Privacy Policy

    § 1. Personal Data Controller

    The personal data controller is A Design Anna Kawalec, ul. Angielska 3, 63-500 Ostrzeszów, Tax ID (NIP): 514-028-10-71 (hereinafter: "the Controller").

    To contact the Controller regarding personal-data protection matters:

    • e-mail: bupu@bupu.pl
    • correspondence address: ul. Angielska 3, 63-500 Ostrzeszów

    § 2. Scope of Data Collected

    The Controller collects personal data provided voluntarily by the Customer in connection with using the Shop, in particular:

    • first name and surname,
    • delivery address,
    • e-mail address,
    • phone number,
    • invoicing data (company name, tax ID, address) - if the Customer requests a VAT invoice.

    § 3. Purposes and Legal Bases for Processing

    The Controller processes Customers' personal data for the following purposes:

    1. Order fulfilment and performance of the sales contract - pursuant to Art. 6(1)(b) GDPR (processing necessary for the performance of a contract). This includes: accepting and handling the order, delivering the Goods, issuing a sales document, handling returns and complaints.
    2. Fulfilment of legal obligations - pursuant to Art. 6(1)(c) GDPR. This includes: maintaining accounting and tax records, fulfilling obligations under the Consumer Rights Act.
    3. Legitimate Interest of the Controller - pursuant to Art. 6(1)(f) GDPR. This includes: pursuing or defending against claims, conducting web analytics to improve the Shop.
    4. Client's Consent - pursuant to Art. 6(1)(a) GDPR. This includes: sending newsletters and commercial information by electronic means, marketing activities. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.

    Providing personal data necessary to place and fulfil an order is voluntary but required for concluding and performing the sales contract. Failure to provide such data makes it impossible to process the order. Providing data for marketing purposes is entirely voluntary.

    § 4. Recipients of Data

    Customers' personal data may be shared with the following categories of recipients, only to the extent necessary for the given purpose:

    Courier and logistics companies (scope: first name, surname, delivery address, telephone number, e-mail address - shared in the form of a shipping label / waybill constituting a delivery instruction):

    • DPD Polska sp. z o.o.,
    • InPost sp. z o.o. (including InPost parcel-locker services).

    Payment operators (scope: data necessary to process the payment transaction):

    • Przelewy24 (PayPro S.A.),
    • Stripe Payments Europe, Ltd.,
    • PayPal (Europe) S.à r.l. et Cie, S.C.A.

    Other entities:

    • hosting and IT service providers supporting the Shop,
    • the accounting firm cooperating with the Controller,
    • Google Ireland Limited (Google Analytics) - only after consent to analytical cookies has been given,
    • Cloudflare, Inc. (Cloudflare Turnstile - contact-form verification, solely for bot protection),
    • public authorities - only where disclosure is required by law.

    The amount of data shared is limited to the necessary minimum in each case.

    § 5. Transfer of data to third countries

    Personal data may be transferred outside the European Economic Area in connection with the use of PayPal, Stripe and Cloudflare (contact-form verification), and - only after consent to analytical cookies has been given - Google Analytics (Google Ireland Limited / Google LLC, USA). Such transfers rely on the safeguards provided for in the GDPR, in particular standard contractual clauses or, in the case of Google LLC, the EU-US Data Privacy Framework.

    § 6. Data Retention Period

    • Data related to order fulfilment - for the duration of the contract and subsequently for the limitation period for civil-law claims (as a rule, 6 years from the end of the calendar year in which the claim became due).
    • Accounting and tax data - for a period of 5 years from the end of the calendar year in which the tax payment deadline expired.
    • Data processed on the basis of consent (e.g. newsletter) - until consent is withdrawn.
    • Data processed for the purpose of a legitimate interest - until an effective objection is raised or the purpose of processing ceases.

    § 7. Client Rights

    Every Customer whose personal data are processed has the right to:

    1. access to your personal data (Art. 15 GDPR),
    2. rectification rectification of inaccurate data or supplementation of incomplete data (Art. 16 GDPR),
    3. erasure of data - the "right to be forgotten" (Art. 17 GDPR), where no other legal basis for further processing exists,
    4. restriction of processing of data (Art. 18 GDPR),
    5. portability of data to another controller (Art. 20 GDPR),
    6. objection to processing based on the Controller's legitimate interest (Art. 21 GDPR),
    7. withdrawal of consent at any time - without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

    To exercise the above rights, please contact the Controller at the e-mail address: bupu@bupu.pl or in writing to the registered office address.

    The Customer also has the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl), if the Customer considers that the processing of personal data infringes the GDPR.

    § 8. Automated Decision-Making

    The Controller does not make decisions based solely on automated processing of Customers' personal data, including profiling within the meaning of Art. 22 GDPR.

    § 9. Cookies

    1. The Shop uses cookies, i.e. small text files stored on the Customer's device (computer, phone, tablet) while using the Shop.

    2. The Shop uses the following types of cookies:

      Necessary - ensure the Shop functions correctly, including the shopping cart, the order process, and remembering the Customer's cookie consent choice. They do not require the Customer's consent.

      Analytical (Google Analytics) - cookies _ga and _ga_KG7DBFQB3D, set by Google Ireland Limited, stored for up to 2 years, used to measure traffic and how the Store is used. Loaded only after consent has been given. The Store does not currently use functional or marketing/advertising cookies.

    3. On first visiting the Store, an information banner is displayed allowing the Customer to consent to analytical cookies (Google Analytics) or decline. The Customer can change this decision at any time using the “Cookies” link in the site footer.

    4. The Customer may also manage cookies through their web-browser settings, including blocking their storage. Restricting the use of cookies may affect the availability of certain Shop features.

    5. Detailed information about the cookies used (names, retention periods, purpose) is provided above.

    § 10. Final provisions

    1. The Controller reserves the right to amend this Privacy Policy. Customers will be informed of significant changes via the Shop's website.
    2. Matters not covered by this Privacy Policy shall be governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and other applicable provisions of Polish law.
    3. This Privacy Policy is effective from August 2, 2026.
    Shopping Cart