Privacy policy

Effective date: 07.10.2026

Introduction – Building Your Trust

Dear User! We care about your privacy and want you to feel comfortable when using our services. At COBI S.A., we have been passionately creating miniature worlds for over 30 years. We know that every great model begins with solid foundations and precise instructions. We approach the protection of your personal data with the same care.

This Privacy Policy is our instruction manual. Step by step, we explain how we protect your data, what we use it for, who we may share it with, how long we retain it, and what rights you have.

It is based primarily on the solid foundations of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and other laws concerning personal data protection and privacy applicable to our activities.

§ 1. The Chief Builder – Personal Data Controller

The controller, meaning the entity responsible for your personal data, is:

COBI SPÓŁKA AKCYJNA, with its registered office in Warsaw at ul. Jaskrów 11, 04-709 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000025310, Tax Identification Number (NIP): 9521783570 (“COBI”, “we”, “us”).

For matters relating to the protection of your personal data, you may contact our Data Protection Officer (“DPO”) at: iod@cobi.pl.

§ 2. The Little Builder's Glossary

For the purposes of this Policy, the following terms have the meanings set out below:

  • Store – our online store COBI.COM, available at cobi.com and in its language versions;

  • User – any natural person visiting the Store or using its features;

  • Account – your personal workspace in the Store, created upon registration;

  • Newsletter – a free service consisting of sending information about COBI, its products, new releases, offers, promotions, events, and other marketing content related to COBI's activities to the email address you provide;

  • Cookies – cookies and other similar technologies that enable information to be stored on your device, access to information already stored on the device, or recognition of your device or browser;

  • GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council.

§ 3. The Building Plan – Purposes, Legal Bases and Retention Periods for Personal Data Processing

Your personal data is valuable to us, and we use it only for specified purposes and in accordance with the law.

Providing personal data is voluntary, but in certain cases it may be necessary to enter into or perform a contract, for example to create an Account or fulfil an order.

Below, we present our plan of action.

1. Managing Your Account and Providing Related Services

Purpose of processing: Managing your Account and providing services associated with it.

Legal basis: Article 6(1)(b) GDPR – processing is necessary for entering into and performing the contract for maintaining your Account.

Retention period: For as long as you maintain an Account, until its deletion, and subsequently to the extent necessary to establish, pursue or defend claims or fulfil obligations arising from applicable laws.

2. Processing and Fulfilling Orders

Purpose of processing: Accepting and fulfilling orders, entering into and performing sales contracts, processing payments, deliveries, returns, complaints and other rights related to purchases.

Legal basis: Article 6(1)(b) GDPR – processing is necessary to take steps at your request before entering into a contract and to perform the contract.

Retention period: For the period necessary to fulfil the order and perform the contract, and subsequently until the expiry of applicable limitation periods for related claims and for the period required by applicable law.

3. Compliance with Legal Obligations

Purpose of processing: Fulfilling our legal obligations, particularly tax, accounting and documentation obligations.

Legal basis: Article 6(1)(c) GDPR – processing is necessary to comply with a legal obligation to which COBI is subject.

Retention period: For the period required by the applicable laws.

4. Responding to Enquiries and Correspondence

Purpose of processing: Responding to questions submitted through contact forms, email or other available communication channels and managing related correspondence.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest consists of communicating with Users and responding to their enquiries.

If your enquiry concerns entering into or performing a contract, processing may also be based on Article 6(1)(b) GDPR.

Retention period: Until the matter has been resolved and subsequently for the period necessary to establish, pursue or defend potential claims.

5. Providing the Newsletter Service and Marketing Communications

Purpose of processing: Providing the Newsletter service and sending information about COBI, its products, new releases, offers, promotions, events and other marketing content.

You may unsubscribe from the Newsletter or other marketing communications at any time, in particular by using the unsubscribe mechanism provided in the message you receive.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest consists of conducting direct marketing of our own products and services and providing the Newsletter to individuals who wish to receive it.

Where the nature of processing requires consent under the GDPR, the legal basis is Article 6(1)(a) GDPR.

Regardless of the legal basis for processing personal data, we send marketing communications by email, SMS or other electronic means only after obtaining your prior consent where required by the electronic communications laws applicable to you.

If we process your personal data for direct marketing purposes based on our legitimate interest, you may object to such processing at any time.

Retention period: Until you effectively object to the processing of your data for direct marketing purposes, unsubscribe from the Newsletter or, where processing is based on consent, withdraw that consent.

We may retain information about consent being given, refused or withdrawn, or about an objection being raised, for the period necessary to demonstrate legal compliance, defend against claims and ensure that we do not send you communications contrary to your choices.

6. Analysis of User Activity and Marketing Personalisation

Purpose of processing: Analysing information about your activity and potential interests, including how you use the Store and which products you view, in order to tailor marketing and advertising content to your potential interests, create audience groups and conduct remarketing activities.

Detailed information about individual technologies is provided in the Cookie Policy and Cookie Settings.

Legal basis: Article 6(1)(a) GDPR – your voluntary consent, where profiling uses data collected through optional cookies or similar technologies requiring consent.

Retention period: Until you withdraw your consent or the retention period applicable to the technology used expires, whichever occurs first.

7. Direct Marketing of Our Own Products and Services

Purpose of processing: Conducting direct marketing of our own products and services where this does not require the use of a communication channel or technology subject to your separate consent.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest consists of marketing our own products and services.

Retention period: Until you effectively object to the processing of your personal data for direct marketing purposes.

8. Protection of Our Rights and Legal Claims

Purpose of processing: Protecting our rights, establishing and pursuing claims to which we are entitled, and defending against claims brought against us.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest consists of protecting our rights.

Retention period: Until the expiry of the applicable limitation periods for claims or the conclusion of related proceedings.

9. Website Analytics and Store Improvement

Purpose of processing: Analysing how you use the Store, particularly the pages you visit, products you view, traffic sources and your interactions with the Store, in order to generate statistics, measure traffic and improve the Store's operation and functionality.

Legal basis: Article 6(1)(a) GDPR – your consent. We process data for this purpose only within the scope of your consent to the relevant optional cookies or similar technologies.

Retention period: Until you withdraw your consent or the retention period applicable to the technology expires, whichever occurs first. Detailed retention periods are specified in the Cookie Settings.

10. Internal Business Analytics and Statistics

Purpose of processing: Analysing the operation of the Store, sales, orders and the use of our services in order to prepare internal reports and statistics, evaluate the effectiveness of our activities, and improve the Store and our services.

This process does not involve activating optional cookies without your consent. It concerns the analysis of data that we lawfully possess in connection with the use of our services and the conduct of our business.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest consists of analysing and improving the operation of the Store and our business and evaluating their effectiveness.

Retention period: For the period necessary to achieve these purposes, but no longer than until you effectively object, unless there are overriding legitimate grounds for further processing.

If data is no longer required in a form that allows a User to be identified, we may anonymise it.

§ 4. Our Building Partners – Recipients of Personal Data

To ensure that our Store operates smoothly, we cooperate with trusted partners. Accordingly, we may disclose or entrust your personal data to entities whose services are necessary or useful for conducting our business.

Depending on the features you use, recipients of your data may include, in particular:

  • IT service providers, hosting providers and technical infrastructure providers that ensure the technical operation of the Store;

  • courier and postal service providers that deliver your orders;

  • electronic payment service providers that enable us to process payments;

  • providers of marketing, communication and analytics tools that help us manage the Newsletter, analyse Store performance and carry out marketing and advertising activities;

  • accounting firms, law firms and consulting companies supporting our business operations;

  • public authorities and other authorised entities where the disclosure of data is required by law.

Depending on the nature of the service provided and the scope of processing, entities receiving your data may act:

  • as data processors acting on our behalf and under our instructions, in which case we entrust them with data processing in accordance with Article 28 GDPR;

  • as independent data controllers, where they independently determine the purposes and means of processing in connection with the services they provide;

  • as joint controllers together with us, where we jointly determine the purposes and means of specific processing activities, in which case the arrangements for joint controllership are established in accordance with Article 26 GDPR.

We disclose data to recipients only to the extent justified by the specified purpose, the nature of the services provided and applicable law.

Where a recipient processes data on our behalf, we use service providers that offer sufficient guarantees of implementing appropriate technical and organisational measures so that processing complies with the GDPR and protects your rights.

§ 5. International Projects – Transfers of Personal Data Outside the EEA

Our building blocks reach more than 60 countries around the world, and in the digital world, data may also travel internationally.

We strive to ensure that your data is processed within Europe. However, when using global tools, such as analytics or marketing services, your data may be transferred to third countries, including the United States.

We ensure that every such transfer is carried out in accordance with the highest security standards, using mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission or on the basis of a European Commission adequacy decision.

Where these safeguards are unavailable, before transferring data to a third country, we conduct a Transfer Impact Assessment (TIA), assessing the risks associated with the transfer in accordance with the guidelines of the European Data Protection Board (EDPB), taking into account local laws and the practices of the recipient country's public authorities.

If we identify a risk of inadequate data protection, we implement additional safeguards.

§ 6. Tailored Sets – Profiling

If you consent to the use of optional cookies or similar technologies for marketing purposes, we may analyse information about your activity and potential interests, including how you use the Store and which products you view.

Based on this information, we may create a profile of your potential interests, tailor marketing and advertising content to those interests, create audience groups and conduct remarketing activities.

Where the information used for these purposes constitutes personal data, the legal basis for our processing in connection with marketing profiling using optional cookies is your consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time through the Cookie Settings. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

In connection with marketing profiling, we may use external providers of marketing and advertising technologies. Detailed information about the technologies used and their providers is available in the Cookie Policy and Cookie Settings.

We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

§ 7. Your Tools – User Rights

You have control over your personal data. Depending on the circumstances and the legal basis for processing, you may exercise the following rights:

  • Right of access (Article 15 GDPR) – you may obtain confirmation of whether we process your personal data, access that data and receive a copy of it.

  • Right to rectification (Article 16 GDPR) – if your personal data is inaccurate or incomplete, you may request its correction or completion.

  • Right to erasure (Article 17 GDPR) – in the circumstances specified by the GDPR, you may request the deletion of your personal data.

  • Right to restriction of processing (Article 18 GDPR) – in the circumstances specified by the GDPR, you may request restrictions on how your personal data is processed.

  • Right to data portability (Article 20 GDPR) – where the conditions specified by the GDPR are met, you may receive the data you have provided to us in a structured, commonly used and machine-readable format and transmit it to another controller.

  • Right to withdraw consent (Article 7(3) GDPR) – where we process data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before its withdrawal.

  • Right to object (Article 21 GDPR) – where we process your personal data under Article 6(1)(f) GDPR, you may object to such processing on grounds relating to your particular situation.

Where your personal data is processed for direct marketing purposes, you may object at any time to its processing for those purposes, including profiling to the extent that it is related to such direct marketing. In that case, we will stop processing your personal data for those purposes.

You also have the right to lodge a complaint with the competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority competent for COBI in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

To exercise your rights or obtain additional information about the processing of your personal data, please contact our Data Protection Officer at: iod@cobi.pl.

We fulfil your rights in accordance with the rules and time limits established by the GDPR. Where we have reasonable doubts about the identity of the person submitting a request, we may ask for additional information necessary to verify their identity.

§ 8. Small but Important Elements – Cookies and Similar Technologies

Our Store uses cookies and other similar technologies that enable information to be stored on your device or access to information already stored on it (collectively referred to as “cookies”).

We use both first-party cookies and technologies provided by third parties.

We use the following categories of cookies:

  • Necessary cookies – required for the proper and secure operation of the Store and the provision of services you wish to use, particularly session management, shopping cart functionality, order processing, login and privacy settings;

  • Functional cookies – enable additional Store features and remember your choices and preferences;

  • Analytics cookies – allow us to analyse how you use the Store, generate statistics and improve its operation and functionality;

  • Marketing cookies – used to measure the effectiveness of advertising activities and, depending on the technology used, tailor advertisements to your potential interests, create audience groups and conduct remarketing.

We may use necessary cookies without your consent only to the extent permitted by applicable law. Other cookies are used after obtaining your prior consent where required. Technologies requiring consent are not activated until that consent has been given.

Where information collected through cookies constitutes personal data, we process it in accordance with the GDPR and this Privacy Policy.

For optional cookies requiring your consent, the legal basis for our processing of personal data for the purposes covered by that consent is generally Article 6(1)(a) GDPR.

For necessary cookies, the legal basis depends on the purpose of processing and may arise, in particular, from Article 6(1)(b), (c) or (f) GDPR.

You may accept all optional cookies, reject them or select individual categories. You may also change your preferences or withdraw your consent at any time through the Cookie Settings.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Detailed information about the use of cookies, categories of data processed, external providers and possible transfers of data outside the European Economic Area is available in the Cookie Policy.

An up-to-date list of the technologies used, including their names, providers, purposes, categories and retention periods, is available in the Cookie Settings.

§ 9. Technical and Organisational Measures

To ensure that your personal data is secure and processed in accordance with the law, we apply the following safeguards:

  • Transmission encryption – data is transmitted using the HTTPS/TLS protocol.

  • Encryption of stored data – our databases are protected by encryption.

  • Backups – we regularly create backups, which are stored on a separate server.

  • Access controls – password policies, multi-factor authentication, registration and verification of access permissions.

  • Data protection training and procedures – we provide employee training and have implemented an incident management procedure.

§ 10. Final Provisions

We reserve the right to update this instruction manual. We will inform you of any changes by publishing a new version of the document in the Store. Changes take effect on the date of publication.

The current version of the Privacy Policy is always available in the Store, together with information about the date of its most recent update.

If a change introduces a new purpose for processing your personal data or a significant change in the way it is processed, we will provide you with the required information before such processing begins.

Where applicable law requires your consent for a change, we will begin the relevant processing only after obtaining that consent.