A.M.G. Venol Motor Oil
Cart 0

Privacy Policy

1. Data Controller

The controller of personal data processed in connection with the website and online store available at https://amgoil.eu is:

VENOL MOTOR OIL Sp. z o.o.
ul. Lodowa 107
93-232 Łódź
Poland

Tax Identification Number (NIP): 982-037-64-99
National Court Register (KRS): 0000623004
REGON: 364695098

E-mail: info@amgoil.eu
Phone: +48 661 022 220

hereinafter referred to as the “Controller”.

For any questions concerning the processing of personal data, you may contact the Controller using the contact details above.

2. Scope of this Privacy Policy

This Privacy Policy explains how personal data is processed in connection with:

  • visiting amgoil.eu,
  • browsing products,
  • placing and processing orders,
  • online payments,
  • delivery of Goods,
  • returns,
  • complaints,
  • communication with the Controller,
  • Customer accounts, where available,
  • website security,
  • cookies and similar technologies,
  • analytics, where consent has been given where required,
  • marketing communications, where consent has been given where required.

3. Personal data we may process

Depending on how you use the Store, we may process:

  • first and last name,
  • company name,
  • billing address,
  • delivery address,
  • country,
  • e-mail address,
  • telephone number,
  • VAT or EU VAT identification number,
  • order information,
  • purchased products,
  • transaction information,
  • payment status,
  • return and complaint information,
  • correspondence with us,
  • account information,
  • IP address,
  • browser and device information,
  • website activity,
  • cookie identifiers,
  • consent preferences,
  • security and technical log information.

We generally do not need to receive or store your full payment card details. Payment card information may be processed directly by Stripe.

4. Purposes and legal bases for processing

4.1. Processing and fulfilling orders

We process personal data in order to:

  • accept your order,
  • conclude a Sales Contract,
  • process the order,
  • arrange payment,
  • prepare Goods for shipment,
  • deliver the Goods,
  • communicate with you about your order,
  • process returns.

The legal basis is Article 6(1)(b) GDPR, as processing is necessary to enter into or perform a contract.

4.2. Legal obligations

We may process personal data where necessary to comply with legal obligations relating to:

  • taxation,
  • accounting,
  • invoicing,
  • consumer protection,
  • product safety,
  • record keeping,
  • regulatory obligations.

The legal basis is Article 6(1)(c) GDPR.

4.3. Complaints and legal claims

We process personal data to handle complaints and fulfil our statutory obligations concerning consumer rights and the conformity of Goods. The legal basis is Article 6(1)(c) GDPR.

Where processing is necessary to perform contractual obligations that go beyond statutory requirements, the legal basis is Article 6(1)(b) GDPR.

We also retain and use relevant information to establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the protection and enforcement of our legal rights.

4.4. Customer communications

If you contact us by e-mail, telephone, contact form or another communication channel, we process the information you provide in order to respond to your request.

The legal basis may be:

  • Article 6(1)(b) GDPR where your enquiry concerns a contract or steps prior to entering into a contract,
  • Article 6(1)(f) GDPR for other enquiries.

Our legitimate interest is the ability to communicate with Customers and persons interested in our products or services.

4.5. Customer accounts

Where the Store allows Customers to create an account, personal data is processed to create, maintain and provide the account and its functionality.

The legal basis is Article 6(1)(b) GDPR.

4.6. Website and transaction security

We may process technical information, including IP addresses, security logs and device information, in order to:

  • protect the Store against cyberattacks,
  • prevent fraud,
  • detect unauthorised access,
  • diagnose technical problems,
  • ensure transaction security,
  • protect Customers and our systems.

The legal basis is Article 6(1)(f) GDPR.

Our legitimate interest is ensuring the security of the Store, our systems and transactions.

4.7. Analytics and order attribution

If analytics and order attribution features are enabled, we use them to understand how visitors reach the Store and which sources lead to orders. This may include information about referring websites, campaign identifiers, visited pages and interactions with the Store.

Non-essential tracking technologies, including cookies used for order attribution, are activated only after consent has been given. The legal basis for the associated processing of personal data is Article 6(1)(a) GDPR.

Consent may be withdrawn at any time through the “Cookies preferences” link in the website footer. Refusing or withdrawing analytics consent does not prevent you from placing an order.

4.8. Marketing

Where we send electronic marketing communications requiring consent, personal data is processed on the basis of the user’s consent.

Consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4.9. Managing and recording consent preferences

We use CookieYes to display cookie choices, store preferences and maintain records of consent where applicable.

Processing necessary to demonstrate compliance with consent requirements is based on Article 6(1)(c) GDPR. Processing necessary to operate the preference management tool and respect your choices is based on Article 6(1)(f) GDPR. Our legitimate interest is maintaining a functioning consent management system that respects users’ preferences.

5. Stripe and online payments

Online payments in the Store are processed using Stripe.

For the purpose of processing a transaction, Stripe may receive data including:

  • name,
  • e-mail address,
  • billing address,
  • transaction amount,
  • transaction currency,
  • payment method information,
  • IP address,
  • device information,
  • information required for payment authentication,
  • information required for fraud prevention.

Depending on the relevant processing activity, Stripe may process personal data as a processor acting on behalf of the Seller or as an independent controller in accordance with its own legal obligations and services.

Stripe may also use automated fraud prevention and risk assessment systems.

Further information about Stripe’s processing activities, its roles as a controller and processor, and the entities responsible for processing is available at:

Stripe Privacy Policy:
https://stripe.com/privacy

Stripe Privacy Center:
https://stripe.com/legal/privacy-center

Stripe Data Processing Agreement:
https://stripe.com/legal/dpa

Information about international transfers is also provided in section 8 of this Privacy Policy.

6. Delivery providers

Orders are delivered using FedEx International services.

We disclose to the FedEx entity handling the shipment, and to logistics partners involved in delivery, the information necessary to deliver the order and provide shipment notifications. This may include the recipient’s name, company name where applicable, delivery address, telephone number, e-mail address and shipment details.

Couriers may process data as independent controllers for their own transport operations and legal obligations. The relevant provider’s privacy information applies to those activities.

7. Recipients of personal data

Depending on the service used and the purpose of processing, personal data may be disclosed to:

– Stripe and the payment institutions involved in processing your chosen payment method;
– FedEx and logistics partners involved in delivering the order;
– CookieYes Limited, which provides cookie consent management services;
– hosting, website maintenance, security and IT support providers;
– e-mail and communication service providers;
– accounting, tax and legal advisers;
– providers of analytics or marketing services, where those services are enabled on a lawful basis;
– public authorities where disclosure is required by law.

Data is disclosed only to the extent necessary for the relevant purpose.

Providers acting as processors on our behalf are subject to data processing agreements and applicable data protection requirements. Providers acting as independent controllers are responsible for their own processing activities.

The Store uses WordPress and WooCommerce software. The use of that software does not, by itself, mean that Customer data is disclosed to its developers.

8. International transfers of personal data

The use of certain service providers may involve transferring personal data outside the European Economic Area, including access to data from another country.

Stripe

Payment processing through Stripe involves international processing, including transfers to Stripe, LLC in the United States. Transfers covered by the EU-U.S. Data Privacy Framework rely on the applicable European Commission adequacy decision and Stripe’s certification. Where that mechanism does not apply, the relevant Standard Contractual Clauses and safeguards specified in Stripe’s Data Transfers Addendum apply.

Stripe’s transfer safeguards and information about its affiliates and service providers are available at:

https://stripe.com/legal/dta
https://stripe.com/legal/service-providers
https://stripe.com/legal/data-privacy-framework

CookieYes

CookieYes Limited is established in the United Kingdom. Its consent management services may also involve service providers in the United States. Transfers covered by an applicable adequacy decision rely on that decision. Restricted transfers not covered by such a decision are subject to the safeguards set out in CookieYes’s Data Processing Agreement, including Standard Contractual Clauses where applicable.

Information about CookieYes’s safeguards, service providers and processing locations is available at:

https://www.cookieyes.com/dpa/
https://www.cookieyes.com/sub-processors-list/

You may contact info@amgoil.eu to obtain information about the safeguards relevant to your data, including a copy of the applicable contractual safeguards, subject to lawful redactions necessary to protect confidential information.

9. Data retention

Retention periods depend on the purpose of processing and the legal requirements applicable to the relevant records.

Tax and accounting records

Tax documentation is generally retained until the relevant tax liability becomes time-barred. Under Polish law, this is normally five years from the end of the calendar year in which the tax payment deadline expired. The period may be extended where limitation is suspended or interrupted, or another statutory retention requirement applies.

Where transactions are recorded under the VAT One Stop Shop scheme, the required records are retained for ten years from the end of the calendar year in which the transaction took place.

Orders, returns, complaints and legal claims

Data is processed while the order, return or complaint is being handled. Afterwards, information needed to establish, exercise or defend a specific legal claim is retained until the applicable limitation period expires.

Under Polish law, the general limitation period is six years, while certain claims have shorter or longer statutory periods. For example, claims of the Seller arising from sales made in the course of its business generally have a two-year limitation period. The applicable period and its starting date depend on the nature of the claim. Relevant information may be retained longer where proceedings are ongoing or limitation is suspended or interrupted.

Customer accounts

Account information is retained while the account remains active. Following account deletion, information required for tax records, outstanding orders or legal claims is retained only for the corresponding periods described above.

General enquiries

Correspondence unrelated to an order, complaint or legal claim is retained for one year after the enquiry has been resolved.

Marketing and consent records

Data used for consent-based marketing is retained until consent is withdrawn or the marketing activity ends, whichever occurs first. Limited records needed to demonstrate consent or respect an opt-out may be retained afterwards for the applicable compliance or legal limitation period.

Technical and security logs

Routine technical and security logs are retained for one year from their creation. Relevant extracts may be retained longer where needed to investigate a specific security incident, comply with a legal obligation or establish, exercise or defend a legal claim.

Cookies and analytics

Cookie lifetimes are specified in the cookie preference panel. Personal data obtained through analytics is retained for the period specified for the relevant tool or processing activity in that panel or the accompanying information.

10. Your rights under GDPR

Subject to the conditions provided by applicable law, you have the right to:

  • access your personal data,
  • obtain a copy of your personal data,
  • rectify inaccurate personal data,
  • complete incomplete personal data,
  • request deletion of personal data,
  • request restriction of processing,
  • object to processing based on legitimate interests,
  • receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies,
  • request transmission of eligible data to another controller where technically feasible,
  • withdraw consent at any time where processing is based on consent.

To exercise your rights, please contact:

info@amgoil.eu

We may need to verify your identity before fulfilling certain requests.

11. Right to object

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing.

If you object to direct marketing, your personal data will no longer be processed for that purpose.

12. Right to lodge a complaint

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.

The supervisory authority in Poland is:

President of the Personal Data Protection Office
Urząd Ochrony Danych Osobowych
ul. Stanisława Moniuszki 1A
00-014 Warszawa
Poland

Depending on the circumstances, you may also have the right to lodge a complaint with a supervisory authority in another EU Member State.

13. Cookies and similar technologies

The Store uses cookies and similar technologies to operate the website and, where consent has been given, enable additional functions such as analytics and order attribution.

Strictly necessary technologies support functions such as the shopping cart, checkout, sessions, security and the storage of cookie preferences. These technologies may be used without consent only to the extent that they meet the applicable legal requirements for the exemption.

Analytics, advertising and other non-essential tracking technologies are used only after the relevant consent has been given. A technology is not treated as strictly necessary merely because it is useful to the Seller.

Cookie preferences are managed through CookieYes. You may accept optional categories, reject them or select your preferences. You can reopen the panel and change or withdraw consent at any time using the “Cookies preferences” link in the website footer.

Refusing optional cookies does not prevent you from making a purchase. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

The cookie preference panel provides information about the cookies and similar technologies used by the Store, including their names, providers, purposes and storage periods. Session cookies generally expire when the relevant browser session ends, while persistent cookies remain for the stated period unless deleted earlier.

Browser settings may also be used to manage or delete cookies. Blocking strictly necessary cookies may affect functions such as the shopping cart or checkout.

14. Automated fraud prevention and payment security

Stripe and other institutions involved in processing a payment may use automated systems to assess transaction security and detect suspected fraud.

These systems may analyse payment and transaction details, IP addresses, device information, authentication results and other security indicators. The assessment may result in additional authentication, further verification or refusal of a payment.

Information about processing carried out by Stripe, including automated fraud prevention and the applicable rights, is available in Stripe’s Privacy Policy and Privacy Center linked in section 5.

The Controller may use security information received from payment providers to identify orders requiring further review. Any decision by the Controller to refuse an order on the basis of suspected fraud is reviewed by an authorised member of staff and is not based solely on an automated risk score.

If you believe that your order has been incorrectly flagged, contact info@amgoil.eu to request an explanation and review. The Controller’s review does not require a bank or payment provider to authorise a payment that it has declined.

15. Data security

The Controller uses appropriate technical and organisational measures designed to protect personal data against:

  • unauthorised access,
  • accidental loss,
  • unlawful destruction,
  • unauthorised disclosure,
  • alteration,
  • misuse.

Security measures are selected taking into account the nature of the data, the scope of processing and the risks associated with processing.

16. Data required to place an order

Providing personal data required during checkout is necessary to conclude and perform the Sales Contract.

Failure to provide information required to:

  • identify the Customer,
  • process payment,
  • deliver the order,

may make it impossible to place or fulfil the order.

Providing data for optional marketing purposes is voluntary.

17. Changes to this Privacy Policy

This Privacy Policy may be updated where necessary, including as a result of:

  • changes in applicable law,
  • changes to Store functionality,
  • implementation of new service providers,
  • changes in the way personal data is processed.

The current version of this Privacy Policy is available at:
https://amgoil.eu/privacy-policy/

Where required, we will provide additional notice of material changes. Updating this Privacy Policy does not replace the need to obtain a new consent where a change in processing requires one.

Last updated: 6 October 2026.