Privacy policy

1. Data controller

Producer: Oleksandra Zvaholska / Garry Craft; Graniczna 151H lok. 1, 32-084 Bibice; NIP 5130277688; e-mail: garrycraft.workshop@gmail.com. Details to be confirmed against CEIDG.

Contact on personal data matters: garrycraft.workshop@gmail.com.

2. Scope and purposes of processing

• Enquiries and correspondence: name, e-mail, content of the enquiry, any attachments and other data provided voluntarily; legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract) or Article 6(1)(f) GDPR (handling correspondence not related to a contract).
• Order fulfilment: identification, contact and delivery data, order specification and history; Article 6(1)(b) GDPR.
• Billing: invoicing and payment data; Article 6(1)(c) GDPR (tax and accounting obligations).
• Complaints, returns, disputes: order data, correspondence and documentation; Article 6(1)(c) or (f) GDPR, depending on the purpose.
• Website security: necessary logs and technical data; Article 6(1)(f) GDPR, following an assessment of the controller's interest.
• E-mail/SMS marketing: only where an appropriate GDPR legal basis and the required consent for the communication channel exist; Article 6(1)(a) GDPR or another appropriate basis, in line with the actual model.

3. Data recipients

Data may be disclosed to providers of hosting, e-mail and shop software, payment operators, courier companies, accounting and IT service providers, and authorities entitled under the law. Names of the actual providers: Przelewy24, couriers, e-mail provider and analytics tools.

4. Retention periods

Enquiries that did not result in a contract: [determine a justified period, e.g. 12 months from the last contact, unless longer retention is necessary].

Order data: for the duration of the contract and thereafter for the period necessary to handle claims and fulfil legal obligations. Tax documents: for the period required by tax law, as a rule taking into account 5 years from the end of the year in which the tax payment deadline expired, taking into account any suspension/interruption of the limitation period.

Marketing data: until consent is withdrawn or the purpose ends, with the possibility of retaining the necessary proof of consent given/withdrawn.

5. Data subject rights

You have the right of access, rectification, erasure, restriction of processing and data portability — in the cases provided for by law — and the right to object to processing based on legitimate interest. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

A complaint may be lodged with the President of the Personal Data Protection Office (UODO) (uodo.gov.pl). To exercise your rights, please write to the controller's address.

6. Obligation to provide data

Providing the data necessary to conclude and perform the contract is a condition of fulfilling the order; failure to provide it may prevent the conclusion of the contract or delivery. Providing data for marketing is voluntary.

7. Recipients of personal data and transfers outside the EEA

a) Recipients of personal data

Customers' personal data may be transferred to the following categories of recipients, solely to the extent necessary to achieve the specified purposes of processing:

• entities providing hosting, IT and website maintenance services;
• entities handling electronic payments;
• postal operators, courier and transport companies;
• entities providing accounting, tax and legal services;
• entities providing e-mail, IT security and web analytics services, where such services are used;
• public authorities, where an obligation to disclose data arises from legal provisions.

b) Area of data processing

Personal data are processed in Poland and may be processed in other countries of the European Economic Area (EEA).

Where services of entities with registered offices or infrastructure outside the EEA are used, personal data may be transferred to third countries.

c) Transfers of data to third countries

If personal data are transferred outside the EEA, the Controller ensures that an appropriate transfer mechanism is applied, in particular:

• a European Commission decision finding an adequate level of personal data protection in the given country or for specified recipients, in accordance with Article 45 GDPR;
• standard contractual clauses approved by the European Commission, in accordance with Article 46(2)(c) GDPR, together with supplementary protection measures where required.

Where data are transferred to the United States, the transfer may be based on the European Commission decision concerning the EU–US Data Privacy Framework, provided that the specific recipient is covered by that mechanism.

d) Information on safeguards

Customers may obtain information on the safeguards applied to data transfers outside the EEA and on how to obtain a copy of them by contacting the Controller at: garrycraft.workshop@gmail.com.

8. Profiling and automated decision-making

1. The Controller may carry out advertising and marketing activities via social media services, in particular Facebook, Instagram and other social media platforms.
2. As part of these activities, social media platform operators may process users' data, including information about their interests, activity and preferences, in order to tailor the advertisements displayed to specific audiences. Such activities may constitute profiling within the meaning of Article 4(4) GDPR.
3. The Controller may use advertising tools that allow advertising audiences to be defined according to selected criteria, such as users' interests, location or activity, in accordance with the rules of the given platform and the applicable personal data protection laws.
4. If the Controller uses tracking or advertising tools on the website that require the user's consent, they are activated only after the appropriate consent has been obtained, which may subsequently be withdrawn.
5. The Controller does not make decisions regarding Customers based solely on automated processing of personal data that would produce legal effects concerning them or similarly significantly affect them, within the meaning of Article 22 GDPR.
6. The display of personalised advertisements does not automatically affect the ability to place an order, the terms of concluding a contract or the price of the Products offered by Garry Craft.

9. Cookies and similar technologies

The website may use technologies necessary for the operation of forms, maintaining security and payments. [TO BE COMPLETED: table of actual cookies and technologies: name, provider, purpose, duration, category].

Technologies not required to provide the service (e.g. analytics or marketing technologies, where they require consent) should be activated only after appropriate consent has been obtained. The user should be able to refuse and to change their choice later. The details require verification of compliance with the Electronic Communications Law (Prawo komunikacji elektronicznej).

10. Security and changes

The Controller applies appropriate technical and organisational measures adapted to the risk, in particular access control, updates, backups and protection of communications.

This Policy may be updated in the event of changes in the law or technology. Effective from 15.11.2026.

11. Legal basis

Regulation (EU) 2016/679 (GDPR), in particular Articles 5, 6, 12–15, 17–22, 28, 32 and 44–49; the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) with regard to storing information and accessing it on terminal equipment.