Wishlist

Privacy policy

I. WHAT THIS DOCUMENT IS

In this policy, we explain what personal data we collect when you use the groundgame.com store, make purchases, or contact us: why we collect it, on what legal basis, how long we retain it, whom we share it with, and what your rights are.

This policy is informative and does not impose any obligations on you. Cookies and the tools that utilize them are described separately in our Cookie Policy.

II. WHO IS THE DATA CONTROLLER

The controller of your personal data is GGSPORTS Sp. z o.o., ul. Budowlana 2S/2, 65-386 Zielona Góra, Poland, KRS 0000861925, Tax ID (NIP): PL9292044002 — the company operating the Ground Game store ("we", "us").

For questions regarding personal data, email us at shop@groundgame.com or write to our registered office address. We have not appointed a Data Protection Officer.

III. WHAT PERSONAL DATA MEANS

Personal data is any information that allows you to be identified — directly (such as your name or email address) or indirectly (such as an order number). Personal data may also include online identifiers, such as your IP address or an ID stored in a cookie — particularly when linked to you, e.g., after logging into your account. We process personal data in compliance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) and applicable Polish data protection laws.

IV. PURPOSES AND LEGAL BASES FOR PROCESSING YOUR DATA

The specific data we process depends on how you interact with our store. Each scenario is described below. Whom we share data with is set out in Section VII, international transfers outside Europe in Section VIII, and your rights in Section IX.

For each situation, we specify how long we retain your data. We may retain data longer if required by statutory obligations or necessary for the establishment, exercise, or defense of legal claims — until the applicable limitation period expires (Article 6(1)(c) or (f) GDPR). Where the same data is processed for multiple purposes, we store it for the longest applicable period.

1. Orders

When you place an order, we process your name, delivery address, email address, and phone number, and if purchasing as a business, also the company name and Tax ID (NIP/VAT number). Payment card or bank account details are provided directly to payment operators; we do not see your full card number. We process this data to:

  • fulfill the order and communicate with you regarding its execution — Article 6(1)(b) GDPR (performance of a contract);
  • issue invoices and maintain accounting records — Article 6(1)(c) GDPR (legal obligation under tax and accounting laws);
  • establish, exercise, or defend against legal claims — Article 6(1)(f) GDPR (our legitimate interest).

Providing data is voluntary, but necessary to complete the order. Invoice details are mandatory under tax regulations.

Retention period: for the duration of order fulfillment, and subsequently until the end of the 6th calendar year following the year of completion (statutory limitation period for claims). Invoices and accounting records are kept for 5 years from the end of the year in which the tax payment deadline expired.

2. Customer Account

When you register an account, we process your email address, saved addresses, and order history to:

  • maintain your user account — Article 6(1)(b) GDPR (performance of an account management contract);
  • establish, exercise, or defend against legal claims — Article 6(1)(f) GDPR.

Providing this data is voluntary, but necessary to create and operate the account.

Retention period: for as long as your account remains active.

3. Returns and Complaints

When returning a product or filing a warranty claim, we process order details, submission notes, submitted photos, and — if a refund via bank transfer is requested — your bank account number to:

  • handle the return or complaint — Article 6(1)(c) GDPR (statutory obligations under consumer rights laws);
  • establish, exercise, or defend against legal claims — Article 6(1)(f) GDPR.

Retention period: for the duration of the complaint or return procedure, and thereafter for the same duration as order data.

4. Newsletter and Marketing Communications

We send our newsletter only if you actively subscribe. We process your email address, and if you have previously purchased from us, also your name and order history, based on your consent — Article 6(1)(a) GDPR in conjunction with Article 398 of the Polish Electronic Communications Law.

You confirm your subscription via the link sent immediately upon signup — ensuring no one registers you without your knowledge.

In newsletters, we address you by name and tailor select messages to purchased products — for instance, providing care instructions following a boxing gloves purchase.

Only with your consent do we send reminders about items left in your abandoned cart or unfinished orders, as well as post-purchase review requests.

You can unsubscribe from marketing emails at any time via the link in the email footer or by contacting us. Retention period: until consent is withdrawn, and thereafter solely for the period required to demonstrate when consent was granted and revoked.

5. Product Reviews

When you submit a review, we process your name or nickname, email address, and review content, and verify whether the reviewed product was purchased in our store — Article 6(1)(f) GDPR (our legitimate interest in displaying authentic customer feedback). If you opt into the Google Customer Reviews survey, we transfer your email address, order ID, delivery country, and estimated delivery date to Google — Article 6(1)(a) GDPR. Google sends the survey and processes responses under its own policies.

Retention period: for as long as the review remains published; you may request its removal at any time.

6. Contact and Inquiries

When you contact us via email, Facebook Messenger, Instagram, or WhatsApp, we process the message contents and data you provide to respond — Article 6(1)(f) GDPR (legitimate interest: customer service), or if related to an active order — Article 6(1)(b) GDPR. In messaging apps, Meta also processes messages under its own policies.

Retention period: up to 3 years from concluding the correspondence — older messages are deleted annually. We retain messages longer only if required for ongoing claims or disputes.

7. Social Media Profiles

We maintain Ground Game profiles on Facebook, Instagram, TikTok, YouTube, and LinkedIn. When you follow, comment on, or message our profiles, we see your profile handle and public contributions or direct messages. We use this data to administer profiles and reply to inquiries — Article 6(1)(f) GDPR.

The platforms also provide us with aggregated profile analytics. For page insights on Facebook, Instagram, TikTok, and LinkedIn, we act as joint controllers with the platform providers: Meta Platforms Ireland Ltd, TikTok Technology Limited, and LinkedIn Ireland Unlimited Company. Core joint controller arrangements are available via Meta (facebook.com/legal/terms/page_controller_addendum) and LinkedIn (legal.linkedin.com/pages-joint-controller-addendum). In all other respects, these platforms — including Google for YouTube — act as independent data controllers under their respective privacy policies.

Retention period: for as long as we operate the profiles or until you object; analytics are stored for the period provided by each platform.

8. Loyalty Program and Customer Balance

When collecting points or utilizing store credit, we process your purchase history, accrued points, and balance to administer the program and settle credit balances — Article 6(1)(b) GDPR. Detailed rules are set out in the Loyalty Program Terms. Retention period: for the duration of your participation, and following account closure or balance settlement, for the same duration as order data.

9. Gift Cards

When you purchase or redeem a gift card, we process data as in regular orders, along with the card code, balance, and transaction history — Article 6(1)(b) GDPR. If a gift card is dispatched directly to a recipient, their name and email are used exclusively for delivery — Article 6(1)(f) GDPR. This data is provided by the purchaser. Retention period: until redemption or expiration, and thereafter for the same duration as order data.

10. Analytics and Advertising — Cookies and Google Analytics

Subject to your consent, we use analytics and marketing cookies, including Google Analytics 4 with Google advertising features (Google Signals, remarketing, demographic and interest reports) and the Meta Pixel — Article 6(1)(a) GDPR in conjunction with Article 399 of the Electronic Communications Law. If you are signed into a Google account with ads personalization enabled, Google may connect cross-device sessions (Google Signals). We receive only aggregated reports from Google Signals. For the Meta Pixel, we act as joint controllers with Meta regarding initial event data collection — core arrangements can be viewed at: facebook.com/legal/controller_addendum.

Google Analytics and Google Ads operate in Advanced Consent Mode: if you decline consent, they do not set cookies, but our site sends basic interaction pings to Google (such as IP address, browser type, visited pages) without user IDs — for aggregated modeling and campaign measurement — Article 6(1)(f) GDPR (our legitimate interest in measuring store traffic).

Full details on tools, categories, and lifespans are listed in our Cookie Policy. Retention period: until consent is withdrawn; in Google Analytics, event-level data (e.g. visited pages) is retained for 2 months, and user-level data for 14 months from the last activity.

11. Targeted Ads Based on Contact Data

If you consent, we share your email address, phone number, name, and address with Google and Meta. Email, phone, name, and street address are transmitted in hashed form — converted into a one-way mathematical code from which raw data cannot be read; city, postal code, and country are transmitted unhashed. The platforms match this data against user records to assess advertising performance, deliver targeted ads, or exclude existing customers from acquisition campaigns. In Google, this is handled through user-provided data in Google Analytics and Enhanced Conversions; in Meta, through Advanced Matching. Hashed data remains personal data. Legal basis: your consent to marketing cookies in our consent banner — Article 6(1)(a) GDPR.

You can opt out of targeted ads at any time by withdrawing consent in "Cookie settings" in the website footer, disabling ad personalization in your Google account settings (myadcenter.google.com), or using the Google Analytics opt-out browser extension (tools.google.com/dlpage/gaoptout).

Retention period: until consent is withdrawn.

12. Records of Cookie Consent

To demonstrate compliance and verify your choices, we record the timestamp, consent scope, device type, and country — Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (obligation to demonstrate consent).

Retention period: 5 years from when consent was granted.

13. Store Operation and Security

We process technical data concerning store visits — such as IP addresses, browser types, and access timestamps — to safeguard the infrastructure against cyber threats and abuse — Article 6(1)(f) GDPR.

Retention period: as defined in Shopify's security log retention policies (shopify.com/legal/privacy).

Forms on our website, such as contact forms, are protected against automated bots and spam by hCaptcha. It assesses whether an input originates from a human by analyzing IP addresses, browser and device parameters, and browsing behavior — Article 6(1)(f) GDPR (legitimate interest: infrastructure security and spam prevention).

Web fonts are loaded from Bunny Fonts servers (BunnyWay d.o.o., Slovenia). Your browser transmits your IP address to the provider for this technical delivery — Article 6(1)(f) GDPR (legitimate interest: proper visual display). Bunny Fonts does not store cookies.

V. ARE YOU REQUIRED TO PROVIDE DATA

You are under no obligation to provide personal data. However, without required order details, we cannot conclude the contract or deliver products, and without an email address, you cannot create an account. Invoicing details are mandatory under tax law. All other processing — newsletters, cart reminders, review requests, personalized advertising, and non-essential cookies — is entirely optional. Mandatory fields are clearly marked in our forms.

VI. DO WE PROFILE YOUR DATA

If you consent to marketing cookies or tailored advertising, we and our partners analyze your store behavior — such as viewed products — to display personalized ads. This constitutes profiling. If you subscribe to our newsletter, we also personalize content according to purchase history — which also constitutes profiling.
We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

VII. WHOM WE SHARE YOUR DATA WITH

We do not sell your personal data. We disclose it solely to the following recipients and only to the extent necessary for the purposes set out in Section IV:

  • Shopify International Limited (Dublin, Ireland) — our e-commerce platform provider; stores order, account, and customer data on our behalf;
  • Payment service providers — Paynow (mElements S.A., Warsaw), processing BLIK, online bank transfers, and card payments; the current list of methods and operators is available in the "Payment Methods" section; payment operators also process data as independent controllers;
  • Shipping and courier operators — to deliver your parcel; the current carrier roster is listed in the "Shipping" section;
  • Judge.me Ltd (London, United Kingdom) — product review management system acting as our processor;
  • Consentmo (iSense Ltd, Sofia, Bulgaria) — cookie consent management tool;
  • Intuition Machines, Inc. (USA) — provider of hCaptcha, protecting website forms against spam;
  • BunnyWay d.o.o. (Slovenia) — provider of Bunny Fonts typography services;
  • Store application providers — MiB Wishlist (LUNNEA sp. z o.o., Radom, Poland) and the Joy loyalty platform (Joy Loyalty Pte. Ltd., Singapore), acting as our processors;
  • Newsletter service provider — Shopify, integrated into the store platform;
  • Analytics and advertising partners — provided you grant consent: Google and Meta; full partner details are listed in the Cookie Policy;
  • Marketplace platforms — Allegro, Amazon, Decathlon — when purchasing through these channels; they act as independent controllers.

If you pay via Shop Pay or use the Shop app, Shopify also processes your data as an independent controller. Your data may additionally be disclosed to our accounting firm, legal advisors, IT and hosting providers, and, where mandated by law, public authorities and courts.

VIII. IS YOUR DATA TRANSFERRED OUTSIDE EUROPE

Yes, in several instances — always subject to safeguards mandated by EU data protection law:

  • Shopify may process data within group entities outside Europe, including Canada — pursuant to Binding Corporate Rules, Standard Contractual Clauses (SCCs), and, for Canada, the European Commission adequacy decision;
  • Judge.me operates from the UK — covered by the European Commission adequacy decision — and stores data in the USA pursuant to European Commission Standard Contractual Clauses;
  • Google (including YouTube), Meta, and LinkedIn may transfer data to the USA — pursuant to the EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses;
  • hCaptcha (Intuition Machines, Inc.) processes data in the USA — pursuant to the EU-U.S. Data Privacy Framework;
  • TikTok may transfer data outside Europe, including group entities — pursuant to Standard Contractual Clauses;
  • Joy (Joy Loyalty Pte. Ltd., Singapore) processes data primarily in the USA — pursuant to Standard Contractual Clauses;
  • MiB Wishlist (LUNNEA sp. z o.o.) may use sub-processors outside the EEA — pursuant to European Commission adequacy decisions (including the Data Privacy Framework) or Standard Contractual Clauses;

You can request a copy of these transfer safeguards or information on their availability by contacting us.

IX. WHAT YOUR RIGHTS ARE

You have the right at any time to:

  • access your personal data and receive a copy;
  • rectify data that is inaccurate or incomplete;
  • request the erasure of data — we will comply unless statutory requirements (e.g. tax laws) or legal defense requirements mandate continued retention;
  • obtain restriction of data processing;
  • data portability — receive your data in a structured, commonly used, machine-readable format to transmit it to another controller;
  • object to data processing for direct marketing purposes, including profiling — without providing grounds;
  • object to other processing based on our legitimate interest (such as displaying reviews) on grounds relating to your particular situation;
  • withdraw any consent previously granted — without affecting the lawfulness of processing carried out prior to withdrawal;
  • lodge a complaint with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or the supervisory authority of the EU Member State of your habitual residence or workplace.

To exercise your rights, contact us using the details in Section II. We respond within one month; in complex cases, this deadline may be extended by two additional months, of which you will be notified.

X. WILL WE SEND YOU COMMERCIAL COMMUNICATIONS

Only if you explicitly consent — such as by subscribing to the newsletter or checking a marketing consent box. You can withdraw your consent at any time with a single click in the email footer.

XI. POLICY AMENDMENTS

This policy is effective as of November 2, 2026. Any revisions will be published on this page with an updated date, and material changes will be announced via our store interface or email.