issuing and archiving sales documents, including via KSeF (Poland's National e-Invoicing System) (such as Fakturownia). • E-mail service provider: sending transactional and marketing messages (such as Resend). • Hosting and backend infrastructure: maintaining the Shop and its data (such as Vercel, Supabase). • Analytics: measuring and improving the operation of the Shop, i.e. Google Analytics 4 and Google Tag Manager (Google Ireland Ltd. / Google LLC); scripts load only after consent is given, see the Cookie Policy for details. • Social sign-in provider: authenticating the user when they choose to sign in with Google (Google Ireland Ltd. / Google LLC). Data may also be disclosed to entities authorised to receive it under applicable law. Some providers may process data outside the European Economic Area (EEA). In such cases, the transfer takes place on the basis of appropriate safeguards, in particular standard contractual clauses (SCCs) in accordance with Article 46 GDPR.
5. Data retention period
1. We process data relating to the Account and the Subscription for the duration of the contract and, after it ends, for the period necessary for settlement and until any claims become time-barred. 2. We store data contained in accounting documents (invoices) for the period required by tax and accounting law. 3. Data processed on the basis of consent: until the consent is withdrawn. 4. Data processed on the basis of legitimate interest (including direct marketing): until a valid objection is raised.
6. Rights of data subjects
1. You have the right to: access your data, rectify it, erase it, restrict its processing, data portability, object to processing based on legitimate interest (including direct marketing), and withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal). 2. Some of these rights can be exercised directly from your Account (including editing profile data and addresses, and managing the Subscription). 3. To exercise your rights, please contact us at: hello@velipet.com. 4. You have the right to lodge a complaint with the supervisory authority, the President of PUODO (the Polish supervisory authority for personal data protection), ul. Stawki 2, 00-193 Warsaw, Poland.
7. Marketing and communication
1. Transactional messages (e.g. order confirmations, delivery statuses, Subscription renewal and payment reminders) are necessary for the performance of the contract and are sent in connection with order fulfilment. 2. We send marketing messages (e.g. newsletter, offers) on the basis of the consent given. Consents are managed separately for each communication purpose. 3. You can opt out of marketing communication at any time via the unsubscribe link in the message or by contacting us.
8. Automated decision-making and profiling
1. Within the Configurator, we prepare Product recommendations based on the information provided about your dog and your preferences. This activity supports the selection of our offer and does not produce legal effects concerning you or similarly significantly affect you. 2. We do not make decisions based solely on automated processing that would produce legal effects or similarly significantly affect the Customer.
9. Data security
1. We apply technical and organisational measures ensuring a level of data protection appropriate to the risk, including access controls limiting each Customer's access to their own data only. 2. Sign-in to the Account is passwordless: either via a one-time authentication link sent to your e-mail, or via your Google account. We neither create nor store Shop passwords, and we have no access to your Google password. We do not store full payment card details: they are processed by the payment operator in accordance with payment industry security standards (PCI DSS).
10. Cookies and changes to this Policy
1. Detailed information about the cookies we use and about consent management can be found in the separate Cookie Policy available in the Shop. 2. This Privacy Policy may be updated from time to time (including in connection with changes in the law, the scope of our services or the list of providers). The current version is always available on the Shop's website.
Last updated: July 20, 2026