Privacy Policy

1. Data Controller

The data controller for La Grana Integrator platform users is La Grana, reachable by e-mail: integracje@lagrana.pl.

For all matters related to personal data protection, please contact: integracje@lagrana.pl.

2. Data we collect

Depending on how you use the platform, we may process the following categories of data:

• Account data — first name, last name, email address, username, password (stored as a cryptographic hash).
• Business data — company name, address, tax ID — provided optionally when configuring a StoreForge store or via the contact form.
• Order data — data of StoreForge store buyers (name, delivery address, contact email) and details of ordered products and transaction values.
• Technical data — IP address, browser type, operating system, pages visited, visit duration — collected automatically by the server and optionally by Google Analytics 4 (only with user consent).
• Contact form data — name, email, phone, message content.

3. Legal basis for processing

We process personal data on the following legal bases in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR):

• Art. 6(1)(b) GDPR — processing necessary for the performance of a contract or to take steps prior to entering into a contract (account management, order fulfilment).
• Art. 6(1)(a) GDPR — consent of the data subject (analytical cookies / GA4 — given via the cookie banner).
• Art. 6(1)(c) GDPR — compliance with a legal obligation of the controller (e.g. retention of accounting records).
• Art. 6(1)(f) GDPR — legitimate interests of the controller (system security, fraud prevention, handling contact form enquiries).

4. Purposes of data processing

• Creating and maintaining user accounts on the platform.
• Providing integration tools (REST API, XML, plugins, StoreForge, AllegroHub).
• Operating online stores created in StoreForge, including order fulfilment.
• Responding to enquiries submitted via the contact form.
• Traffic analysis and platform optimisation (Google Analytics 4 — only with consent).
• Ensuring system security and preventing abuse.
• Fulfilling obligations arising from applicable law.

5. Your rights

You have the following rights regarding the processing of your personal data:

• Right of access — you may request information about what data we hold and how we process it.
• Right to rectification — you may correct inaccurate or incomplete data.
• Right to erasure — you may request deletion of data when it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing — you may request that processing be restricted in certain circumstances.
• Right to data portability — you may receive your data in a structured, commonly used, machine-readable format.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time (e.g. by changing cookie settings in the banner).
• Right to lodge a complaint — you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) or your local supervisory authority.

To exercise any of the above rights, please contact: integracje@lagrana.pl.

6. Cookies

The service uses two types of cookies:

• Necessary cookies — required for the platform to function correctly. These include login sessions, CSRF tokens, and the StoreForge shopping cart. They do not require user consent.
• Analytical cookies (Google Analytics 4) — used only after the user gives consent via the cookie banner. GA4 collects anonymous traffic data (pages visited, visit duration, country, device type). This data is processed by Google LLC in accordance with their privacy policy. IP anonymisation is enabled by default.

Cookie preferences are stored locally in the browser (localStorage). Consent can be withdrawn at any time by deleting the lg_cookie_consent key from localStorage or refreshing the page after clearing local data.

7. Data recipients

Personal data may be transferred to the following categories of recipients:

• Technical infrastructure providers — hosting, database and email services (EmailLabs).
• Google LLC — only when consent is given for analytical cookies (Google Analytics 4). Google processes data on servers in the EU or USA in accordance with standard contractual clauses.
• Public authorities — when required by law.

We do not sell or share personal data with third parties for marketing purposes.

8. Data retention periods

• Account data — for the duration of the active account on the platform and for the period required by law after its closure.
• Order data — for 5 years from the end of the tax year in which the transaction took place (tax requirements).
• Contact form data — for 12 months from the date the reply was given.
• GA4 analytical data — for the period configured in Google Analytics (default 14 months).

9. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. These include encrypted connections (HTTPS/TLS), password hashing, restricted data access, and regular security reviews.

10. Changes to the Privacy Policy

We reserve the right to update this privacy policy. We will notify users of significant changes by email or by a prominent notice on the website. The effective date of the updated version will be shown at the top of the document.

11. Contact

For matters relating to personal data protection or this privacy policy, please contact us:

La Grana
E-mail: integracje@lagrana.pl