Privacy Policy

§ 1. Personal Data Controller

The personal data controller is A Design Anna Kawalec, ul. Angielska 3, 63-500 Ostrzeszów, Tax ID (NIP): 514-028-10-71 (hereinafter: "the Controller").

To contact the Controller regarding personal-data protection matters:

  • e-mail: pufoswiat@gmail.com
  • correspondence address: ul. Angielska 3, 63-500 Ostrzeszów

§ 2. Scope of Data Collected

The Controller collects personal data provided voluntarily by the Customer in connection with using the Shop, in particular:

  • first name and surname,
  • delivery address,
  • e-mail address,
  • phone number,
  • invoicing data (company name, tax ID, address) — if the Customer requests a VAT invoice.

§ 3. Purposes and Legal Bases for Processing

The Controller processes Customers' personal data for the following purposes:

  1. Order fulfilment and performance of the sales contract — pursuant to Art. 6(1)(b) GDPR (processing necessary for the performance of a contract). This includes: accepting and handling the order, delivering the Goods, issuing a sales document, handling returns and complaints.
  2. Fulfilment of legal obligations — pursuant to Art. 6(1)(c) GDPR. This includes: maintaining accounting and tax records, fulfilling obligations under the Consumer Rights Act.
  3. Legitimate Interest of the Controller — pursuant to Art. 6(1)(f) GDPR. This includes: pursuing or defending against claims, conducting web analytics to improve the Shop.
  4. Client's Consent — pursuant to Art. 6(1)(a) GDPR. This includes: sending newsletters and commercial information by electronic means, marketing activities. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.

Providing personal data necessary to place and fulfil an order is voluntary but required for concluding and performing the sales contract. Failure to provide such data makes it impossible to process the order. Providing data for marketing purposes is entirely voluntary.

§ 4. Recipients of Data

Customers' personal data may be shared with the following categories of recipients, only to the extent necessary for the given purpose:

Courier and logistics companies (scope: first name, surname, delivery address, telephone number, e-mail address — shared in the form of a shipping label / waybill constituting a delivery instruction):

  • DPD Polska sp. z o.o.,
  • InPost sp. z o.o. (including InPost parcel-locker services).

Payment operators (scope: data necessary to process the payment transaction):

  • PayU S.A.,
  • PayPal (Europe) S.à r.l. et Cie, S.C.A.

Other entities:

  • hosting and IT service providers supporting the Shop,
  • the accounting firm cooperating with the Controller,
  • public authorities — only where disclosure is required by law.

The amount of data shared is limited to the necessary minimum in each case.

§ 5. Transfer of data to third countries

Personal data may be transferred outside the European Economic Area in connection with the use of PayPal services. Such transfers are based on appropriate safeguards provided for in the GDPR, in particular standard contractual clauses or European Commission adequacy decisions.

§ 6. Data Retention Period

  • Data related to order fulfilment — for the duration of the contract and subsequently for the limitation period for civil-law claims (as a rule, 6 years from the end of the calendar year in which the claim became due).
  • Accounting and tax data — for a period of 5 years from the end of the calendar year in which the tax payment deadline expired.
  • Data processed on the basis of consent (e.g. newsletter) — until consent is withdrawn.
  • Data processed for the purpose of a legitimate interest — until an effective objection is raised or the purpose of processing ceases.

§ 7. Client Rights

Every Customer whose personal data are processed has the right to:

  1. access to your personal data (Art. 15 GDPR),
  2. rectification rectification of inaccurate data or supplementation of incomplete data (Art. 16 GDPR),
  3. erasure of data — the "right to be forgotten" (Art. 17 GDPR), where no other legal basis for further processing exists,
  4. restriction of processing of data (Art. 18 GDPR),
  5. portability of data to another controller (Art. 20 GDPR),
  6. objection to processing based on the Controller's legitimate interest (Art. 21 GDPR),
  7. withdrawal of consent at any time — without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

To exercise the above rights, please contact the Controller at the e-mail address: pufoswiat@gmail.com or in writing to the registered office address.

The Customer also has the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl), if the Customer considers that the processing of personal data infringes the GDPR.

§ 8. Automated Decision-Making

The Controller does not make decisions based solely on automated processing of Customers' personal data, including profiling within the meaning of Art. 22 GDPR.

§ 9. Cookies

  1. The Shop uses cookies, i.e. small text files stored on the Customer's device (computer, phone, tablet) while using the Shop.

  2. The Shop uses the following types of cookies:

    Necessary — ensure the proper functioning of the Shop, including the shopping cart, the ordering process and cookie-consent management. They do not require the Customer's consent.

    Analytical — allow measuring website traffic, analysing how the Shop is used and which products are viewed most often, in order to improve the Shop's performance. They require the Customer's consent.

    Functional — allow the Shop to remember the Customer's chosen settings and personalise the interface. They require the Customer's consent.

    Marketing/Advertising — enable the display of personalised advertising content. They require the Customer's consent.

  3. On the first visit to the Shop, an information banner is displayed allowing the Customer to grant or refuse consent for individual cookie categories. The Customer may change cookie preferences at any time.

  4. The Customer may also manage cookies through their web-browser settings, including blocking their storage. Restricting the use of cookies may affect the availability of certain Shop features.

  5. Detailed information about the cookies used (names, storage period, purpose) is available in the consent-management panel on the Shop's website.

§ 10. Final provisions

  1. The Controller reserves the right to amend this Privacy Policy. Customers will be informed of significant changes via the Shop's website.
  2. Matters not covered by this Privacy Policy shall be governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and other applicable provisions of Polish law.
  3. This Privacy Policy is effective from August 2, 2026.
Shopping Cart