1. Data Controller

The data controller is: Michał Socha, ul. Rynkowa 12, 05-816 Michałowice, Poland Email: michalsocha.art@gmail.com The Controller processes personal data to operate the online store, fulfill orders, contact customers, and for marketing purposes, in accordance with applicable data protection laws, including GDPR (Regulation (EU) 2016/679).

2. Personal Data Collected and Purpose of Processing

The store collects personal data voluntarily provided by users, including: Data necessary for order fulfillment: Name, delivery address, email, phone number, invoicing details. Purpose: order processing and delivery. Legal basis: Article 6(1)(b) GDPR. Data for marketing and analytics purposes: Newsletter subscriptions, website traffic analysis (Google Analytics), remarketing (Facebook Pixel). Purpose: marketing and improving store services. Legal basis: Article 6(1)(a) GDPR (consent) or Article 6(1)(f) GDPR (legitimate interest). Data submitted in contact forms: Email, message content, other voluntarily provided information. Purpose: responding to inquiries and providing support. Legal basis: Article 6(1)(b) or (f) GDPR. Payment data: Processed via payment provider TPAY. Purpose: payment processing. Legal basis: Article 6(1)(b) GDPR.

3. Recipients of Personal Data

Personal data may be shared with entities cooperating with the store for order fulfillment or store operations: Courier and postal service providers, Payment providers (TPAY), Hosting providers (Shopanda), Employees and collaborators processing data for order fulfillment. Marketing and analytics data may be processed by Google Analytics and Facebook Pixel. Data transfer outside the EU is carried out in compliance with GDPR (e.g., using Standard Contractual Clauses).

4. Data Retention Period

Order and invoicing data: 5 years (according to accounting law). Marketing data: up to 3 years from the date of consent. Data in the store system: until deletion upon user request, unless legal regulations require longer retention.

5. User Rights

Users have the right to: Access their personal data. Rectify their data. Delete data (“right to be forgotten”) unless prohibited by law. Restrict data processing. Data portability. Withdraw consent at any time (marketing and cookies). Object to processing for marketing and profiling purposes. Lodge a complaint with the Polish Data Protection Authority (UODO).

6. Cookies

The website uses cookies for: Essential functions: user session management, security. Analytics and statistics: Google Analytics, website performance. Marketing and remarketing: Facebook Pixel. Types of cookies: Session cookies: deleted after browser closure. Persistent cookies: stored for a specified period or until deleted by the user. Managing cookies: Users can change browser settings to block or delete cookies. Disabling some cookies may limit website functionality. More information: www.wszystkoociasteczkach.pl.

7. Profiling and Automated Decisions

Profiling is used only for marketing purposes (Google/Facebook).No automated decisions with legal or similarly significant effects on the user are made.

8. Data Security

Data submitted via forms and login is encrypted using SSL certificates. The Controller implements technical and organizational measures to protect data from unauthorized access.

9. Changes to the Privacy Policy

This Privacy Policy may be updated as needed. Updates do not affect data collected prior to the change unless required by law. The current version is published at: https://socha.storli.pl.