1. Introduction
Superwayz (“we”, “us” or “our”) is a sub-brand associated with and operated by Fively Poland sp. z o.o. (“Fively”, the “Company”). Superwayz is a brand name and is not a separately registered trademark. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit our website superwayz.com, including any related media form, channel, mobile website, or application (collectively, the “Site”), and describes your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Polish data protection law.
Please read this Privacy Policy carefully. If you do not agree with its terms, please do not use the Site.
We may update this Privacy Policy from time to time. We will indicate changes by updating the “Last Updated” date. Where changes are material, or where the law requires it, we will provide a more prominent notice (for example, by email or an on-Site notice). Changes take effect when the updated Policy is posted. We encourage you to review this Policy periodically.
2. Data Controller
The controller of your personal data within the meaning of Article 4(7) GDPR is:
Fively Poland sp. z o.o. (operating the Superwayz brand)
UL. SENATORSKA 2, 00-075 WARSZAWA, Poland
Email: contact@5ly.co
We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Article 37 GDPR. For any data protection matter, please use the contact details above.
3. Personal Data We Collect
We collect the following categories of data:
3.1 Data you provide to us
- Identification and contact data: your name, email address, shipping address, telephone number.
- Demographic data: your age, gender, hometown, and interests.
- Account and profile data: registration details, preferences, and content you submit (e.g. via chat, contact forms, surveys, contests or giveaways).
3.2 Data collected automatically
- Technical/derivative data: browser type, IP address, operating system, access times, and the pages you viewed before and after visiting the Site.
- Device data: mobile device ID, model, manufacturer, and approximate device location, where you access the Site via a mobile device.
- Cookie and tracking data: as described in our Cookie Policy.
3.3 Data from third parties
- Social networks: if you connect a social account (e.g. Facebook, Google, Instagram, Apple), we may receive your name, username, email, profile picture, and other information you make available, in line with the permissions you grant.
- Payment data: payment-related data (card brand, last digits, expiry) is processed by our payment processor, Stripe. We store only very limited payment data, if any.
Providing personal data is voluntary, but some data is necessary to use certain features of the Site; without it, those features may be unavailable.
4. Purposes and Legal Bases for Processing
Under Article 6(1) GDPR, we process your personal data only where we have a valid legal basis. The table below sets out our purposes and the corresponding legal bases.
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Creating and managing your account; fulfilling purchases, orders, payments and other transactions; providing customer service. | Performance of a contract — Art. 6(1)(b). |
| Processing payments and refunds via Stripe. | Performance of a contract — Art. 6(1)(b); compliance with legal (accounting/tax) obligations — Art. 6(1)(c). |
| Sending newsletters, marketing emails, targeted ads, coupons and promotions; arranging contests and giveaways. | Consent — Art. 6(1)(a), which you may withdraw at any time. |
| Personalising your experience and recommendations; remembering preferences. | Consent — Art. 6(1)(a) for non-essential personalisation; otherwise our legitimate interests — Art. 6(1)(f). |
| Analytics, usage statistics, improving and securing the Site, preventing fraud and abuse. | Legitimate interests — Art. 6(1)(f); consent — Art. 6(1)(a) where required for analytics/advertising cookies. |
| Responding to legal requests, subpoenas, and assisting law enforcement; resolving disputes; enforcing our terms. | Compliance with a legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f). |
| Transfer of data in connection with a merger, sale, reorganisation or insolvency. | Legitimate interests — Art. 6(1)(f). |
Where we rely on legitimate interests, you have the right to object (see Section 8). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
5. How We Share Your Data
We may share your personal data with the following categories of recipients, acting as our processors or as independent controllers:
- Service providers (processors): payment processing (Stripe), hosting, data analysis, email delivery, customer service, and marketing support, acting on our instructions under data processing agreements.
- Advertising and analytics partners: such as Google Analytics and Yandex Metrica, where you have consented to the relevant cookies.
- Affiliates: Fively Poland sp. z o.o. and companies under common control, bound to honour this Policy.
- Other users: where you interact publicly on the Site (e.g. posts, chat, invitations), your name, profile photo and activity may be visible to others.
- Authorities and legal parties: where necessary to comply with law, respond to legal process, or protect rights, property and safety.
- Successors: in the event of a merger, acquisition, reorganisation, sale of assets or insolvency, your data may be transferred to the successor entity.
We do not sell your personal data.
6. International Data Transfers
Some of our service providers (for example Stripe and Google) may process data outside the European Economic Area (EEA). Where this occurs, we ensure an adequate level of protection through one of the safeguards permitted under Chapter V GDPR, namely: (i) an adequacy decision of the European Commission, or (ii) Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by additional measures where necessary. You may request a copy of the relevant safeguards using the contact details in Section 11.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including the following criteria:
- Account and transaction data: for the duration of your account, and afterwards as required to fulfil legal, accounting and tax obligations (under Polish law, generally up to 5 years from the end of the relevant financial year).
- Marketing data: until you withdraw consent or object, after which it is deleted or anonymised.
- Technical, analytics and cookie data: for the retention periods set out in our Cookie Policy.
Where data is no longer needed, we delete or anonymise it. We may retain limited data where necessary to prevent fraud, resolve disputes, or comply with legal requirements.
8. Your Rights Under the GDPR
Subject to the conditions in the GDPR, you have the following rights:
- Access (Art. 15): to obtain confirmation of, and a copy of, the personal data we hold about you.
- Rectification (Art. 16): to have inaccurate or incomplete data corrected.
- Erasure (Art. 17): to have your data deleted (“right to be forgotten”) in certain circumstances.
- Restriction (Art. 18): to restrict processing in certain circumstances.
- Data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
- Objection (Art. 21): to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Rights regarding automated decision-making (Art. 22): not to be subject to a decision based solely on automated processing producing legal or similarly significant effects.
- Withdrawal of consent (Art. 7(3)): to withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us using the details in Section 11. We will respond within one month, as required by Article 12 GDPR.
Right to lodge a complaint
If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Polish supervisory authority:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO)
ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl
9. Cookies and Tracking Technologies
We use cookies, web beacons, and similar technologies on the Site. Strictly necessary cookies are used on the basis of our legitimate interest in operating the Site. All other cookies (including analytics, personalisation and advertising cookies) are set only after you give consent through our cookie consent banner, and you may change or withdraw your choices at any time. Full details are set out in our Cookie Policy, which forms part of this Privacy Policy.
Do-Not-Track
No uniform Do-Not-Track (“DNT”) standard has been adopted. As such, we do not currently respond to DNT signals. If a binding standard is adopted, we will update this Policy accordingly.
10. Security and Third-Party Websites
We use appropriate administrative, technical, and physical measures to protect your personal data, as required by Article 32 GDPR. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The Site may contain links to third-party websites and services that are not operated by us. This Privacy Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review their privacy policies before providing any data.
11. Contact Us
For any questions, requests, or to exercise your rights regarding this Privacy Policy, please contact:
Superwayz — a sub-brand of Fively Poland sp. z o.o.
UL. SENATORSKA 2
00-075 WARSZAWA, Poland
contact@5ly.co