Privacy Policy

Last updated: 16 September 2026

Woof Root runs this shop and website, including all related information, content, features, tools, products and services, to give you a tailored shopping experience (the "Services"). This Privacy Policy explains how we collect, use and share your personal data when you visit or use the Services, buy through them or otherwise get in touch with us. If our Terms of Service and this Privacy Policy conflict, this Privacy Policy governs how we collect, process and share your personal data.

Please read this Privacy Policy carefully. By accessing and using the Services, you confirm that you have read it and understand how we collect, use and share your data as described here.

1. Data controller

The controller of your personal data is:

WEEV
ul. Milczańska 18c/15, 61-131 Poznań, Poland
Email: hello@woofroot.com
Website: woofroot.com

We have not appointed a Data Protection Officer (DPO) because we are not required to under Article 37 GDPR. For any data protection matters, please email us at hello@woofroot.com.

2. Personal data we process

"Personal data" means information that identifies you or can reasonably be linked to you. It does not include information collected anonymously or anonymised so that it can no longer identify you. Depending on how you use the Services, we may collect or process the following categories of personal data:

  • Identity and contact data – first name, last name, phone number, email address.
  • Address data – delivery address, billing address.
  • Payment data – transaction details, payment method, payment confirmations. Card and bank account details are handled solely by the payment operator; we have no access to them.
  • Account data – email address, password (stored in encrypted form) and saved delivery and invoice details.
  • Transaction data – order history, products added to the cart, returns and cancellations.
  • Communication data – the content of messages you send to our customer service.
  • Technical data – IP address, device and browser identifiers, network connection data.
  • Usage data – how you use the website, navigation, visit duration, elements you click.

We do not process special categories of personal data within the meaning of Article 9 GDPR (such as health data, religious beliefs or biometric data).

3. Legal bases and purposes of processing

We process personal data only when we have a valid legal basis under Article 6 GDPR.

Performance of a contract (Article 6(1)(b) GDPR)

Processing necessary to enter into or perform a sales contract, including accepting and fulfilling orders, arranging shipping and delivery, handling returns and complaints, managing your account and communicating with you about your order.

Legal obligations (Article 6(1)(c) GDPR)

Processing necessary to comply with the law, including issuing invoices and keeping accounting records (tax obligations – data kept for 5 years), complying with consumer protection rules and responding to requests from public authorities.

Legitimate interests (Article 6(1)(f) GDPR)

We process data based on our legitimate interests, having weighed them against your interests and rights, in particular to prevent fraud and illegal activity, keep the Services and our IT infrastructure secure, establish or defend legal claims, and compile anonymised or aggregated statistics. You have the right to object to processing based on legitimate interests – see section 10.

Consent (Article 6(1)(a) GDPR)

Where processing requires your consent (for example email marketing or analytics and marketing cookies), we ask for it separately before the processing starts. Consent is voluntary and you can withdraw it at any time, without affecting the lawfulness of processing carried out before you withdrew it.

4. Marketing and advertising

We use your personal data for marketing only with your explicit consent (email or SMS marketing) under Article 6(1)(a) GDPR and applicable electronic communications law, or based on our legitimate interest in direct marketing of similar products and services to existing customers (Recital 47 GDPR).

You can opt out of marketing messages at any time by clicking the "Unsubscribe" link in any email or by contacting us at hello@woofroot.com. Opting out does not affect transactional messages such as order confirmations.

For personalised online advertising (including cookie-based ads) we rely on consent. You can change your choices at any time using the cookie banner on our website.

5. Sources of personal data

We may collect personal data from the following sources:

  • Directly from you – when you create an account, place an order, use the Services or contact us.
  • Automatically through the Services – from your device while you use the website, using cookies and similar technologies.
  • From our service providers – when we work with them to provide technology and they collect or process your data on our behalf.
  • From business partners and other third parties – to the extent permitted by law.

6. Recipients of personal data

We may share your personal data with the following categories of recipients:

  • Server infrastructure provider – hosting the shop on servers located in Frankfurt am Main, Germany.
  • Payment operator – PayPro S.A., operator of Przelewy24, acting as an independent controller or as a processor within the meaning of the GDPR.
  • Courier and logistics companies – to the extent needed to deliver your order.
  • IT and cloud service providers – companies providing technical infrastructure, hosting and security.
  • Analytics and marketing tool providers – for example Google Analytics or Meta Ads (only if you consent to the relevant cookies).
  • Customer service providers – companies that help us communicate with customers.
  • Public authorities – where disclosure is required by law or a final court decision.
  • Legal successors – in the event of a merger, acquisition or reorganisation of the business.

All parties processing data on our behalf do so under a data processing agreement concluded in accordance with Article 28 GDPR.

7. Transfers outside the EEA

Your data is stored on servers located in the European Economic Area (EEA). If any of our providers processes data outside the EEA, the transfer will only take place with appropriate safeguards, in particular:

  • Standard Contractual Clauses (SCC) adopted by the European Commission (Implementing Decision 2021/914),
  • a transfer to a country recognised by the European Commission as providing an adequate level of data protection (for example Canada).

You can obtain a copy of these safeguards by contacting us at hello@woofroot.com.

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes it was collected for, taking applicable law into account:

  • Account data – for as long as you have an account and for 12 months after it is deleted (to handle any claims).
  • Transaction data and accounting records – for 5 years from the end of the tax year in which the transaction took place (required by tax law).
  • Marketing data (based on consent) – until you withdraw consent, or for 3 years after your last interaction with our messages.
  • Customer service communications – for 3 years after the matter is closed.
  • Technical data (logs, IP addresses) – for 12 months from collection.
  • Data processed based on legitimate interests – until your objection is upheld or the legitimate interest ends, but no longer than 3 years.

After the retention period ends, the data is deleted or anonymised.

9. Automated decision-making and profiling

We do not use profiling.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

10. Your rights

Under the GDPR you have the following rights:

  • Right of access (Article 15 GDPR) – to find out what data we process about you and to receive a copy.
  • Right to rectification (Article 16 GDPR) – to have inaccurate data corrected or incomplete data completed.
  • Right to erasure (Article 17 GDPR) – to have your data deleted in the cases provided for by law.
  • Right to restriction of processing (Article 18 GDPR) – to have processing limited to storage in the cases set out in the GDPR.
  • Right to data portability (Article 20 GDPR) – to receive your data in a structured format and have it transferred to another controller (for data processed based on consent or a contract).
  • Right to object (Article 21 GDPR) – to object to processing based on legitimate interests. Once you object, we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests.
  • Right to withdraw consent (Article 7(3) GDPR) – where processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please email us at hello@woofroot.com. We will reply without undue delay and in any case within one month of receiving your request. For particularly complex requests, this period may be extended by a further two months, and we will let you know if it is.

We may ask you to verify your identity before handling a request. We will not treat you differently for exercising your rights. Where permitted by law, you may authorise a representative to make requests on your behalf.

11. Right to lodge a complaint

If you believe that the processing of your personal data breaches the GDPR or other data protection law, you have the right to lodge a complaint with a supervisory authority.

For people living in Poland, the competent authority is:

President of the Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
Phone: +48 22 531 03 00
Website: uodo.gov.pl

If you live in another EEA country, you can find your supervisory authority on the website of the European Data Protection Board.

Before contacting a supervisory authority, we encourage you to get in touch with us first – we will do our best to resolve the issue directly.

12. Hosting and data location

The shop runs on the Controller's own software, hosted on servers located in Frankfurt am Main, Germany. The server infrastructure provider processes personal data solely as a processor within the meaning of Article 28 GDPR, under a data processing agreement and only to the extent necessary to run the server.

Data needed to fulfil your order is shared only with the recipients listed in section 6, and only as far as necessary to perform the contract.

13. Third-party websites

The Services may contain links to websites and other online platforms run by third parties. If you visit sites that are not affiliated with or controlled by us, please read their privacy policies. We do not guarantee the privacy or security of such sites and are not responsible for them.

14. Children's data

The Services are not intended for children under 16, and we do not knowingly collect their personal data. If you are a parent or legal guardian and learn that a child has given us their data without your knowledge and consent, please contact us at hello@woofroot.com straight away – we will delete the data without undue delay.

15. Data security

We apply appropriate technical and organisational security measures in line with Article 32 GDPR, including encrypted data transmission (TLS/SSL), encrypted password storage and access control to our systems and data. Despite these measures, no system is completely immune to breaches.

If we detect a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority (UODO) within 72 hours and inform you without undue delay, in accordance with Articles 33 and 34 GDPR.

We recommend using strong, unique passwords and never sharing your login details with anyone.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in how we process data. We will tell you about significant changes at least 14 days in advance, by email or with a clear notice on our website. The "Last updated" date at the top always shows the current version.

17. Contact

If you have any questions about this Privacy Policy or want to exercise your rights, please contact us:

Woof Root
Email: hello@woofroot.com
Address: ul. Milczańska 18c/15, 61-131 Poznań, Poland

We aim to reply within 3 business days, and in any case within the time limit set by the GDPR.

Under applicable data protection law, we are the controller of your personal data within the meaning of Article 4(7) GDPR.