Privacy policy

This translation is provided for information only. The Polish version is binding.

Effective from 27 October 2026.

§ 1. Data controller

  1. The controller of the personal data of users of the online shop karstyl.pl (the Shop) is Grzegorz Karcz, an entrepreneur conducting business under the name FPHU “Karstyl” Grzegorz Karcz, Spytkowice 572, 34-745 Spytkowice, Poland, NIP (tax ID) 7351259862, REGON 490721381 (the Controller).
  2. In matters concerning personal data protection, the Controller can be contacted by email at karstyl@interia.pl, by telephone at +48 601 836 919 or by post at its business address.
  3. The Controller has not appointed a data protection officer.

§ 2. Data processed

The Controller processes the following personal data:

  1. in connection with an order — first and last name, delivery address, email address, telephone number and, where an invoice is requested, company name and tax ID; payment card details are processed only by the payment provider;
  2. in connection with the newsletter — email address;
  3. in connection with the contact form — first and last name, email address, telephone number and message content;
  4. in connection with the lead-time enquiry form — email address, the Product and variant concerned, quantity and message content;
  5. in connection with the Customer account — email address and the data stored in the account, including order history;
  6. in connection with the chat — the conversation and any data given during it, in particular first name and email address;
  7. in connection with contact by telephone or email — the data provided in the correspondence or conversation;
  8. in connection with use of the Shop — technical data (in particular IP address, browser type, pages visited) collected by cookies and similar technologies to the extent described in § 7.

§ 3. Purposes, legal bases and retention

Purpose of processing Legal basis Retention period
Conclusion and performance of the sales contract Art. 6(1)(b) GDPR until the contract has been performed and then until the limitation period for contractual claims expires
Handling withdrawals and complaints Art. 6(1)(c) GDPR in conjunction with the Polish Consumer Rights Act for the period of liability for the conformity of the Product with the contract and until the limitation period for claims expires
Issuing invoices and keeping accounting records Art. 6(1)(c) GDPR in conjunction with tax and accounting law 5 years from the end of the calendar year in which the tax payment deadline expired
Establishing, pursuing or defending claims Art. 6(1)(f) GDPR (the Controller’s legitimate interest) until the limitation period for claims expires
Handling correspondence, chat, the contact form and lead-time enquiries Art. 6(1)(f) GDPR (the Controller’s legitimate interest in communicating with Customers) and, for enquiries preceding an order, Art. 6(1)(b) GDPR until the matter is closed, and no longer than the limitation period for any claims
Maintaining the Customer account Art. 6(1)(b) GDPR until the account is deleted
Sending the newsletter Art. 6(1)(a) GDPR (consent) until consent is withdrawn
Analytics and marketing using cookies Art. 6(1)(a) GDPR (consent) until consent is withdrawn, and no longer than the lifetime of the cookie concerned

Providing personal data is voluntary but necessary to conclude and perform the sales contract and, for the newsletter, to receive it.

The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the data subject or similarly significantly affect them.

§ 4. Recipients of data

Personal data may be disclosed, to the extent necessary for the purpose concerned, to the following recipients:

  1. Shopify International Limited (Ireland) — provider of the Shop platform, including hosting, order processing, chat (Shopify Inbox) and email delivery;
  2. Stripe Payments Europe, Limited (Ireland) — processing payments within Shopify Payments (payment cards, BLIK, Apple Pay, Google Pay);
  3. Klarna Bank AB (publ) (Sweden) — if Klarna payment is chosen; Klarna processes the data as an independent controller under its own privacy policy;
  4. DPD Polska sp. z o.o. or another delivering carrier — first and last name, delivery address, telephone number and cash-on-delivery amount;
  5. Appfleece, s.r.o. (Jana Palacha 363, 530 02 Pardubice, Czech Republic) — provider of the Payflow app, which controls the selection of payment and delivery methods in the order form;
  6. the email service provider (Interia) — for correspondence with the Controller;
  7. public authorities — where required by law.

Processors handle the data on the Controller’s behalf under data processing agreements. Carriers and payment providers may process the data as independent controllers.

§ 5. Transfers outside the European Economic Area

Shopify, Stripe (within Shopify Payments) and sub-processors of Appfleece, s.r.o. (provider of the Payflow app) may transfer personal data outside the European Economic Area, in particular to Canada and the United States. The European Commission has adopted an adequacy decision for Canada. Transfers to the United States are based on the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission. A copy of the safeguards can be obtained from the Controller.

§ 6. Rights of data subjects

  1. The data subject has the right:
    1. of access to their data and to receive a copy;
    2. to rectification of the data;
    3. to erasure of the data;
    4. to restriction of processing;
    5. to data portability — for data processed on the basis of a contract or consent;
    6. to object to processing based on the Controller’s legitimate interest;
    7. to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
  2. To exercise these rights, contact the Controller at karstyl@interia.pl.
  3. The data subject has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

§ 7. Cookies and similar technologies

  1. Cookies are small text files stored on the user’s device. The Shop uses cookies and similar technologies (pixels) in the following categories:
    1. necessary — required for the Shop to work properly (in particular the cart, the order form and remembering cookie settings); their use does not require consent;
    2. preferences — allow settings to be remembered, in particular the selected language;
    3. analytics — used to compile statistics on use of the Shop (Shopify statistics) and to analyse the ordering process (the Payflow app pixel, run in the order form);
    4. marketing — used to measure the effectiveness of marketing activities. The Shop does not currently use third-party advertising tools (in particular Meta or Google); if they are introduced, this Privacy Policy will be updated accordingly.
  2. Cookies other than necessary ones are stored only with consent. Consent can be changed or withdrawn at any time in the cookie settings available in the Shop.
  3. The user may also delete or block cookies in their browser settings, which may, however, limit the functionality of the Shop.

§ 8. Changes to the Privacy Policy

The Controller announces changes to the Privacy Policy by updating its effective date. Newsletter subscribers are informed of significant changes by email.