1. Controller

The controller of personal data processed through souveniq.eu is EnjoyGroup Sp. z o.o., ul. Brzeska 8/4, 21-500 Biała Podlaska, Poland, NIP 5372686054, KRS 0001143543 ("we"). Contact: corp@souveniq.eu.

2. What we process and why

Enquiry and quote forms: name, company, email, phone, message, attached files and the page you wrote from. Purpose: answering your request and preparing a quote (art. 6(1)(b) GDPR — steps prior to a contract) and keeping records of correspondence (art. 6(1)(f) — legitimate interest).

Orders and invoices: company details, VAT number, delivery address, contact persons. Purpose: performance of the contract (art. 6(1)(b)) and accounting obligations (art. 6(1)(c)); retained for the period required by Polish tax law.

Email and phone correspondence: content and metadata, retained as long as needed for the business relationship and claims (art. 6(1)(f)).

Website analytics: see the cookie policy. Analytics runs only on the basis described there.

Server logs: IP address, user agent, requested address, time — kept by the hosting provider for security for up to 30 days (art. 6(1)(f)).

3. Recipients

Hosting and email providers, the messaging service used to notify our team of new requests, accounting and payment providers, carriers for deliveries, and partner factories only to the extent needed to produce and ship your order (company name and delivery address). We do not sell personal data. Where a provider is outside the EEA, transfers rely on adequacy decisions or standard contractual clauses.

4. Retention

Enquiries that do not lead to an order: 24 months. Orders, invoices and contracts: as required by tax and accounting law (currently 5 full years after the tax year). Server logs: up to 30 days.

5. Your rights

You may request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interest. Write to corp@souveniq.eu. You may lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych) or the authority in your country.

6. Obligation to provide data

Providing data in forms is voluntary, but without name, email and a message we cannot answer. For orders, company and invoice data are required by law.

7. Automated decision-making

We do not use automated decision-making or profiling with legal effects.

8. Changes

This policy may be updated; the current version is always at this address. Last updated: 17 October 2026.