Privacy Policy

1. Data controller

The controller of your personal data is:

The controller has not appointed a Data Protection Officer. For any matter concerning your data, write to the e-mail address above or to the registered address.

2. Purposes and legal bases

Purpose	Legal basis (GDPR)
Concluding and performing the sales contract: handling the order, payment, shipping, contact about the order	Art. 6(1)(b) — necessary to perform a contract
Issuing and storing invoices and other accounting records	Art. 6(1)(c) — legal obligation (Polish VAT and accounting law)
Handling complaints and withdrawal from the contract	Art. 6(1)(c) and (b)
Answering an enquiry sent through the contact form	Art. 6(1)(f) — legitimate interest (replying); also (b) where the enquiry concerns an offer
Sending the newsletter	Art. 6(1)(a) — consent (you may withdraw it at any time)
Keeping the site secure and preventing abuse and spam (anti-bot mechanism, rate limits, server logs)	Art. 6(1)(f) — legitimate interest
Establishing, exercising or defending legal claims	Art. 6(1)(f) — legitimate interest

3. What we collect

• Order: name (or recipient's name), delivery address, e-mail address, phone number, order contents, amount and payment method, and — if you ask for an invoice — your invoicing details including VAT ID.
• Contact form: whatever you enter — usually a name, an e-mail address and the message.
• Newsletter: e-mail address plus the date and confirmation of your sign-up.
• Technical data: IP address, browser and operating system, date and time of the request — recorded in server logs.

We do not process special categories of data (Art. 9 GDPR) and we never ask for them. Please do not put such data in messages or in order notes.

We never see or store your card number. You enter card details directly with the payment provider; we only receive the outcome of the transaction.

4. Recipients

We share data only as far as the purposes above require. Categories of recipients:

• Payment provider — to settle the transaction.
• Carrier / postal operator — to deliver the parcel (address and a phone number for the courier).
• Hosting and shop maintenance provider — as a processor, under a data processing agreement.
• E-mail and messaging provider — to send confirmations and the newsletter.
• Accounting office — for accounting records.
• Anti-bot service provider — to tell humans from automated scripts in forms.
• Law firms and debt recovery — where this proves necessary.
• Public authorities — where the law requires it.

The list of the specific entities we entrust data to: [[LIST OF PROCESSORS — to be completed to match reality]]. We also provide it on request sent to the address in section 1.

We do not sell personal data and we do not share it for third-party marketing.

5. How long we keep it

• Order data: for as long as the order is being handled and then until claims become time-barred — as a rule 6 years.
• Accounting records: 5 years from the end of the calendar year in which the tax payment fell due.
• Contact form correspondence: up to 12 months after the matter is closed, unless it turns into an order.
• Newsletter: until you withdraw consent. We keep proof of consent and of its withdrawal for the limitation period.
• Server logs: up to 12 months.

6. Your rights

In connection with the processing of your data you have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• rectification of inaccurate or incomplete data (Art. 16),
• erasure (Art. 17) — as far as no legal obligation stands in the way, e.g. keeping invoices,
• restriction of processing (Art. 18),
• portability of data processed under a contract or consent (Art. 20),
• object to processing based on legitimate interest (Art. 21) — including, at any time, to direct marketing,
• withdraw consent at any time (Art. 7(3)); withdrawal does not affect the lawfulness of processing before it.

Send your request to the e-mail address in section 1. We respond without undue delay and at the latest within one month of receiving it.

7. Transfers outside the European Economic Area

As a rule we process data within the EEA. Where a tool provider processes data outside the EEA, this happens under a European Commission adequacy decision or under standard contractual clauses (Art. 46(2)(c) GDPR), together with an assessment of the transfer. We provide a copy of the safeguards on request sent to the address in section 1.

8. Cookies

1. Strictly necessary cookies — keep your session and cart and protect forms (CSRF token). The shop does not work without them, so they do not require consent.
2. Analytics and marketing cookies — we set them only after you consent in the banner shown on your first visit. You can change or withdraw that consent at any time in the consent settings or by deleting cookies in your browser.
3. Your browser lets you block cookies. Blocking the strictly necessary ones makes it impossible to place an order.

9. Is providing data required

Providing data is voluntary, but in some cases necessary. Without address and contact details we cannot fulfil an order, without invoicing details we cannot issue an invoice, and without an e-mail address we cannot send the newsletter. Signing up to the newsletter is never a condition of buying.

10. Automated decision-making

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you (Art. 22 GDPR). The anti-bot mechanism protecting our forms assesses the nature of a request rather than a person and does not decide about your rights — if it wrongly rejects you, simply contact us by e-mail.

11. Changes to this policy

We may update this policy when the law, the scope of our services or the tools we use change. A new version applies from the day it is published on this page. We notify newsletter subscribers by e-mail about material changes that affect them.

Document version of [[PUBLICATION DATE]].