Last updated: 19 October 2026
1. Data Controller
The data controller for this website is:
ZILIO Marzena Rewers
Gliwicka 35, 42-600 Tarnowskie Góry, Poland
EU VAT ID: PL6451705993
Email: info@nis-2-templates.com
2. What Data We Collect
2.1 Website Visitors (No Account Required)
- Server log data: IP address, browser type, operating system, referring URL, pages visited, date and time of access. Legal basis: legitimate interest (Article 6(1)(f) GDPR) in website security and performance monitoring.
- Cookies: See Section 5.
2.2 Customers (Template Purchases)
- Contact data: name, email address, company name (if provided). Legal basis: performance of contract (Article 6(1)(b) GDPR).
- Billing data: billing address, VAT ID. Legal basis: performance of contract and legal obligation (Article 6(1)(b) and (c) GDPR).
- Payment data: processed directly by our payment processor (Stripe); we do not store credit card numbers or full payment details internally.
- Transaction data: purchase history and download records. Legal basis: performance of contract (Article 6(1)(b) GDPR).
2.3 Contact Form and Email Enquiries
Data submitted via contact form or email is collected solely to respond to your enquiry. Legal basis: legitimate interest or pre-contractual relationship (Article 6(1)(b) and (f) GDPR).
2.4 NIS2 Readiness Check Tool
All answers entered in the Readiness Check tool are processed locally in your browser and are not transmitted to our servers unless you voluntarily submit your email address to receive results.
2.5 Email Sign-ups, Follow-up Emails and Customer Emails
What we collect. When you request a free resource (for example a checklist, an assessment or a crosswalk), we collect your email address, optionally your first name, which resource you requested, the date, and which version of the consent wording you agreed to. We pass this data directly to our email service provider Brevo and do not keep a separate copy on our website. Your IP address is used for up to one hour to protect the form against abuse.
Double opt-in. Brevo sends you one email with a confirmation link on our behalf. We only send further emails after you click that link and confirm; your resource opens right after you confirm. Brevo records when you confirmed and the IP address used, so that we can prove your consent.
What you receive. A short series of emails with practical guidance on NIS2, the Cyber Resilience Act or ISO 27001, including offers for our template packs. We measure whether our emails are opened and which links are clicked, to improve them.
Legal basis. Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email or by writing to info@nis-2-templates.com. Withdrawal does not affect emails sent before it.
Customers. At checkout you can tick a box to receive emails about new and related templates (consent, Art. 6(1)(a) GDPR). If you do not tick it, we send you only emails about your order. You can unsubscribe at any time with the link in every email.
Email service provider. We send these emails through Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France), which processes the data on our behalf under a data processing agreement. Brevo processes the data in the EU and also transfers data to the USA and India, based on the European Commission’s Standard Contractual Clauses.
Retention. We keep your contact details until you unsubscribe. After that we keep your address only on a block list, so that you receive no further emails. We keep the consent record (held in Brevo) for three years after our last email to you, so that we can prove consent, and then delete it.
2.6 Post-Purchase Question
After a purchase we ask one optional question about what almost stopped you from buying. The answer is stored with your order and used only to improve the shop (legitimate interest, Article 6(1)(f) GDPR).
2.7 Partner Programme
If you apply to our partner programme, we process the details you give in the application form: your name, email address, password (stored only as a hash), preferred partner code, your company’s legal name, VAT or tax number, registered address, website, type of business and how you plan to recommend us. After acceptance we also process your partner code, the orders made with it (date, products, net value, commission), your invoices, the business bank account details for payouts and, for partners outside Poland, your certificate of tax residence.
We use these data to assess your application, run your partner account and dashboard, calculate and pay commission, and keep accounting and tax records. Legal bases: taking steps at your request before entering into the partner contract and performing it (Article 6(1)(b) GDPR), our legal obligations under tax and accounting law (Article 6(1)(c)), and our legitimate interest in preventing fraud and defending claims (Article 6(1)(f)).
The partner account is a WordPress user account on this website. Partner data stay on our server and are not shared with other partners. Payouts are made through our bank or payment provider (for example Wise).
Customers who use a partner code. When you enter a partner code at checkout, we record which code was used with your order. The partner sees in their dashboard that an order was made with their code, with its date, products and net value, but not your name, company or contact details. Legal basis: performance of the purchase contract, under which the discount is applied (Article 6(1)(b)), and our legitimate interest in paying the correct commission (Article 6(1)(f)). Referral links only add the code to your basket; we do not set tracking cookies for the partner programme.
Retention. We keep a rejected application for 12 months, then delete it. We keep the data of accepted partners for the duration of the partnership, and invoices and payout records for the statutory period under Polish tax law (currently 5 years from the end of the relevant tax year).
3. How We Use Your Data
- Delivering purchased templates and processing payments
- Issuing invoices and complying with tax and accounting obligations, including issuing invoices through the Polish National e-Invoicing System (KSeF) as required by Polish VAT law
- Responding to enquiries and providing customer support
- Improving website content, functionality, and services
- Ensuring website security and preventing fraud
4. Data Sharing and Sub-Processors
We do not sell personal data. We share personal data only with the recipients listed below, each of whom is bound by a data processing agreement in accordance with Article 28 GDPR.
| Recipient | Purpose | Data categories | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland stripe.com/privacy |
Payment authorisation and processing, fraud prevention | Name, email, billing address, card/payment details, IP, transaction amount | EU (Ireland), with limited transfers to Stripe, Inc. (US) under EU Standard Contractual Clauses |
| Fakturownia (operator established in Poland) fakturownia.pl/polityka-prywatnosci |
Automated invoice generation, invoice storage, KSeF submission | Name, company name, billing address, VAT/NIP number, purchase details | EU (Poland) |
| Krajowy System e-Faktur (KSeF) Ministerstwo Finansów / Krajowa Administracja Skarbowa, Warsaw, Poland podatki.gov.pl/ksef |
Mandatory e-invoice archiving for Polish B2B transactions (legal obligation under Polish VAT law) | Invoice data: seller and buyer NIP, amounts, VAT, invoice line items | EU (Poland) — government system |
| cyber_Folks S.A. (hosting) cyberfolks.pl/polityka-prywatnosci |
Website hosting, backup, server security | All data transmitted to/stored on the website | EU (Poland) |
| Email / transactional mail Transactional emails (order confirmations, download links, invoices) are sent via the hosting provider’s mail infrastructure. |
Sending transactional and support emails | Name, email address, order/invoice details | EU |
| Accountant / tax advisor | Statutory bookkeeping and tax filing under Polish law | Invoice data, transaction records | EU (Poland) |
| Public authorities | Where required by law or to protect our legal rights (e.g., tax authorities, courts) | As legally required | EU (Poland) |
| Sendinblue SAS (Brevo) 17 rue Salneuve, 75017 Paris, France brevo.com/legal/privacypolicy |
Double opt-in emails, download emails, newsletter (see 2.5) | Email, first name, requested resource, consent record, email opens and clicks | EU (France), with transfers by Brevo to the USA and India under EU Standard Contractual Clauses |
| Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland policies.google.com/privacy |
Website statistics (Google Analytics) and measuring Google Ads conversions, only after your consent (see 5.2 and 5.3) | Pseudonymous online identifiers, IP address, pages visited, conversion events | EU, with transfers to Google LLC (US) under the EU-US Data Privacy Framework |
5. Cookies and Tracking Technologies
This website uses cookies. A cookie is a small text file placed on your device when you visit a website. We use a cookie consent management tool to ensure that non-essential cookies are only set with your explicit consent.
You can manage or withdraw your cookie preferences at any time by clicking the Cookie Settings link in the website footer.
5.1 Strictly Necessary Cookies
These cookies are required for the website to function correctly. They cannot be disabled.
| Cookie | Purpose | Duration |
|---|---|---|
| WordPress session cookies | Core website functionality and authentication | Session |
| woocommerce_cart_hash, woocommerce_items_in_cart | Maintains shopping cart state | Session / 48 hours |
| wp_woocommerce_session_* | WooCommerce customer session data | 48 hours |
| __stripe_mid, __stripe_sid | Stripe fraud prevention during checkout | 1 year / 30 minutes |
| cmplz_* (Complianz) | Stores your cookie consent preferences | 365 days |
When you follow a partner referral link, the partner code is stored in your shopping session (the wp_woocommerce_session_* cookie listed above) until you complete or leave your order. No separate tracking cookie is set.
5.2 Analytics Cookies
Analytics cookies help us understand how visitors interact with the website. These cookies are only activated with your prior consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics (Google Ireland Limited) | Distinguishes visitors to produce anonymous usage statistics | 2 years |
5.3 Marketing and Third-Party Cookies
With your consent we use Google Ads conversion tracking to measure which ads lead to purchases. We do not use retargeting or social media tracking cookies.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads (Google Ireland Limited) | Attributes purchases to ad clicks (conversion measurement) | 90 days |
We use Google Consent Mode: until you consent in the cookie banner, Google tags set no cookies and send only cookieless signals without identifiers. Statistics and marketing cookies are set only after you accept those categories. Legal basis: your consent (Article 6(1)(a) GDPR).
6. Data Retention
- Server log data: deleted after 30 days
- Customer and transaction data: retained for the duration of the business relationship plus the statutory period under Polish tax law (currently 5 years from the end of the relevant tax year)
- Invoice data in KSeF: archived by the Polish tax authority for 10 years as required by law — we have no control over deletion
- Contact enquiries: retained for up to 12 months after the last communication, unless a longer period is required by law
- Cookie consent records: retained for 12 months in line with the consent period
- Partner programme data: rejected applications 12 months; accepted partners for the duration of the partnership, plus the statutory period under Polish tax law for invoices and payout records
7. Your Rights Under GDPR
As a data subject you have the following rights:
- Right of access (Article 15) — request a copy of the personal data we hold about you
- Right to rectification (Article 16) — request correction of inaccurate or incomplete data
- Right to erasure (Article 17) — request deletion of your data, subject to legal retention obligations
- Right to restriction of processing (Article 18) — request that we limit how we process your data
- Right to data portability (Article 20) — receive your data in a structured, machine-readable format
- Right to object (Article 21) — object to processing based on legitimate interest
- Right to withdraw consent (Article 7(3)) — withdraw consent at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at info@nis-2-templates.com. We will respond within one month (Article 12(3) GDPR).
8. Supervisory Authority
The lead supervisory authority for ZILIO Marzena Rewers is:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
Website: https://uodo.gov.pl/
You also have the right to lodge a complaint with the supervisory authority in your EU member state.
9. International Data Transfers
Personal data is primarily processed and stored within the EEA. Limited transfers may occur to Stripe, Inc. in the United States for global payment processing and fraud prevention; such transfers are governed by EU Standard Contractual Clauses as approved by the European Commission.
Transfers to Google LLC are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework. Brevo transfers data to the USA and India under the Commission’s Standard Contractual Clauses.
10. Security
We implement appropriate technical and organisational security measures including SSL/TLS encryption for all data in transit, access controls, and regular security reviews.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. Updates take effect upon publication. We recommend reviewing this page periodically.
12. Contact
ZILIO Marzena Rewers
Gliwicka 35, 42-600 Tarnowskie Góry, Poland
Email: info@nis-2-templates.com