Privacy Policy – Ciechorski Rough Jewellery

1. Data controller

The controller of personal data is Michał Ciechorski, conducting non-registered business activity under Article 5 of the Polish Entrepreneurs’ Law Act of 6 March 2018.

Address: ul. Śląska 35/30, 80-379 Gdańsk, Poland.
Workshop: ul. Wassowskiego 16, 80-225 Gdańsk, Poland.
Email: ciechorski.jewellerystudio@gmail.com
Phone: +48 500 466 776

The controller applies appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access or use.

2. Purposes and legal bases for processing

Personal data is processed in particular for:

order fulfilment – to the extent necessary to conclude and perform the contract, including name, delivery address, email address, telephone number and order and payment information; legal basis: Article 6(1)(b) GDPR;
compliance with legal obligations, in particular tax and accounting obligations; legal basis: Article 6(1)(c) GDPR;
handling enquiries, messages and contact forms – to the extent necessary to respond; legal basis: Article 6(1)(f) GDPR and, where the contact leads to a contract, Article 6(1)(b) GDPR;
handling returns and complaints – to the extent necessary to comply with legal obligations and establish, exercise or defend against claims; legal basis may be Article 6(1)(c) or (f) GDPR.

3. Data retention

Personal data is retained for no longer than necessary for the purpose for which it was collected, taking into account applicable legal obligations and limitation periods for claims.

Sales and tax documentation is retained for the period required by applicable tax and accounting regulations.

Data relating to contracts, returns, complaints and claims may be retained for as long as necessary to establish, exercise or defend against claims.

4. Recipients of data

Personal data may be disclosed to service providers supporting the operation of the Shop and fulfilment of orders, including:

CyberFolks S.A. – hosting and technical services;
Google Ireland Limited and relevant Google entities – technical and email services, where used;
InPost – delivery services;
DPD Polska – delivery services;
Poczta Polska – delivery services;
CashBill S.A. based in Katowice (ul. Sobieskiego 2, 40-082 Katowice, Poland, NIP: 6292410801, REGON: 241048572, KRS: 0000323297) – processing, fulfilment and security of electronic payments and BLIK payments;
providers of shop software and auxiliary tools;
an accounting office or accounting software provider, where used.

Such entities receive data only to the extent necessary to perform their services.

5. Payments

Where electronic payment is selected, data necessary to process the transaction may be transferred to the payment service provider. The controller does not store payment card details where these are handled by an external payment provider.

6. Data subject rights

Subject to the GDPR, data subjects have the right to:

access their personal data;
obtain a copy of their data;
rectify inaccurate data;
erase their data;
restrict processing;
data portability;
object to processing based on the controller’s legitimate interests.

Data subjects also have the right to lodge a complaint with the President of the Polish Data Protection Authority (UODO).

7. Voluntary provision of data

Providing data necessary to conclude and perform a contract is voluntary, but failure to provide such data may prevent an order from being placed or fulfilled. Providing data when contacting the Shop is voluntary, but may be necessary to receive a response.

8. Automated decision-making

Personal data is not used for decisions based solely on automated processing, including profiling, which produce legal effects concerning a person or similarly significantly affect them.

9. Transfers outside the EEA

As a general rule, personal data is processed within the European Economic Area. If the use of a particular service provider involves a transfer of data outside the EEA, the controller ensures that an appropriate GDPR-compliant transfer mechanism is used, such as an adequacy decision or standard contractual clauses, where required.

10. Cookies

The Shop uses cookies necessary for the proper operation of the website, session handling, the shopping cart and the ordering process.

Depending on the Shop’s configuration, analytical or marketing cookies may also be used. Where consent is required, such cookies are activated only after consent has been obtained.

Users may also change cookie settings in their browser. Restricting cookies necessary for the operation of the Shop may affect its functionality.