Privacy policy
This policy explains what we do with personal data when you visit this store, place an order, or write to us. It is written under the EU General Data Protection Regulation (GDPR).
1. Controller
[TO FILL — legal company name], [TO FILL — registered address]. Contact for all data protection matters: [TO FILL — email].
Data protection officer: [TO FILL — name and contact, or "not appointed; a DPO is not required for our processing"].
2. What we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, delivery and billing address, email, phone | Fulfilling your order and providing support | Art. 6(1)(b) — performance of a contract | Duration of the contract, then the statutory accounting period |
| Order and invoice records | Tax and accounting obligations | Art. 6(1)(c) — legal obligation | [TO FILL — statutory period, typically 5–10 years] |
| Payment data | Taking payment | Art. 6(1)(b) | Held by the payment provider, not by us; we see only the last four digits and the transaction reference |
| Account credentials, if you create an account | Order history and faster checkout | Art. 6(1)(b) | Until you delete the account |
| Email address for the newsletter | Sending new-release emails | Art. 6(1)(a) — consent | Until you withdraw consent |
| Correspondence with us | Answering and evidencing your enquiry | Art. 6(1)(b) and 6(1)(f) | Three years after the matter is closed |
| Analytics and marketing cookies | Understanding how the store is used | Art. 6(1)(a) — consent, given through the cookie banner | See the cookie table below |
| Server logs, fraud and abuse signals | Security and integrity of the store | Art. 6(1)(f) — legitimate interest | Up to 12 months |
3. Cookies
Strictly necessary cookies — cart, session, checkout, security, and the record of your own consent choice — are set without consent because the store cannot function without them.
Everything else, including analytics and any advertising measurement, is set only after you accept in the cookie banner. Rejecting is a single click and carries no penalty: the store works identically. You can change or withdraw your choice at any time from the cookie settings link in the footer.
4. Who else processes your data
- Shopify Inc. — the store and checkout platform, acting as our processor.
- [TO FILL] — payment provider, acting as an independent controller for payment data.
- [TO FILL] — carrier, receiving name, address and phone number for delivery.
- [TO FILL] — email provider, for transactional and, where consented, marketing email.
Where a processor is outside the European Economic Area, the transfer is covered by an adequacy decision or by the European Commission's standard contractual clauses. We do not sell personal data and we do not share it for anyone else's marketing.
5. Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable format. Where processing rests on consent, you may withdraw that consent at any time, without affecting the lawfulness of what happened before.
Write to [TO FILL — email]. We answer within one month. You may also complain to a supervisory authority — for Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw — or to the authority in your own country of residence.
6. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you. Our payment provider may run automated fraud checks on a transaction.
7. Providing data
The data required at checkout is necessary to conclude and perform the contract. Without it we cannot ship an order. Everything else — newsletter, account — is optional.
Last updated: [TO FILL — date].