Effective from: 1 January 2026

1. Data Controller

The data controller is MaxAnimals Sp. z o.o., registered in Warsaw, ul. Przykladowa 10, 00-001 Warsaw, Poland, NIP: 1234567890. Data Protection Officer contact: iod@maxanimals.pl.

2. Data Collected

We collect the following data: first and last name, e-mail address, phone number, delivery and billing address, tax ID (optional), order and payment data, pet information (name, species, breed, age, weight, body condition score, playdate profile -- voluntary), activity data (walks, GPS location -- with consent), veterinary photos (breed, BCS, skin lesions -- voluntary, for AI analysis), social data: lost-pet broadcasts, NFC/QR tags and their scans, heat-in-car alert sessions, pet-sitter share links, playdate interactions, dog-friendly place reviews, short-lived presence pings at POIs and in your area (TTL 30 min, blurred to a ~500 m grid, k-anonymity threshold 2-3), product Q&A, product collections, affiliate links and their conversions, technical data (IP address, device type, browser).

3. Purposes of Processing

We process data for: fulfilling orders and delivering Products, managing your Account and providing Service features, operating the loyalty programme and subscriptions, personalising product recommendations (AI), tracking pet activity (walks, health), marketing communications (with consent), fulfilling legal obligations (accounting, taxation).

4. Legal Basis

Processing is based on: Art. 6(1)(b) GDPR -- performance of a contract, Art. 6(1)(a) GDPR -- consent (marketing, GPS tracking, newsletter), Art. 6(1)(c) GDPR -- legal obligation (accounting), Art. 6(1)(f) GDPR -- legitimate interest of the controller (security, analytics).

5. Data Retention

Order data: 5 years from the end of the tax year (accounting obligation). Account data: until account deletion. Marketing data: until consent is withdrawn. Activity data (walks, GPS): 24 months from last activity. Lost-pet broadcasts: until the report is resolved or the account is deleted. NFC/QR tags and scan history: until the owner deactivates the tag or deletes the account. Heat-in-car alert sessions: until the session ends + 24h diagnostic log. Pet-sitter share links: until the token expires or is revoked by the owner. Playdate profiles and interaction history: until opt-out or account deletion. Dog-friendly place reviews: until account deletion or manual review removal. Presence pings (POI presence, Nearby Now): TTL 30 minutes, removed by an automatic job every 5 minutes. Product Q&A and product collections: until account deletion. Affiliate links and conversions: 5 years (accounting obligation). Technical logs: 12 months.

6. Data Sharing

Data may be shared with: payment operators (Stripe Payments Europe Ltd.), courier companies (InPost, DPD, DHL, Poczta Polska), IT service providers (hosting, e-mail), government authorities as required by law. We do not transfer data outside the European Economic Area, except to Stripe Inc. (USA) under Standard Contractual Clauses.

7. Cookies

The Service uses cookies: essential (session, cart, authentication), functional (language preferences, selected tenant), analytical (visit statistics -- with consent). Cookie settings can be changed in your browser. Disabling essential cookies may prevent you from using the Service.

8. Your Rights

You have the right to: access your data, rectify your data, erase your data (right to be forgotten), restrict processing, data portability, object to processing, withdraw consent at any time, lodge a complaint with the supervisory authority (Prezes Urzedu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

9. Children's Data

The Service is not intended for persons under 16 years of age. We do not knowingly collect personal data from children. If a parent or guardian learns that a child has provided us with personal data, please contact us -- the data will be promptly deleted.

10. Data Security

We apply appropriate technical and organisational measures to protect personal data: encrypted connections (TLS/SSL), multi-factor authentication (Keycloak), regular security audits, role-based access control, encryption of sensitive data at rest.

11. Policy Updates

We reserve the right to update this Privacy Policy. We will notify you of material changes via the Service or by e-mail at least 14 days before they take effect.

12. Contact

For data protection matters please contact: Data Protection Officer: iod@maxanimals.pl MaxAnimals Sp. z o.o. ul. Przykladowa 10, 00-001 Warsaw, Poland