Velipet Privacy Policy
This Privacy Policy describes how we process the personal data of users of the velipet.com website and of customers of the online shop, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). We use the terms defined in the Shop Terms and Conditions – in particular “Account”, “Configurator”, “Pack”, “Starter Pack”, “Subscription” and “Cycle”.
1. Data controller
The controller of personal data is: Proteine Resources Sp. z o.o. ul. Jesionowa 11, Masłomiąca, 32-091 Michałowice, Poland (Lesser Poland Voivodeship) VAT ID (NIP): 5130251192, REGON: 368033566 KRS: 0000690446, District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register Share capital: PLN 134,300.00 For all matters concerning the protection of personal data you may contact us at hello@velipet.com or in writing at our registered office. The controller has not appointed a Data Protection Officer.
2. Where we obtain your data
1. We primarily process data that you provide to us yourself: in the Configurator, in the order form, on the Logged-in pages, in correspondence with customer service and in the forms available on the site (waiting list, B2B enquiries, reviews, return and complaint notifications). 2. Some data arise on our side in connection with performance of the contract – for example order history, the Subscription schedule, the calculated food portion and payment status. 3. Some data we receive from third parties, to the extent necessary to perform the contract: • from payment providers: payment status, the identifier (token) of a saved payment method, information about a failed charge and its reason. We do not receive your full card number; • from carriers and the logistics operator: consignment status, tracking number, the collection point you indicated; • from our e-mail service provider: information about delivery or non-delivery of a message; • from Google: authentication data, if you choose to sign in with a Google account (see sections 3 and 4).
3. Purposes and legal bases of processing
We process personal data for the following purposes and on the following legal bases: • Operating the Account and authentication – signing in with a one-time link (“magic link”) or with a Google account. The Account is created automatically in the course of the first order; we do not create or store passwords. Basis: Article 6(1)(b) GDPR. Retention: for the term of the Account agreement and then until claims become time-barred. • Selecting food in the Configurator – on the basis of data about your dog we calculate the daily portion and recommend the composition and size of the Pack; the result determines the size of subsequent deliveries, the Subscription frequency and the level of the standing discount. Basis: Article 6(1)(b) GDPR. Retention: for the term of the Account; you may change or delete your dog's data on the Logged-in pages. • Fulfilling orders and Subscriptions – including maintaining the delivery schedule (planned dates, amendment deadlines, the history of postponements, skips, pauses and resumptions) and the Starter Pack marker attached to the Subscription, which holds the parameters of the introductory offer: the starter interval calculated for your dog, the amounts and discounts envisaged for the first and second deliveries, and the point of transition to the steady mode. That marker is necessary so that the amount shown to you before purchase is exactly the amount we take. Basis: Article 6(1)(b) GDPR. Retention: for the term of the contract and then until claims become time-barred. • Payments, including recurring payments – payment status and the identifier (token) of the saved payment method: a card token or the identifier of consent to recurring charges in the BLIK service. The token refers to a method held by the provider; we do not store full payment card details. If a charge fails, we process information about the failure and its reason in order to make further attempts and to contact you. Basis: Article 6(1)(b) and (f) GDPR. Retention: for the term of the Subscription; we delete the token once it ends permanently or is replaced. • Delivery, including choice of collection point – we pass the address, recipient contact details and telephone number to the carrier. If you choose a parcel locker, you indicate the specific locker after paying for the order; we then process the identifier and address of the point you indicated. Basis: Article 6(1)(b) GDPR. • Sales documents and tax obligations – issuing and storing invoices and submitting them to the National e-Invoicing System (KSeF) to the extent required by law. Basis: Article 6(1)(c) GDPR. Retention: as a rule 5 years counted from the end of the calendar year in which the tax payment deadline fell. • Introductory offers and prevention of abuse – to establish whether you are entitled to an introductory offer (in particular the Starter Pack) we check whether you previously held an Account and previously placed a paid order. For that check we use the e-mail address, delivery address, payment instrument details and device identifier. The same mechanism serves to detect attempts to use the same offer more than once. Basis: Article 6(1)(f) GDPR – our legitimate interest in ensuring that an introductory offer reaches only its intended recipients, and in preventing abuse. The check is limited to the fact of an earlier purchase and does not build a profile of your behaviour. You have the right to object (section 6). • Discount codes – information about the use of a code, its association with your e-mail address or Account, the number of uses and the reason for refusing to apply it. Basis: Article 6(1)(b) and (f) GDPR. • Transactional messages – order confirmations, notifications of an upcoming charge stating the amount, date and amendment deadline, information about payment and consignment status, messages about failed payments, and links enabling an interrupted payment to be completed or a payment method to be repaired. Basis: Article 6(1)(b) GDPR. These messages are not commercial information and cannot be unsubscribed from separately from the service itself. • Marketing and the Newsletter – with your consent. Basis: Article 6(1)(a) GDPR and, for our own marketing directed at our customers, Article 6(1)(f) GDPR. Retention: until consent is withdrawn or an effective objection is raised. • Content personalisation – the grammatical forms (inflections) of your dog's name and of your own name, generated so that we can address you in correct Polish. On the site we display only the dog's name; we do not display forms of the owner's name publicly. Basis: Article 6(1)(f) GDPR. Recognition of returning customers is described in the Cookie Policy. • Reviews, photographs and materials submitted by you – publication and use in marketing materials on the terms set out in the Terms and Conditions. Basis: Article 6(1)(a) and (f) GDPR. Retention: until consent is withdrawn or the material is removed. • Complaints, withdrawals, returns and claims. Basis: Article 6(1)(c) and (f) GDPR. Retention: until claims become time-barred and, in the event of a dispute, until it is finally resolved. • Security, diagnostics and maintenance of the site – technical data and event logs. Basis: Article 6(1)(f) GDPR. • Waiting list, B2B enquiries and earlier campaigns – on the terms specified for the relevant form or campaign. Basis: Article 6(1)(a) or (b) GDPR.
4. Categories of data processed
Depending on how you use the Shop, we may process: • Identification and contact data: first name and surname, e-mail address, telephone number, country. • Data from Google sign-in (if you choose this method): e-mail address, first name and Google account identifier. We receive these from Google within the standard scope (openid, e-mail, profile) and use them solely to authenticate and identify your Account. We do not receive your Google password. • Address data: delivery and billing addresses, the collection point indicated. • Data about your dog: name, breed, age, body weight, activity level, intolerances and dietary preferences, provided in the Configurator in order to select food. • Calculated data: daily food portion, recommended Pack size, delivery frequency, discount level. • Order and Subscription data: order history, the composition and status of the Subscription, the schedule and history of changes, the Starter Pack marker, Cycle dates and amounts. • Payment data: payment status, the identifier (token) of the saved payment method, information about a failed charge – without full payment card details. • Invoice data: purchaser details, including the VAT ID for company invoices. • Discount data: discount codes used, discounts granted, the outcome of the introductory-offer eligibility check. • Consent and communication data: consents given and withdrawn, communication preferences, records of message dispatch and delivery. • Personalisation data: grammatical forms of the dog's name and the owner's name. • Content provided by you: correspondence with customer service, reviews, photographs, complaint notifications. • Technical data: device identifier, IP address, browser information, event logs – see the Cookie Policy. We do not process special categories of personal data within the meaning of Article 9 GDPR on the site, and we ask you not to send us such data, in particular information about the dog owner's health.
5. Recipients of data / processors
We entrust data to trusted service providers who process them on our behalf solely to the extent necessary to provide the relevant service, under processing agreements meeting the requirements of Article 28 GDPR. Below we list the categories of recipients together with example providers (the list may change): • Payment providers: taking payments and handling recurring payments (Stripe Payments Europe Ltd., Krajowy Integrator Płatności S.A. – Tpay). • Logistics operator and carriers: picking and delivering consignments, including to parcel lockers (including Omnipack, DHL, InPost, DPD). • Invoicing system and accounting: issuing and archiving sales documents, including KSeF (including Fakturownia). • E-mail service provider: sending transactional and marketing messages (including Resend Inc.). • Hosting and backend infrastructure: running the Shop and its data (including Vercel Inc., Supabase Inc.). • Analytics: measuring and improving the Shop – Google Analytics 4 and Google Tag Manager (Google Ireland Ltd. / Google LLC); scripts are loaded only after analytics consent is given, see the Cookie Policy. • Social sign-in provider: authenticating the user where they choose to sign in with Google (Google Ireland Ltd. / Google LLC). Data may also be disclosed to entities authorised under the law, in particular tax and law-enforcement authorities, upon their justified request. Some providers may process data outside the European Economic Area (EEA). In such cases the transfer takes place on the basis of the safeguards provided for in Chapter V GDPR – a European Commission adequacy decision or standard contractual clauses compliant with Article 46(2)(c) GDPR, supplemented by additional measures where necessary. We will provide a copy of the safeguards applied on request.
6. Your rights
1. You have the right to: • access your data and obtain a copy of it (Article 15 GDPR); • rectify inaccurate data and complete incomplete data (Article 16 GDPR); • erase data (Article 17 GDPR) – to the extent that we are not obliged to retain it, in particular under tax law; • restrict processing (Article 18 GDPR); • data portability for data processed on the basis of consent or a contract (Article 20 GDPR); • object to processing based on our legitimate interest – including the introductory-offer eligibility check and personalisation – and, in the case of direct marketing, to object unconditionally, which we always uphold (Article 21 GDPR); • withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR). 2. You can exercise some of these rights yourself on the Logged-in pages – in particular you can correct your profile data, addresses and dog data, manage communication consents, review order history and pause or cancel your Subscription. 3. Otherwise, write to hello@velipet.com. We respond without undue delay and no later than within one month of receiving the request; in complex cases that period may be extended by a further two months, of which we will inform you. We may ask for additional information to confirm your identity if we have reasonable doubts as to the identity of the person making the request. 4. You have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
7. Is providing data mandatory?
Providing data is voluntary, but: • providing contact, address and payment data is a condition of concluding and performing the contract – without it we cannot fulfil an order; • providing data about your dog is a condition of using the Configurator and of selecting the Pack correctly; • providing invoice data is a statutory requirement for invoices issued to a company; • providing an e-mail address for the Newsletter is voluntary and does not affect your ability to make purchases.
8. Retention periods
1. The retention periods assigned to individual purposes are set out in section 3. The general rules are as follows. 2. Data connected with the Account and Subscription are processed for the term of the contract and, after it ends, for the period necessary for settlement and until any claims become time-barred. 3. Data on accounting documents (invoices) are kept for the period required by tax and accounting law. 4. Data processed on the basis of consent: until that consent is withdrawn. 5. Data processed on the basis of a legitimate interest (including direct marketing): until an effective objection is raised.
9. Marketing and communication
1. Transactional messages – order confirmations, delivery statuses, notifications of an upcoming charge and payment-related messages – are necessary to perform the contract and are sent in connection with fulfilling an order. 2. Marketing messages (the Newsletter, offers) are sent on the basis of the consent you have given. Consents are managed separately for individual communication purposes. 3. You may opt out of marketing communication at any time using the unsubscribe link in the message, the settings on the Logged-in pages, or by contacting us. Unsubscribing from the Newsletter does not switch off transactional messages.
10. Automated decision-making and profiling
1. We carry out the following automated operations on the site: • calculating the food portion and the selection and size of the Pack on the basis of data about your dog; • determining the delivery schedule and the level of the standing discount, both derived from the calculated portion; • checking eligibility for an introductory offer and monitoring discount-code usage limits. 2. In our assessment these operations do not constitute a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22(1) GDPR – they concern the selection of goods and the terms of a promotional offer, not your legal status or your access to the service as such. Every purchase remains available to you regardless of the outcome of the introductory-offer eligibility check. 3. Independently of the above, we give you the opportunity to contest the outcome of that check: simply write to hello@velipet.com – a member of our staff will review the matter, we will explain the basis of the decision and give you the opportunity to present your own position.
11. Data security
1. We apply technical and organisational measures appropriate to the risk, including encryption of transmission and access controls restricting each Customer's access to their own data only. 2. Signing in to the Account is passwordless: through a one-time authentication link sent by e-mail or through a Google account. We do not create or store passwords for the Shop and we have no access to your Google password. This means that access to your e-mail inbox is equivalent to access to your Account – we recommend securing that inbox, in particular with two-factor authentication. If you suspect that an unauthorised person has gained access to your inbox or Account, write to hello@velipet.com: we will block further sign-ins and suspend the fulfilment of scheduled deliveries. 3. We do not store full payment card details – they are processed by the payment provider in accordance with payment industry security standards (PCI DSS).
12. Children
The site is intended solely for persons of full age. We do not direct our offer at children and we do not knowingly collect data relating to persons under 18 years of age.
13. Cookies and changes to this Policy
1. Detailed information about the cookies and related technologies we use – including browser local storage – and about managing consents can be found in the separate Cookie Policy available in the Shop. 2. This Privacy Policy may be updated from time to time, for example in connection with changes in the law, in the scope of our services or in our list of providers. The current version is always available on the Shop website. We will give you advance notice of any material change – by e-mail if you hold an Account, or by a notice on the site.
Last updated: August 3, 2026