Privacy and cookies
How we use data to handle your purchases and what rights you have.
1. Controller
The controller is IHOR DUBNYTSKYI, a business registered in CEIDG, NIP 1133185157. Registered address: ul. Długa 29, 00-238 Warszawa, Poland. For personal data matters, contact grifslais@gmail.com.
The virtual office at ul. Długa 29 is the registered address only. No correspondence, returns or customer visits are accepted there.
2. Data, purposes and legal bases
- Orders and delivery: name, email, phone, address or pickup point, order contents and payment status, to perform a contract or take requested pre-contract steps (GDPR Article 6(1)(b)).
- Accounting and legal duties: transaction data, business details and tax number when relevant, and complaint records, under legal obligations (Article 6(1)(c)).
- Contact, security and claims: correspondence and necessary technical data such as IP addresses and logs, for our legitimate interests in responding, protecting the store and establishing or defending claims (Article 6(1)(f)); contractual or legal grounds also apply where relevant.
- Optional analytics or marketing, only if actually enabled and with required consent (Article 6(1)(a)). Consent may be withdrawn without affecting earlier lawful processing.
Providing data is voluntary, but we cannot fulfil orders or respond without the necessary information. Statutory accounting information is required by law.
3. Recipients and international transfers
We use Shopify to host the store and Google/Gmail for correspondence. As necessary to handle an order, recipients may include InPost, the selected payment provider, IT and accounting providers, advisers and authorities entitled by law. We share only data needed for the relevant service or duty.
Shopify and Google use international infrastructure. Transfers outside the European Economic Area require appropriate safeguards, such as an adequacy decision or standard contractual clauses. Information about applicable safeguards and how to obtain a copy is available on request. See the Shopify privacy policy and Google privacy policy. Providers may also act as separate controllers for their own services.
4. Retention
Order data is kept for fulfilment and then for statutory accounting and claims periods. Correspondence is kept to resolve the matter and, if needed, protect claims. Consent-only processing lasts until withdrawal or earlier completion of the purpose. Cookie and similar technology periods depend on enabled services: Shopify’s cookie information; duration depends on the cookie and the function used.
5. Your rights
You may request access, correction, erasure, restriction and, where applicable, portability. You may object to legitimate-interest processing based on your situation and object to direct marketing at any time. You may withdraw consent and complain to the Polish data protection authority: uodo.gov.pl. Each right is subject to the GDPR conditions.
6. Cookies and automated decisions
Essential technologies support the bag, session and security. Optional analytics and advertising require prior consent where required by law. Refusal does not prevent purchases. Preferences may be changed through the store’s privacy controls.
No Google Ads or Meta advertising pixels have been added to the storefront we prepared. Before enabling additional analytics or advertising that requires consent, we will offer the appropriate choice and update this information. Shopify tools may process technical data for store operation and security; see the Shopify information linked above.
Updated: 12 September 2026.