local_shipping Our new delivery is expected on 31 July 2026. Order dispatch will begin on 3 August 2026.
Currency EUR
EURPLN
Language EN
PLENUAAMDEFR
person menu
descriptionDocuments

Privacy Policy

Last updated: 8 July 2026

This Privacy Policy sets out the principles governing the processing and protection of personal data of Users of the HayWay Export Marketplace online shop, operating at https://polandarmenia.com. This document has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

We care about the privacy of our Customers, which is why we process personal data solely to the extent necessary to conduct the sale and export of products, in a manner compliant with the applicable law. Please read this Policy before using the shop.

1. Data Controller

The controller of Users' personal data is:

  • HAYWAY TRADE Sp. z o.o. — a limited liability company registered in Poland,
  • registered office address: ul. Nadbrzezie 15, 31-983 Kraków, Poland,
  • Tax ID (NIP): 6783227153,
  • e-mail address for contact in all matters (including those concerning personal data protection, general enquiries, complaints and cookies): info@polandarmenia.com.

The Controller operates an online shop under the HayWay Export Marketplace brand (https://polandarmenia.com), the object of which is the sale and export of premium Shalakh variety apricots (quality class I, calibre 4–6 cm, 8 kg box) and fruit preserves originating from Armenia, with delivery within the European Union.

The Controller has not appointed a data protection officer. For all matters relating to the processing of personal data, you may make contact at: info@polandarmenia.com a data protection officer has not been appointed.

2. What personal data we collect

In connection with the use of the shop and the placing and fulfilment of orders, we process the following categories of personal data:

2.1. Order data and contact details

  • first name and surname,
  • e-mail address,
  • telephone number,
  • information about orders placed, their content, status and history.

2.2. Address data

  • delivery address (street, number, postcode, town, country),
  • billing address, if different from the delivery address,
  • data required to issue a sales document, where the Customer requests one (including company details and the tax identification number in the case of business Customers).

2.3. Payment data

  • information about the chosen payment method and about the status and identifier of the transaction.

We do not store full payment card details. Card payments, BLIK and instant transfers are handled directly by external payment operators (PayU, PayPal), who process transaction authentication data within their own secure systems. The Controller receives only confirmation that a payment has been completed or declined.

2.4. Technical data

  • IP address,
  • information about the browser and device,
  • session data (including the contents of the basket), currency preference and language preference,
  • information stored in cookies necessary for the operation of the shop.

Providing the data marked as required is voluntary but necessary to conclude and perform the contract of sale — without it, an order cannot be accepted and fulfilled.

3. Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases arising from Article 6(1) GDPR:

  • Performance of the contract of sale — accepting and handling the order, contacting you about the order, arranging refrigerated delivery and settling payment. Legal basis: Article 6(1)(b) GDPR (processing necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract).
  • Fulfilment of legal obligations incumbent on the Controller, in particular accounting, settlement and tax obligations, including the issuance and retention of sales documents, as well as the handling of complaints and the exercise of the right of withdrawal from the contract. Legal basis: Article 6(1)(c) GDPR (a legal obligation to which the Controller is subject).
  • The Controller's legitimate interest, encompassing the establishment, assertion and defence of claims, ensuring the security of the shop and preventing abuse, handling correspondence, and carrying out internal analyses and statistics. Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest).
  • Consent — to the extent that it is required, in particular in relation to the storage of selected cookies and any marketing communications, insofar as these are carried out. Legal basis: Article 6(1)(a) GDPR (the consent of the data subject). Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

4. Data recipients and processors

In order to fulfil orders properly and operate the shop, the Controller uses the services of trusted external entities to which it entrusts the processing of personal data on the basis of data processing agreements (Article 28 GDPR), or which act as separate controllers in respect of the services they provide. The recipients of the data may be:

  • Courier companies and the Furgonetka logistics platform — to the extent necessary to arrange and carry out the refrigerated delivery of the ordered products (first name and surname, delivery address, telephone number, e-mail address).
  • Payment operators — PayU and PayPal — to the extent necessary to handle and settle payments by card, BLIK, instant transfer and PayPal.
  • The provider of hosting and IT services — to the extent necessary for the maintenance, security and technical operation of the online shop.

Personal data may also be disclosed to state authorities or other entities authorised under the law, provided they submit such a request on an appropriate legal basis.

5. Transfer of data outside the European Economic Area (EEA)

The data controller — HAYWAY TRADE Sp. z o.o. — has its registered office in the Republic of Armenia, i.e. in a third country located outside the European Economic Area (EEA). This means that, in connection with the fulfilment of orders and Customer service, the personal data provided in the shop is transferred to Armenia and processed there by the Controller.

The transfer of data to Armenia takes place on the following bases provided for in Chapter V GDPR:

  • Necessity for the performance of a contract — the transfer of data is necessary for the performance of the contract of sale concluded between the Customer and the Controller, or for the implementation of pre-contractual measures taken at the Customer's request (Article 49(1)(b) GDPR).
  • Necessity for the conclusion or performance of a contract concluded in the interest of the data subject — in respect of contracts concluded with data recipients, such as courier companies and payment operators, for the purpose of fulfilling the Customer's order (Article 49(1)(c) GDPR).
  • Explicit consent — to the extent that it is required, the Customer may be informed of the possible risks of such a transfer and give explicit consent to it (Article 49(1)(a) GDPR).

As at the date on which this Policy was drawn up, the European Commission had not issued a decision confirming an adequate level of personal data protection in respect of Armenia (an adequacy decision within the meaning of Article 45 GDPR). Accordingly, the transfer of data takes place on the specific bases indicated above, and the Controller applies appropriate organisational and technical measures to ensure the security of the data transferred. To the extent that this is possible and required, the Controller seeks to conclude with the data recipients standard contractual clauses approved by the European Commission.

The Customer has the right to obtain information about the safeguards applied and about the possibility of receiving a copy of them by contacting info@polandarmenia.com.

6. Data retention period

We retain personal data for the period necessary to achieve the purposes for which it was collected, and thereafter for the period required or justified by law:

  • data processed for the purpose of performing the contract — for the duration of the contract and until it has been fully settled (including the completion of delivery, the handling of complaints and the exercise of the right of withdrawal);
  • data processed for the purpose of fulfilling accounting and tax obligations — for the period required by law, including accounting legislation and tax legislation (as a rule, for 5 years, counted from the end of the year in which the tax obligation arose);
  • data processed on the basis of a legitimate interest, including for the purpose of establishing, asserting or defending against claims — for the limitation period for claims arising under the law;
  • data processed on the basis of consent — until it is withdrawn or until the purpose for which the consent was given ceases to apply.

Upon expiry of the periods indicated, the data is deleted or anonymised.

7. Rights of the data subject

In connection with the processing of personal data, you have the following rights arising from the GDPR:

  • the right of access to your data and to obtain a copy of it (Article 15 GDPR);
  • the right to rectification of inaccurate data and the completion of incomplete data (Article 16 GDPR);
  • the right to erasure of data (the "right to be forgotten"), in the situations provided for by law (Article 17 GDPR);
  • the right to restriction of processing of data (Article 18 GDPR);
  • the right to data portability in respect of the data you have provided to the Controller, in a structured, commonly used, machine-readable format (Article 20 GDPR);
  • the right to object to the processing of data based on the Controller's legitimate interest, on grounds relating to your particular situation (Article 21 GDPR);
  • the right to withdraw consent at any time, where processing is based on consent — without affecting the lawfulness of processing carried out prior to its withdrawal (Article 7(3) GDPR).

In order to exercise the above rights, please make contact at: info@polandarmenia.com.

You also have the right to lodge a complaint with the supervisory authority responsible for the protection of personal data. In Poland, this authority is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw. A complaint may be lodged if you consider that the processing of personal data infringes the provisions of the GDPR.

8. Cookies

The shop uses cookies to the extent necessary for its proper operation. We use only:

  • session cookies (PHPSESSID) — used to maintain the User's session and the contents of the basket;
  • preference cookies — storing the chosen currency and language;
  • consent cookies — storing the User's decision regarding cookies.

We do not use analytical or advertising cookies. Third-party cookies may appear only at the moment the User is redirected to the payment operator's website (PayU or PayPal) in order to carry out a transaction — on the terms specified by those operators.

Detailed information about the cookies used is contained in a separate Cookie Policy. Cookie settings can be changed at any time in your web browser's settings.

9. Data security

The Controller applies appropriate technical and organisational measures aimed at protecting personal data against loss, unauthorised access, disclosure, alteration or destruction. In particular:

  • the transmission of data between the User's browser and the shop is encrypted using the TLS (SSL) protocol;
  • access to personal data is granted solely to authorised persons, to the extent necessary to carry out the tasks entrusted to them;
  • payment data is processed in the secure environments of the payment operators — the Controller does not store full payment card details;
  • entities processing data on behalf of the Controller are required to apply appropriate security measures.

10. Changes to the privacy policy and contact

The Controller reserves the right to make changes to this Privacy Policy, in particular in connection with changes in the law, the development of the shop or a change in the scope of the services provided. The current version of the Policy is published each time in the online shop at https://polandarmenia.com, together with the date of the last update. We recommend that you review the content of this document periodically.

For all matters relating to the protection of personal data and to this Privacy Policy, please make contact at the e-mail address: info@polandarmenia.com.

Back to home