Last updated: 13 May 2026
This Privacy Policy and Cookies document describes how WEBET Sp. z o.o. ("Administrator", "we", "us", "our") collects, processes, stores and protects your personal data in connection with use of the CheaperForDrug platform (taniejpolek.pl). This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR) and the Polish Personal Data Protection Act.
The controller of your personal data is:
WEBET SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. 1 Maja 30A
45-355 Opole, Poland
NIP: 7543346806
REGON: 520717497
KRS: 0000940072
Email: biuro@webet.pl
Phone: +48 798 908 242
On all matters relating to data protection you can contact us:
Email: biuro@webet.pl
Phone: +48 798 908 242 (Mon-Fri, 9:00-17:00)
By post: WEBET Sp. z o.o., ul. 1 Maja 30A, 45-355 Opole, Poland, marked "Data Protection"
Important: Your payment card details (card number, CVV, expiry date) are processed exclusively by Stripe, Inc. - a PCI DSS Level 1 certified payment provider. We do NOT store and do NOT have access to your full payment card details.
We store only:
We process your personal data only for specified purposes and on the basis of appropriate legal grounds in accordance with Art. 6 GDPR:
Newsletter - combined legal basis:
Newsletters are sent on the basis of three legal grounds jointly: (a) Art. 6(1)(a) GDPR - your voluntary consent to processing your email address; (b) Art. 10(1) of the Polish Act of 18 July 2002 on the Provision of Electronic Services - your consent to receive commercial information by electronic means; (c) Art. 172(1) of the Polish Act of 16 July 2004 - Telecommunications Law - your consent to the use of telecommunications terminal equipment for direct marketing purposes. Consents are collected jointly by actively ticking a checkbox in the subscription form. You can withdraw any consent at any time by clicking the "Unsubscribe" link in the footer of every email or by contacting biuro@webet.pl.
You can withdraw consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal.
We store your personal data for periods necessary to achieve the stated purposes, taking into account the periods required by law:
| Data category | Retention period |
|---|---|
| Account data (email, password) | For the duration of the active account + 30 days after deletion |
| Payment data and invoices | 6 years from the end of the calendar year of the transaction |
| Shopping list and search history | For the duration of the account or until deletion by the user |
| Technical data (IP, logs) | 12 months |
| Marketing consent | Until consent is withdrawn |
| Correspondence and complaints | 3 years after the matter is closed |
The OTC medicine shopping list you create in the Service may, in certain situations, constitute health data within the meaning of Art. 4(15) and Art. 9(1) GDPR (e.g. a list containing medicines specific to a particular condition).
Explicit consent of the User (Art. 9(2)(a) GDPR), expressed when first adding an item to the shopping list or when registering an account. Without this consent it is not possible to use the basket comparison function.
Names of OTC medicines and their quantities added to the shopping list, together with the User's account identifier.
Exclusively price comparison of these medicines in online pharmacies presented in the Service. Data is used to generate a price-optimised basket and - at the User's request - to save the list in the account panel for reuse.
You may withdraw your consent at any time by deleting your shopping list in the user panel or by contacting biuro@webet.pl. Withdrawal does not affect the lawfulness of processing carried out before its withdrawal.
The Administrator does NOT use this data for health profiling, personalised marketing or share it with third parties for purposes other than price comparison in pharmacies. The Service does not provide medical or pharmaceutical advice.
This data is NOT transferred to marketing processors (Google Ads, Meta Platforms) or analytics providers beyond anonymised aggregates in which individual medicines are not identifiable at the level of a single User.
Your personal data may be shared with trusted processors exclusively to the extent necessary for the processing purposes. We have concluded data processing agreements with all the processors listed below in accordance with Art. 28 GDPR.
We have concluded data processing agreements (DPA) with all the processors listed above in accordance with Art. 28 GDPR. The Administrator has not appointed a Data Protection Officer (DPO) - processing does not meet the criteria for mandatory designation set out in Art. 37(1) GDPR. All data protection matters can be addressed directly to the Administrator at biuro@webet.pl.
Some data may be processed outside the European Economic Area. Processing outside the EEA concerns the following entities: Stripe, Inc. (United States), Twilio SendGrid, Inc. (United States), Amazon Web Services - global infrastructure (with Service data hosted in EU regions), Rollbar, Inc. (United States), Google LLC (United States), Meta Platforms, Inc. (United States). Data processed by Hetzner Online GmbH remains entirely in Germany (EEA). Transfer of data outside the EEA takes place on the basis of:
A copy of the Standard Contractual Clauses (SCCs) and information on specific transfer safeguards can be obtained by contacting the Administrator at biuro@webet.pl.
Under the GDPR you have the following rights:
You can obtain confirmation as to whether we process your data and access to that data.
You can request rectification of incorrect data or completion of incomplete data.
You can request the erasure of data if it is no longer necessary or you have withdrawn consent.
You can request restriction of processing in certain situations.
You can receive your data in CSV or JSON format and transmit it to another controller.
You can object at any time to data processing for marketing purposes.
If processing is based on consent, you can withdraw it at any time.
You may lodge a complaint with the supervisory authority - in Poland the President of the Personal Data Protection Office:
Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
Email: kancelaria@uodo.gov.pl
Phone: +48 22 531 03 00
Website: uodo.gov.pl
To exercise any of the above rights, contact us:
We will respond to your request without undue delay - no later than within one month of receipt of the request.
We apply appropriate technical and organisational measures to protect your personal data:
Cookies are small text files saved by your browser on your device while browsing websites. They allow your device to be recognised and information about your visit to be remembered.
Purpose: Necessary for the proper functioning of the website
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
Duration: Session or up to 1 year
Examples: session ID, CSRF token, cookie_consent
Purpose: Remembering preferences and settings
Legal basis: Legitimate interest
Duration: Up to 12 months
Examples: user_preferences, theme_mode
Purpose: Payment processing, fraud prevention
Provider: Stripe, Inc. (USA)
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
Duration: From session up to 2 years
Examples: __stripe_mid, __stripe_sid
More info: stripe.com/cookies-policy/legal
Purpose: Analysis of user behaviour, site optimisation
Legal basis: User consent (Art. 6(1)(a) GDPR)
Duration: Up to 24 months
privacy.sections.cookies.types.analytics.examples
Note: These cookies will be used only with your explicit consent.
On your first visit we will display a banner with cookie information. You can:
You can also manage cookies in your browser settings (Chrome, Firefox, Safari, Edge).
Note: Disabling some cookies may affect the functionality of the site. Essential cookies cannot be disabled without losing basic functionality.
The Service is intended for adults (18 years and older) in accordance with the Terms. The Administrator does not knowingly collect personal data from persons under 16. If it is determined that data from a person under 16 has been collected without verifiable consent of the parental authority (Art. 8(1) GDPR), it will be deleted without delay. If you are a parent or guardian and believe that a child has provided us with personal data, please contact us at biuro@webet.pl.
We may update this privacy policy from time to time. We will inform you of material changes:
In the event of material changes affecting the scope of personal data processing, we will ask you to actively accept the updated policy in the Service panel. Failure to accept within 14 days of being informed may result in limited access to features requiring consent to the new processing terms.
If you have questions about this privacy policy or wish to exercise your rights, contact us:
Email: biuro@webet.pl
Phone: +48 798 908 242 (Mon-Fri, 9:00-17:00)
Address: WEBET Sp. z o.o., ul. 1 Maja 30A, 45-355 Opole, Poland
We respond to general enquiries within 3 working days and to GDPR requests within one month.
GDPR compliance: CheaperForDrug is fully compliant with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the Polish Personal Data Protection Act of 10 May 2018. Your data is processed in accordance with the highest standards of security and privacy.