1. Data controller
The controller of personal data collected through the BimmerBase store is GoldWires Siarhei Kazlenia, ul. Generała Józefa Bema 89A, lok. 116, 15-370 Białystok, Poland, VAT number: PL5423495595, REGON: 540826963. For any question about your personal data, write to us through the contact form, by e-mail at or by post to the address above.
2. What data we collect
When you place an order or create an account we process: your name, email address, phone number, delivery and billing address, your customer number and order history, and — for businesses — the company name and VAT number. Providing this data is voluntary but necessary to place and fulfil an order — without it we cannot enter into a contract with you.
3. Purpose and legal basis for processing
- Order fulfilment and issuing a proforma invoice — GDPR Art. 6(1)(b) (performance of a contract).
- Handling contact inquiries — GDPR Art. 6(1)(f) (legitimate interest).
- Accounting and tax obligations — GDPR Art. 6(1)(c) (legal obligation).
4. Data retention period
Order-related data is kept for the period required by tax regulations (generally 5 years from the end of the tax year). Data from the contact form is kept only as long as needed to handle the enquiry, no more than 12 months after the last contact.
5. Your rights
You have the right to access your data, correct it, delete it, restrict its processing, request data portability, and object to processing, as well as the right to lodge a complaint with the President of the Personal Data Protection Office (UODO). Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
6. Data recipients
Data may be shared with parcel delivery providers and our shipping intermediary (epaka.pl), our bank and payment provider (to process payments), accounting service providers, hosting/IT service providers and the messaging service through which our staff receive order notifications — strictly to the extent necessary to fulfil the order or run the store.
7. Transfers outside the EEA
Order notifications for our staff are delivered through the Telegram messenger, whose servers may be located outside the European Economic Area; they contain only the data needed to handle the order. Other personal data is, as a rule, not transferred outside the EEA. Any such transfer relies only on mechanisms that ensure an adequate level of protection under GDPR (e.g. standard contractual clauses).
8. Automated decision-making
Customer data is not used for automated decision-making with legal effects, including profiling.
9. Cookies
Rules regarding cookies are described in a separate Cookie policy.
10. How to use your rights
In your account (My account → Settings → Your data) you can download a copy of your data or ask us to delete your account; both requests are confirmed by e-mail first, so nobody can make them in your name. You can also write to us through the contact form, choosing “Personal data request”. We answer within one month. Invoices that have already been issued must be kept for 5 years under tax law, so deleting an account does not remove them.
11. Technical data and security
An order stores the IP address from which it was placed. To protect the store against abuse (guessing passwords, automated requests) we keep short-lived counters tied to a visitor’s IP address; they expire within hours. Visit statistics are collected by the store itself, without cookies and without identifying any person. We do not use advertising or tracking services, and the pages do not load scripts, fonts or images from third-party servers.
12. Messages and minors
We send e-mails about orders, payments, invoices, shipping and the security of your account. Marketing messages are sent only with your separate consent, which you can withdraw at any time. The store is intended for adults; we do not knowingly collect the data of persons under 16.