Information
GDPR notice
This is an English translation for information. The binding version is the Polish one. Polish version
Version of: 2026-11-03
§ 1. Scope of this notice
This notice concerns people the Controller is in contact with outside of shop purchases: suppliers, business partners and their employees, people corresponding with us, and people contacting us via our social media profiles. The data of people using the shop is described in the Privacy policy.
§ 2. Controller
The data controller is Oleksandra Zvaholska, Graniczna 151H lok. 1, 32-084 Bibice, NIP (tax ID) 5130277688. Contact: garrycraft.workshop@gmail.com, phone +48 799 080 279.
§ 3. Purposes, legal bases and periods
| Purpose | Legal basis | Period |
|---|---|---|
| Concluding and performing a contract with a business partner who is a natural person | Article 6(1)(b) GDPR | until the contract has been performed |
| Contact with the business partner's employees and associates | Article 6(1)(f) GDPR (legitimate interest: carrying out the cooperation) | for the duration of the cooperation |
| Handling correspondence | Article 6(1)(f) GDPR | up to 12 months from the last contact, unless the correspondence concerns a contract or claims |
| Accounting and tax obligations | Article 6(1)(c) GDPR | 5 years, counted from the beginning of the year following the financial year or from the end of the year in which the tax payment deadline expired |
| Running social media profiles | Article 6(1)(f) GDPR | until the content is deleted or an objection is raised |
| Establishing, pursuing or defending against claims | Article 6(1)(f) GDPR | until the limitation period for claims expires |
§ 4. Sources of data
The data comes from the data subject, from their employer or principal (name, position, contact details) and from public registers such as KRS and CEIDG.
§ 5. Recipients and data transfers
Recipients may include providers of IT, e-mail and hosting services, an accounting office, legal advisers and public authorities where required by law. On social media profiles, data is also processed by the platform operator under its own rules, and with regard to page statistics it may be a joint controller. Data may be transferred outside the EEA only in the cases and under the conditions set out in the GDPR.
§ 6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with the President of the Personal Data Protection Office. Providing data is voluntary, but necessary for cooperation or correspondence. We do not make automated decisions that produce legal effects.