M249, PRIME, MP5 and more – discounts up to -50% →
Darmowa dostawa od  24,79 €
Service Center Pomoc
Trustpilot
Currency€DeliveryPolandLanguageGunfire PolskaGunfire in EnglishGunfire en FranceGunfire en EspañaGunfire ​​in NederlandGunfire in Czech
Language and currency:
en | €
Delivery to:
Poland
  • pl
    en
    fr
    nl
    es
    cz
Back
  1. Home page
  2. Privacy policy

Privacy policy

Privacy Policy of the Gunfire.com Online Store

I. General Information

  1. This Privacy Policy sets out the rules for processing the personal data of persons using the online store available at www.gunfire.com , hereinafter referred to as the “Store”, including persons who:
    1. visit the Store’s website;
    2. create an account in the Store;
    3. place orders;
    4. contact the Company, including through the contact form or chat;
    5. use the Zowie virtual assistant;
    6. subscribe to the newsletter;
    7. submit complaints, statements of withdrawal from the contract or other requests.
  2. The controller of personal data is GF Corp spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office in Wrocław at ul. Jana Długosza 42–46, hereinafter referred to as the “Controller” or the “Company”.
  3. The Controller processes personal data in accordance with applicable laws, in particular:
    1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter referred to as the “GDPR”;
    2. regulations concerning the provision of electronic services and electronic communications;
    3. Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence, hereinafter referred to as the “AI Act”.
  4. The Controller has appointed a Data Protection Officer. In matters concerning the processing of personal data, the Data Protection Officer may be contacted at: iod@gfcorp.pl.
  5. Detailed information on the use of cookies and similar technologies is provided in the Cookie Policy.

II. Sources and Categories of Personal Data

  1. The Controller obtains personal data primarily directly from the data subject, in particular when the person:
    1. creates an account;
    2. places and completes an order;
    3. makes a payment;
    4. contacts the Company;
    5. uses the contact form or chat;
    6. uses the Zowie virtual assistant;
    7. submits a complaint or a statement of withdrawal from the contract;
    8. subscribes to the newsletter;
    9. gives marketing consent;
    10. uses the Store’s website.
  2. Depending on how the Store is used, the Controller may process the following categories of data:
    1. identification data, in particular first name and surname;
    2. contact details, in particular an email address and telephone number;
    3. address details, including the delivery address and the address used for issuing accounting documents;
    4. user account data, including the account identifier and activity history;
    5. data concerning orders, payments, deliveries, returns and complaints;
    6. data contained in correspondence and conversations conducted through chat;
    7. data of a person designated as a contact person or parcel recipient;
    8. date of birth or information confirming that the required age has been reached, where necessary due to the type of product or applicable laws;
    9. search history, viewed products and interactions with Store content;
    10. technical data, in particular the IP address, online identifiers, device type, browser type, operating system, date and time of using the Store and system logs;
    11. marketing preferences and information about consents given;
    12. other data voluntarily provided to the Controller.
  3. In the case of electronic payments, payment instrument data is generally processed by the payment service provider. The Controller does not store full payment card details unless expressly stated otherwise.
  4. If a customer provides the personal data of another person, for example a parcel recipient or contact person, the customer should inform that person that their data has been provided to the Controller and that they may review this Privacy Policy.

III. Purposes and Legal Bases of Data Processing

1. User account management

Personal data is processed to create and maintain an account in the Store and to provide access to its functionalities.

The legal basis for processing is Article 6(1)(b) of the GDPR – the performance of a contract for the provision of electronic services or taking steps at the user’s request before entering into such a contract.

2. Placing and fulfilling orders

Personal data is processed for the purpose of:

  1. accepting and fulfilling an order;
  2. entering into and performing a sales contract;
  3. processing payments;
  4. organising delivery;
  5. contacting the customer regarding order fulfilment.

The legal basis for processing is Article 6(1)(b) of the GDPR.

3. Tax, accounting and other legal obligations

Personal data may be processed for the purpose of issuing and retaining invoices and other accounting documents, maintaining accounting records and complying with other obligations arising from applicable laws.

The legal basis for processing is Article 6(1)(c) of the GDPR – compliance with a legal obligation to which the Controller is subject.

4. Returns, complaints and withdrawal from the contract

Personal data is processed for the purpose of:

  1. accepting and handling complaints;
  2. handling returns or withdrawal from the contract;
  3. exercising rights arising from liability for the conformity of goods with the contract, guarantees or other applicable laws.

The legal basis for processing is Article 6(1)(b) and Article 6(1)(c) of the GDPR and, in relation to the establishment, pursuit or defence of claims, Article 6(1)(f) of the GDPR.

5. Contact with the Controller

Personal data provided by email, telephone, contact form or chat is processed for the purpose of responding to and handling the request.

If the request concerns entering into or performing a contract, the legal basis for processing is Article 6(1)(b) of the GDPR. In other cases, the legal basis is Article 6(1)(f) of the GDPR, and the Controller’s legitimate interest is communicating with users and handling their enquiries.

6. Use of the Zowie virtual assistant

  1. The Store may provide the Zowie virtual assistant, which uses an artificial intelligence system.
  2. Before starting a conversation, the user is clearly and visibly informed that they are interacting with an AI system. This information is provided independently of the provisions of this Privacy Policy.
  3. In connection with the use of Zowie, the Controller may process:
    1. the content of questions, answers and the entire conversation;
    2. contact details provided by the user;
    3. the order number and other data concerning the request, if provided by the user;
    4. technical data, including the IP address, session identifier, date and time of the conversation and device information;
    5. information necessary to transfer the conversation to a Company employee.
  4. Data provided during a conversation with Zowie is processed for the purpose of:
    1. answering the user’s question;
    2. handling requests concerning orders, returns, complaints and other matters related to the Store;
    3. transferring the conversation to a customer service representative where necessary or at the user’s request;
    4. ensuring the security and proper operation of the chat;
    5. detecting and correcting errors;
    6. monitoring the quality of customer service;
    7. establishing, pursuing or defending possible claims.
  5. The legal basis for processing is:
    1. Article 6(1)(b) of the GDPR – where the conversation concerns entering into or performing a contract, an order, return or complaint;
    2. Article 6(1)(f) of the GDPR – in the case of other enquiries, ensuring security, monitoring quality, detecting errors and establishing, pursuing or defending claims.
  6. Conversations with Zowie are retained for the period necessary to provide the service, unless longer retention is required in connection with the performance of a contract, handling a complaint, compliance with a legal obligation or the establishment, pursuit or defence of claims.
  7. The user should not provide the following information through the chat:
    1. payment card details;
    2. passwords and access codes;
    3. special categories of personal data, in particular health data;
    4. personal data of other persons, unless necessary to handle the request.
  8. Zowie supports customer service but does not make decisions concerning the user that produce legal effects or similarly significantly affect the user. In particular, Zowie does not independently resolve complaints or make binding statements on behalf of the Company.
  9. Responses generated by Zowie may contain errors or inaccuracies. The user may request that the conversation be transferred to a Company employee.
  10. Conversation content may be used to train artificial intelligence models only after the user has been informed in advance and provided that the Controller has an appropriate legal basis, including obtaining separate consent where required.
  11. Data processed through Zowie may be entrusted to the chat platform provider and the provider of the AI technology or model. These providers may process the data only on the Controller’s documented instructions, under concluded agreements and with appropriate security measures.

7. Newsletter and marketing communications

  1. Personal data is processed for the purpose of sending newsletters and other commercial information where the user has given the relevant consent.
  2. The legal basis for processing is Article 6(1)(a) of the GDPR.
  3. Email, telephone or other means of electronic communication are used for marketing purposes only in cases permitted by electronic communications laws.
  4. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal. The user may unsubscribe from the newsletter, in particular by using the link included in the message.

8. Content personalisation and product recommendations

  1. The Controller may analyse how the Store is used, including search history, viewed products and interactions with content, for the purpose of:
    1. adjusting how the Store is presented;
    2. displaying product recommendations;
    3. customising search results;
    4. analysing users’ interests and needs;
    5. improving the Store’s functionality.
  2. Where personalisation uses cookies or similar technologies that are not necessary for the Store to operate, personal data is processed based on the user’s consent under Article 6(1)(a) of the GDPR.
  3. In other cases, the legal basis for processing may be Article 6(1)(f) of the GDPR, and the Controller’s legitimate interest is developing the Store, adapting its functionality to users’ needs and conducting statistical analyses.
  4. For the personalisation of search results and recommendations, the Controller may use the services of IdoSell (IAI S.A., with its registered office in Szczecin). Detailed information about this provider is available at: www.idosell.com .

9. Security and prevention of abuse

Personal data, in particular the IP address, online identifiers, device data, activity data and system logs, is processed for the purpose of:

  1. ensuring the security of the Store;
  2. detecting abuse and fraud;
  3. preventing unauthorised access;
  4. ensuring continuity of services;
  5. enforcing the Store’s terms and conditions.

The legal basis for processing is Article 6(1)(f) of the GDPR, and the Controller’s legitimate interest is protecting the Store, its users and the transactions conducted through it.

10. Claims and accountability

Personal data may be processed for the purpose of establishing, pursuing or defending claims and demonstrating the Controller’s compliance with applicable laws.

The legal basis for processing is Article 6(1)(f) of the GDPR, and the Controller’s legitimate interest is protecting its rights and ensuring accountability.

IV. Cookies and Similar Technologies

  1. The Store uses cookies and similar technologies for the purpose of:
    1. ensuring the proper operation of the website;
    2. maintaining the user’s session;
    3. remembering settings;
    4. conducting statistical analyses;
    5. personalising content;
    6. conducting marketing activities;
    7. ensuring security.
  2. Cookies that are not necessary for the proper operation of the Store are used only after obtaining the user’s consent.
  3. The user may change or withdraw their consent at any time using the consent management tool available in the Store.
  4. Detailed information about the types of cookies, their providers and their periods of operation is provided in the Cookie Policy.

V. Recipients of Personal Data

  1. Personal data may be disclosed or entrusted to the following categories of recipients:
    1. hosting, cloud and IT service providers;
    2. providers of software used to operate the Store;
    3. the chat platform provider and the AI technology provider used by Zowie;
    4. payment service providers;
    5. banks and payment institutions;
    6. courier, postal and logistics companies;
    7. providers of search, personalisation and product recommendation tools, including Prefixbox;
    8. email marketing and marketing service providers;
    9. analytics tool providers;
    10. entities providing accounting, legal, auditing and debt collection services;
    11. entities providing system security services;
    12. public authorities, where the obligation to disclose personal data arises from applicable laws.
  2. Recipients may process personal data as processors acting on the Controller’s instructions or as separate controllers where they independently determine the purposes and means of processing.

VI. Transfers of Personal Data Outside the European Economic Area

  1. Some service providers used by the Controller may have their registered offices or infrastructure outside the European Economic Area, in particular in the United States.
  2. This applies or may apply in particular to:
    1. Google LLC;
    2. the chat platform provider;
    3. the provider of the AI system or model used by Zowie;
    4. providers of analytics, hosting or marketing services.
  3. Personal data is transferred outside the European Economic Area only where an appropriate legal basis exists, in particular:
    1. a European Commission adequacy decision, including, where applicable, the recipient’s participation in the EU–US Data Privacy Framework;
    2. standard contractual clauses approved by the European Commission;
    3. other safeguards provided for under the GDPR.
  4. Where required, the Controller applies additional technical and organisational measures and assesses the risks associated with the transfer of personal data.
  5. Information about the safeguards applied, or a copy of such safeguards, may be obtained by contacting the Data Protection Officer.

VII. Personal Data Retention Periods

  1. Account-related data is retained for the period during which the account is maintained and subsequently for the period necessary to comply with legal obligations and until the expiry of the applicable limitation periods for claims.
  2. Data concerning orders and contracts is retained for the duration of the contract and subsequently until the expiry of the limitation periods for related claims.
  3. Tax and accounting documentation is retained for the period required by applicable laws, generally for five years, calculated in accordance with the relevant tax and accounting regulations.
  4. Data concerning complaints, returns and withdrawals from contracts is retained for the period necessary to handle the matter and subsequently until the expiry of the limitation periods for claims.
  5. Data contained in correspondence is retained for the period necessary to handle the matter and subsequently until the expiry of the limitation periods for possible claims.
  6. Conversations conducted through Zowie or another chat service are retained for [● months], subject to the possibility of longer retention of data connected with an order, complaint, legal obligation or claim.
  7. Data processed based on consent is retained until the consent is withdrawn or the purpose of processing ceases to apply. Information about the granting and withdrawal of consent may be retained for longer where necessary to demonstrate the Controller’s compliance with the law.
  8. Data processed for direct marketing purposes is retained until an objection is raised or the relevant consent is withdrawn.
  9. System logs are retained for the period necessary to provide the service, unless longer retention is required due to a security incident, proceedings or a claim.
  10. Data associated with cookies is retained for the periods specified in the Cookie Policy.
  11. After the relevant retention period expires, personal data is deleted or anonymised in a manner that prevents the identification of the person.

VIII. Profiling, Automation and Artificial Intelligence

  1. Personal data may be processed by automated means, including profiling, for the purpose of:
    1. customising search results;
    2. recommending products;
    3. personalising Store content;
    4. conducting statistical analyses;
    5. detecting abuse and ensuring security.
  2. Profiling may involve analysing search history, viewed products, completed purchases, activity in the Store and declared preferences.
  3. The results of such analysis may affect the order in which products, recommendations or marketing content are displayed, but they do not produce legal effects concerning the user or similarly significantly affect the user.
  4. Zowie uses an AI system to analyse the content of a question and generate a response. Data provided during the conversation may be transferred to the AI technology provider to the extent necessary to generate a response and operate the chat.
  5. Zowie does not make decisions concerning the user based solely on automated processing that would produce legal effects or similarly significantly affect the user.
  6. If the Controller implements a system making such decisions in the future, it will provide data subjects, before the system is used, with the information required under the GDPR, including information on the logic involved, the significance and the envisaged consequences of such processing.

IX. Rights of Data Subjects

  1. Subject to the conditions set out in the GDPR, the data subject has the right to:
    1. obtain information about the processing of personal data;
    2. access personal data and receive a copy of it;
    3. rectify inaccurate personal data or complete incomplete personal data;
    4. erase personal data;
    5. restrict processing;
    6. data portability;
    7. object to processing based on Article 6(1)(f) of the GDPR;
    8. withdraw consent at any time where processing is based on consent;
    9. not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject.
  2. Where personal data is processed for direct marketing purposes, the data subject may object at any time. After an objection is raised, personal data will no longer be processed for such purposes.
  3. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
  4. To exercise their rights, the data subject may contact the Controller or the Data Protection Officer at: iod@gfcorp.pl.
  5. The Controller may verify the identity of the person submitting the request where necessary to protect personal data against unauthorised disclosure.
  6. The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office.

X. Voluntary Provision of Personal Data

  1. Providing personal data is voluntary, but in some cases it is necessary to:
    1. create an account;
    2. enter into and perform a contract;
    3. fulfil an order and arrange delivery;
    4. process a payment;
    5. handle a complaint;
    6. respond to a request;
    7. use specific Store functionalities.
  2. Failure to provide personal data required for a particular purpose may make it impossible to provide the relevant service or handle the request.
  3. Providing personal data for the purpose of receiving newsletters or other marketing content is voluntary and is not a condition for entering into a contract.

XI. Personal Data Security

  1. The Controller applies appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing of personal data.
  2. These measures include, in particular, access controls, permission management, IT system safeguards, backups, incident monitoring and confidentiality obligations imposed on persons with access to personal data.
  3. The Controller periodically assesses the security of the systems used, including AI systems and service providers involved in personal data processing.

XII. Amendments to the Privacy Policy

  1. The Privacy Policy may be updated in particular in the event of:
    1. changes in applicable laws;
    2. changes in the scope of the Store’s activities;
    3. the implementation of new functionalities or technologies;
    4. changes of service providers;
    5. changes in how AI systems are used.
  2. The current version of the Privacy Policy is published in the Store together with its effective date.
  3. This version of the Privacy Policy is effective from 1 August 2026.
pixel