Privacy Policy

This Privacy Policy explains how personal data is processed in connection with BidMeat.eu, a business-to-business platform operated by Karpatia Rzeszów Sp. z o.o. It applies to account users, customer representatives, warehouse contacts, prospective business customers and other people who communicate with us in a professional capacity. It should be read together with the Cookie Policy and the information presented at the relevant data-collection point.

1. Controller

The controller of personal data processed through BidMeat.eu is Karpatia Rzeszów Sp. z o.o., Zaczernie 792A, 36-062 Zaczernie, Poland, EU VAT ID PL5170399989, REGON 383671269 ("BidMeat", "we", "us" or "our"). You can contact us about privacy matters at sales@bidmeat.eu or by writing to our registered address.

BidMeat determines the purposes and essential means of processing described in this Policy. In some business relationships another organisation, such as the customer company, an employer, carrier, supplier or payment service provider, may independently determine how it processes the same or related information. Their own privacy information applies to that separate processing.

2. Categories of personal data

We process identification and business-contact data such as name, business email, role, company affiliation and correspondence details. Account data can include login identifiers, account status, authentication and activation records, language or market preferences and security events. We do not need to receive a user's password in readable form.

Company and transaction data can include the legal company name, registered and billing addresses, country, VAT or EU VAT identification, customer identifiers, order history, product and quantity information, fulfilment selection, warehouse addresses, payment method and status, invoices, Pro Forma documents, claims and support correspondence. Warehouse records may include a contact person's name and optional telephone number.

Technical data can include IP address, device and browser information, request timestamps, session identifiers, security logs, cookies and similar storage necessary for the service. We may receive data directly from you, from your company or colleagues, from platform activity, from Saleor and service providers supporting the transaction, and from lawful public or business sources used for verification.

3. Purposes and legal bases

We process data necessary to create and administer business accounts, authenticate users, prepare quotes, receive purchase requests, accept and fulfil orders, arrange Pick-up or Delivery, generate documents, communicate about transactions and handle claims. To the extent the individual is a party to a contract or requests pre-contractual steps, this processing relies on Article 6(1)(b) GDPR. Where the contract is with a company rather than the individual, the processing is generally necessary for our legitimate interests under Article 6(1)(f) GDPR in conducting that business relationship.

We process accounting, tax, invoicing, food traceability and other records where required to comply with legal obligations under Article 6(1)(c) GDPR. We may verify VAT details, preserve order evidence, respond to competent authorities and meet legally required retention duties on this basis.

Under Article 6(1)(f) GDPR, we also process proportionate data to secure accounts and systems, prevent fraud and duplicate registrations, enforce commercial terms, improve reliability, maintain audit records, manage credit and payment risk, establish or defend legal claims and communicate with existing business contacts. Our legitimate interests are balanced against the rights and expectations of affected individuals. Where consent is legally required for a distinct activity, we will request it separately; we do not claim that a marketing consent exists merely because a person has a BidMeat account.

4. Business representatives and warehouse contacts

A customer company may provide personal data about its directors, employees, purchasing representatives, finance contacts, warehouse personnel or other authorised contacts. We use those details to verify authority, communicate about the account and orders, coordinate collection or delivery, provide documents and resolve operational issues. The relevant legal bases are performance of requested business processes, compliance with law and our legitimate interest in managing the contract with the company.

If you provide another person's details, you should ensure that you are authorised to do so, that the data is accurate and limited to what is needed, and that the person receives appropriate information about this processing. Warehouse contact information must not be used to create unrelated marketing lists. Contact details should be updated or removed when the person no longer performs that role, subject to records that must be preserved for completed transactions.

5. Recipients and processors

Personal data is available only to authorised BidMeat personnel and service providers who need it for their work. Recipients may include hosting and infrastructure providers, the Saleor commerce platform, database and storage providers, email delivery services, mapping or routing providers, carriers and logistics partners, payment and banking providers, professional advisers, accountants, auditors and suppliers involved in fulfilling or documenting an order.

We require processors acting on our behalf to process data under appropriate contractual and security obligations. Some recipients act as independent controllers for their own legally defined purposes, for example banks, public authorities or professional advisers. Data may be disclosed where required by law, a binding authority request, the protection of legal rights or a corporate transaction, subject to applicable safeguards.

We do not sell personal data. We do not disclose one customer's orders, documents, profile or warehouses to another customer. Server-side ownership checks and authenticated access controls are used for customer resources.

6. International transfers

Some service providers or their support operations may process data outside Poland or the European Economic Area. We therefore do not claim that all processing always remains inside the EEA. The location depends on the provider, service configuration, sub-processors and the data involved.

Where personal data is transferred to a country without an adequacy decision, we use an applicable transfer mechanism, such as European Commission standard contractual clauses, together with supplementary safeguards where required. A transfer may also rely on another lawful derogation in a specific situation. You may contact us for information about the relevant categories of safeguards, subject to protection of confidential security and commercial information.

7. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and for applicable legal, accounting, tax, food-traceability, security and claims requirements. Retention periods therefore differ by data category and transaction. We do not invent a single exact period that applies to every record.

Account data is normally retained while the business account is active and for an appropriate period afterwards to resolve transactions, security events and claims. Order, invoice and accounting records are retained for periods required by applicable law. Security logs and technical records are kept for periods proportionate to investigation and system-protection needs. Unsuccessful or incomplete registration records are reviewed under operational and legal requirements rather than kept indefinitely without purpose.

At the end of the applicable period, data is deleted, anonymised or securely isolated unless further retention is required by law or needed for a legal claim. A request to close an account does not require deletion of records that must lawfully be retained.

8. Data subject rights

Subject to the conditions in the GDPR, you may request access to your personal data, rectification of inaccurate data, deletion, restriction of processing, and data portability for data covered by that right. You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

Rights are not absolute. For example, deletion may be unavailable where records are required for tax, accounting, contractual evidence, food traceability or legal claims. Portability applies only to certain data processed by automated means on the basis of consent or contract. We may request information necessary to verify identity and authority before responding, particularly where a request concerns a company account or commercial documents.

Requests can be sent to sales@bidmeat.eu. We will respond within the period required by applicable law and explain any lawful limitation. Exercising data protection rights does not normally involve a fee, although a legally permitted fee or refusal may apply to manifestly unfounded or excessive requests.

9. Right to lodge a complaint with UODO

You have the right to lodge a complaint with a competent supervisory authority if you consider that processing infringes the GDPR. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO). Current contact and complaint information is available from the authority's official website.

We encourage you to contact us first so that we can understand and address the concern, but doing so is not a condition for making a complaint. You may also have the right to contact the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

10. Security

We apply technical and organisational measures appropriate to the nature and risk of the processing. Measures include access controls, authenticated customer sessions, separation of customer resources, secure transport, restricted administrative functions, logging, rate limiting, backups and controlled handling of secrets. Sensitive credentials are intended to remain in protected environment configuration rather than public source code.

No internet service can guarantee absolute security. Customers must protect credentials, use trusted devices, restrict internal account access and notify us promptly of suspected compromise. Users should not send passwords, activation tokens, payment credentials or unnecessary sensitive personal data by email or in free-text order fields.

Where a personal data breach occurs, we assess its scope and risk and make notifications to authorities or affected individuals where required by law. Security information may be limited where disclosure would increase risk or reveal protections.

11. Cookies and technical data

BidMeat uses cookies or comparable browser storage where necessary to operate sessions, authentication, security, cart functions, account features and user choices. Server logs and request data help deliver content, diagnose failures, prevent misuse and protect the platform. Details, including browser controls and the consequences of blocking necessary storage, are described in the Cookie Policy.

Optional analytics or marketing technologies will be introduced only with an appropriate legal basis and consent mechanism where required. This Policy does not claim that named advertising platforms or analytics tools are in use when they have not actually been implemented. Third-party technical services used by the platform may process limited network and device data according to their role and our configuration.

12. Changes and contact

We may update this Privacy Policy when legal requirements, processing activities, service providers or platform functions change. The current version will be published on BidMeat.eu. Where a change materially affects individuals, we may provide an additional notice through the platform or an appropriate business communication.

Questions, rights requests and privacy concerns may be directed to Karpatia Rzeszów Sp. z o.o., Zaczernie 792A, 36-062 Zaczernie, Poland, or to sales@bidmeat.eu. Please describe the request sufficiently to identify the relevant relationship, but do not include passwords, access tokens or unrelated confidential information.