Privacy policy

Last Updated: July 8, 2026

This Privacy Policy explains how Fuelup Factory Sp. z o.o. collects, uses, processes, and protects your personal data when you visit store.fuel-up.com or make a purchase from within the European Union (EU), European Economic Area (EEA), and Switzerland.

1. DATA CONTROLLER

For residents of the EU, EEA, and Switzerland, the data controller responsible for your personal data is:

  • Company Name: Fuelup Factory Sp. z o.o.

  • Registered Address: ul.Galaktyczna 32a, 80-299 Gdańsk, Poland

  • Tax Identification Number (NIP / VAT): 5842856230

  • Contact Email: return@fuel-up.com

2. CATEGORIES OF PERSONAL DATA WE COLLECT

We process the following categories of personal data:

  • Account Data: Login credentials, user ID, and associated order history.

  • Identifiers: First name, last name, shipping address, billing address, email address, and phone number.

  • Commercial Data: Purchase history, product preferences, transaction details (processed exclusively by PCI-DSS compliant third-party payment gateways; we do not store raw credit card data).

  • Marketing Preferences: Email address and opt-in consent history for receiving our newsletter.

  • User-Generated Content: Product reviews, ratings, and any content submitted via our review application.

  • Technical & Network Data: IP address, browser type, operating system, unique device identifiers, and browsing behavior on our website collected via cookies.

3. LEGAL BASIS FOR PROCESSING UNDER GDPR

We process your personal data strictly in accordance with Article 6 of the General Data Protection Regulation (GDPR):

Purpose of Processing

Categories of Data

Legal Basis (GDPR)

Order Processing & Fulfillment: Managing purchases, processing payments, and delivering products.

Identifiers, Commercial Data

Performance of a Contract (Art. 6(1)(b) GDPR)

Account Management: Creating and maintaining optional customer accounts.

Account Data, Identifiers

Consent (Art. 6(1)(a) GDPR)

Email Marketing: Sending newsletters, promotional offers, and product updates.

Marketing Preferences

Consent (Art. 6(1)(a) GDPR) — Strictly Opt-In

Product Reviews: Displaying verified user-generated product reviews.

User-Generated Content

Consent (Art. 6(1)(a) GDPR)

Website Analytics: Understanding site traffic, user behavior, and layout optimization.

Technical & Network Data

Consent (Art. 6(1)(a) GDPR) via Cookie Banner

Fraud Prevention & Security: Protecting our infrastructure against unauthorized activity or payment fraud.

Technical Data, Commercial Data

Legitimate Interests (Art. 6(1)(f) GDPR)

Legal Compliance: Fulfilling mandatory tax, bookkeeping, and corporate accounting obligations.

Identifiers, Commercial Data

Legal Obligation (Art. 6(1)(c) GDPR)

4. INTERNATIONAL DATA TRANSFERS

To operate our international store, personal data collected within the EU/EEA is transferred to and processed in the United States. This includes data transferred to our corporate affiliate, Fuel UP USA Inc., our e-commerce platform host (Shopify), and our analytics or marketing partners.

To guarantee an adequate level of data protection, all such transfers are executed using verified legal mechanisms under Chapter V of the GDPR, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission.

  • Verification that recipients are certified under the EU-US Data Privacy Framework.

5. DATA PROCESSORS (THIRD-PARTY SHARING)

We do not sell, rent, or lease your personal data. We disclose data to trusted service providers (Data Processors) solely to operate our store:

  • Shopify Inc. (USA/Global): Core e-commerce hosting, store database management, and transactional structures.

  • Payment Gateways (US/EU): Secure, encrypted financial transaction processing.

  • Shipping & Logistics Carriers (EU): Physical delivery and tracking of your ordered packages.

  • Google LLC (USA): Google Analytics traffic analysis (activated only upon your explicit consent).

  • Judge.me (USA): Product review capture, display, and publication engine.

  • Meta Platforms, Inc. (USA): Marketing, remarketing, and conversion tracking (activated only upon your explicit consent).

6. DATA SUBJECT RIGHTS (GDPR)

As an EU/EEA resident, you hold the following statutory rights regarding your personal data:

  • Right of Access: Request a copy of all personal data we hold about you.

  • Right to Rectification: Request correction of any inaccurate or incomplete data.

  • Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your data where valid legal grounds apply.

  • Right to Restrict Processing: Request suspension of processing under specific scenarios.

  • Right to Data Portability: Request transfer of your data to another organization in a machine-readable format.

  • Right to Object: Object to data processing executed under our "Legitimate Interests" framework.

  • Right to Withdraw Consent: Revoke consent at any time for analytics, reviews, or marketing, without affecting the lawfulness of processing before the withdrawal.

📧 How to exercise your rights: Contact our data privacy team at return@fuel-up.com. We are legally mandated to verify your identity and respond within 30 days.

Supervisory Complaint: You have the right to lodge an official complaint with your local Data Protection Authority. For Fuelup Factory Sp. z o.o., the lead supervisory body is the President of the Personal Data Protection Office in Poland (UODO — Urząd Ochrony Danych Osobowych).

7. COOKIE POLICY & PREFERENCE MANAGEMENT

Cookies are small data files stored on your device to improve site navigation and analyze engagement.

Categorization of Cookies:

  • Strictly Necessary: Essential for core operations (e.g., maintaining items in your cart, checkout security via Shopify). These do not require consent.

  • Analytics, Marketing, and Functional Cookies: Used by Google Analytics, Meta Pixel, and Judge.me. These are blocked by default in the EU.

Preference Control:

When first loading our site, an EU-compliant Cookie Banner will prompt you to "Accept All", "Decline All", or "Manage Settings". You can modify your chosen preferences or completely withdraw your consent at any moment by clicking the [Cookie Settings] link located in the footer of our website.

8. DATA RETENTION periods

  • Financial & Tax Records: Retained for up to 10 years to comply with statutory Polish and EU accounting frameworks.

  • Customer Accounts: Retained for the duration of active use, or until a formal deletion request is processed.

  • Marketing Lists: Kept active until you opt out. Upon unsubscribing, your email is permanently moved to an encrypted suppression list to guarantee no further marketing communication is sent.

  • Analytics Logs: Automated expiration via Google Analytics settings (retained for up to 2 years).