Privacy Policy

Last updated: 27 September 2026

This policy explains how Swiftwing Logistics processes personal data in its fulfilment warehouse and in the Swiftwing WMS/OMS system.

1. Who we are

Swiftwing Logistics is the trade name of SWIFTWING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (Swiftwing Sp. z o.o.), registered office: Aleja Krakowska 87/M4, 05-552 Jabłonowo, Poland.

Entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001248256, kept by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register. NIP: 1231606134. Share capital: PLN 100,000.00.

We run an e-commerce fulfilment warehouse at ul. Lipowa 5, 05-860 Płochocin, Poland and operate the Swiftwing WMS/OMS system at swiftwingwms.com.

Privacy contact: xt452036951@gmail.com

2. Whose data we process, and in what role

Buyers (parcel recipients). When a seller who stores goods in our warehouse receives an order — directly or through a marketplace such as TikTok Shop or Allegro — we receive the recipient's name, delivery address, phone number, e-mail and the ordered items, so that we can pick, pack and ship the parcel and handle returns. For this data we act as a processor on behalf of the seller, who is the controller. Questions about an order are best sent to the seller.
Sellers (our customers) and their staff: account, contact and billing details. For this data we are the controller.
Users of our system: login data, IP addresses and actions, recorded for security.

3. Purposes and legal bases

Fulfilling orders (picking, packing, shipping labels, delivery, returns): on behalf of the seller (GDPR Art. 28); for our own customers, performance of the contract (Art. 6(1)(b)).
Billing and accounting: legal obligation (Art. 6(1)(c)).
Security of our systems and prevention of misuse: legitimate interests (Art. 6(1)(f)).

4. Who receives the data

Parcel carriers (such as DPD, InPost, DHL, ORLEN Paczka, Packeta): the recipient's name, address and phone number, to deliver the parcel.
The marketplace where the order was placed (such as TikTok Shop or Allegro): shipment and tracking status.
The seller who owns the order, including through our client portal (see section 5).
Our hosting provider, Alibaba Cloud (servers in Frankfurt, Germany).
A software development support tool (AI assistant) whose provider is based in the United States, used only when needed to troubleshoot a specific problem (see section 5).
We do not sell personal data and do not use it for advertising.

5. Where the data is stored and accessed

Our servers are in Frankfurt, Germany (EU). Backup copies are kept in Poland. Our staff access the data from Poland.

Sellers can view the orders of their own stores in our client portal wherever they are. Some of our sellers are based in China, so their order data, including recipient details, is also viewed from China. This access is made by the seller, as the controller of that data.

When our developer troubleshoots a specific problem, we may use an AI software development assistant whose provider is based in the United States. We share only what the problem requires — usually order numbers, statuses and quantities. Buyer names, phone numbers and addresses are not shared unless the problem concerns that data, for example correcting a delivery address.

6. How long we keep data

Data	Retention
Buyer name, phone, e-mail and address of TikTok Shop orders	Masked 180 days after shipment (cancelled orders: 180 days after the order). Order number, items and fees are kept for accounting.
Marketplace authorisations (access tokens)	Deleted immediately when the seller disconnects the store.
Other order data	As long as needed to provide the service to the seller, and deleted within 30 days after the seller's contract ends, except where the law requires longer retention.
Seller billing records	5 years, as required by Polish accounting law.

7. How we protect the data

All connections are encrypted (HTTPS with TLS 1.2 or 1.3).
Passwords, access tokens and other credentials are stored encrypted (AES-256-GCM) or as one-way hashes.
Access is limited by role; administrator accounts use two-factor authentication.
Logins and operations are logged; servers are protected by firewalls, monitoring and automatic security updates.

8. Your rights

You may ask for access to, correction or deletion of your data, restriction of processing, data portability, or object to processing. For buyer data we pass your request to the seller and help them respond. We reply within one month.

You may also complain to the Polish supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. Cookies

We only use cookies that are needed to run the system: login session cookies, a cookie that lets an administrator skip the second login step on a trusted computer for 30 days, and a short-lived cookie that protects marketplace authorisation. We do not use analytics or advertising cookies.

10. Changes

We review this policy at least once a year and update it when our processing changes. The date at the top shows the latest version.