Privacy policy

Data Controller Information

1. Scope of This Policy

2. Personal Data We Collect & Legal Basis for Processing

2.1 Data collected during checkout & account creation

• Full name, delivery/billing address, postal code, phone number, email address
• Order records: item names, SKUs, purchase amounts, payment receipts, delivery tracking numbers
• Account credentials: encrypted login email and password
  
  
  Legal bases:

1. Performance of sales contract (GDPR Art.6(1)(b)) – required to process orders, ship goods, and handle returns/refunds
2. Legal obligation (GDPR Art.6(1)(c)) – tax and accounting record retention per Polish fiscal law

2.2 Voluntary marketing data

• Email subscription status, preference for women’s fashion updates, discount newsletters
  
  
  Legal basis: Explicit, revocable consent (GDPR Art.6(1)(a)). You may opt out of marketing emails at any time.

2.3 Technical website data (automatic collection)

• IP address, device type, browser version, operating system, page browsing history, click behaviour, session duration
• Cookie and tracking identifiers (analytics & advertising pixels)
  
  
  Legal bases:

1. Legitimate interest (GDPR Art.6(1)(f)): website performance analysis, fraud prevention, service optimisation
2. Consent for non-essential analytics/marketing cookies (GDPR Art.6(1)(a))

2.4 Customer support communication data

3. Purposes We Use Your Personal Data

1. Complete order fulfilment: payment verification, packaging, courier delivery, tracking updates
2. Process returns, exchanges, refunds and 2-year statutory warranty claims under Polish consumer law
3. Respond to customer service emails, phone calls and dispute resolutions
4. Send order confirmations, shipping alerts, return status notifications (transactional emails, no opt-out required)
5. Deliver fashion newsletters, exclusive promotions and restock alerts (only if you tick the marketing consent box)
6. Website analytics: monitor traffic, improve product page layout, adjust women’s clothing inventory
7. Detect and prevent fraudulent orders, unauthorised account access and payment scams
8. Comply with Polish tax, accounting and data retention legal requirements
9. Defend our legal rights in case of commercial disputes

4. Data Retention Periods

• Order, payment and delivery data: stored for 5 full years after the final order completion date (mandatory Polish fiscal retention rule)
• Registered customer account data: retained until you submit a full account deletion request
• Marketing email subscription data: stored until you withdraw consent or unsubscribe
• Website technical log data (IP, session records): automatically erased after 12 months
• Support chat/call records: stored for 24 months post-enquiry to resolve follow-up claims
  
  
  Once retention periods expire, all personal data is securely anonymised or permanently deleted from our servers.

5. Third Parties We May Share Your Data With

1. Shopify E-commerce Platform: hosts our store, processes checkout and stores order data
2. Payment service providers: secure transaction handling for card, bank and digital wallet payments
3. Polish courier/logistics companies: receive your delivery address to ship apparel orders
4. Email marketing tools: send newsletters only to opted-in customers
5. Analytics providers (Google Analytics): track anonymous website traffic with cookie consent controls
6. Legal and tax advisors: limited data disclosure to meet Polish statutory compliance duties
   
   
   All third-party processors implement EU-standard data security measures. Where data transfers outside the EEA occur, we rely on EU Standard Contractual Clauses to guarantee adequate protection.

6. Cookie & Tracking Technologies

1. Strictly necessary cookies (no consent required): shopping cart storage, account login, checkout security functions – cannot be disabled without breaking website functionality
2. Analytical cookies (consent required): measure page visits, product click rates, user browsing patterns
3. Marketing/retargeting cookies (consent required): display tailored women’s fashion ads on external platforms
   
   
   You may adjust cookie preferences via our pop-up consent banner upon first site visit, or clear browser cookies manually at any time. Disabling non-essential tracking will not block core shopping functions.

7. Your GDPR Data Subject Rights

1. Right to Access: Request a full copy of all personal data we store about you
2. Right to Rectification: Correct outdated or incorrect contact, address or order information
3. Right to Erasure (“Right to be Forgotten”): Request full deletion of your account and all personal records (excluding data we must retain for tax law)
4. Right to Restriction of Processing: Suspend data use during disputes or data accuracy checks
5. Right to Data Portability: Receive your order/contact data in a machine-readable format to transfer to another retailer
6. Right to Object: Opt out of marketing emails and processing based on legitimate interest at any time
7. Right to Withdraw Consent: Revoke marketing or analytics cookie consent with immediate effect
8. Right to Lodge a Complaint: Submit a formal grievance to UODO (Poland’s data protection authority) if you believe we violate data protection rules

How to Submit a Data Rights Request

8. Data Security Measures

• End-to-end SSL/TLS encryption for all website traffic and checkout payments
• Encrypted storage of customer payment details (we do not store full credit card numbers)
• Restricted staff access to personal data with individual login permissions
• Regular security audits, malware scanning and password protection protocols
• Secure permanent deletion process for expired customer records
  
  
  In the unlikely event of a personal data breach posing risk to your privacy, we will notify you and UODO within 72 hours per GDPR breach notification rules.

9. Minors’ Data Protection

10. Policy Updates

11. Contact for All Privacy Enquiries