Privacy policy

1. Controller

The controller of personal data is the seller identified above. No data protection officer has been appointed; privacy questions should be sent to the contact email address.

2. Purposes and legal bases for processing

• account and authentication services — performance of the contract and security;
• cart, order, payment, delivery and complaints — performance of the contract and legal obligations;
• fraud prevention, protection of claims and security — legitimate interest;
• transactional messages and customer support — performance of the contract or action at the Customer's request.

3. Categories of data

The data processed may include account data, full name, email address, telephone number, delivery address, order contents, payment and shipping information, correspondence and technical security data. The Store does not retain full payment card details.

4. Recipients and providers

Data is disclosed only to the extent necessary for the relevant purpose: Clerk (identity), Supabase/PostgreSQL and Vercel (hosting and application data), Stripe or Przelewy24 (payments), InPost (delivery after a shipment is created), Resend (email), Upstash (abuse prevention) and Cloudflare Turnstile/DNS (security). The project does not include an advertising system or marketing analytics.

5. Retention period

Order data and accounting records are retained for the period required by tax law and needed to handle claims. Account data is retained until the account is deleted, subject to legal obligations. Security logs are retained for a period proportionate to protecting the Store.

6. Transfers outside the EEA

Some providers may process data outside the EEA. In such cases, the controller uses the mechanisms provided by the GDPR, in particular an adequacy decision or standard contractual clauses. Details depend on the owner's current agreements with the providers.

7. Rights of the data subject

Within the limits of the GDPR, data subjects have rights of access, rectification, erasure, restriction, portability, objection and the right to lodge a complaint with the President of the Polish Personal Data Protection Office. Consent may be withdrawn where processing is based on consent.

8. Cookies and browser storage

The Store uses only mechanisms necessary for authentication, security, the cart, language and theme preferences, and payment operation. The current code does not activate analytics or marketing cookies. If such tools are added, the policy and consent mechanism must be updated before they are activated.