Data Controller
[NAZWA_FIRMY], [ADRES], Poland. VAT ID: [NIP]. For privacy inquiries, contact us at [email protected].
Data We Collect
| Category | Examples | Legal basis |
|---|---|---|
| Order data | Name, address, email, phone, order details | Contract performance (Art. 6(1)(b) GDPR) |
| Payment data | Processed by Stripe — we do not store card numbers | Contract performance (Art. 6(1)(b) GDPR) |
| Account data | Email, password hash, preferences | Contract performance / Consent (Art. 6(1)(a)/(b) GDPR) |
| Technical data | IP address, browser type, pages visited | Legitimate interest (Art. 6(1)(f) GDPR) |
How We Use Your Data
We use your personal data to fulfill orders and deliver products, manage your account, communicate about orders and your account (including transactional emails), comply with legal obligations (such as tax record-keeping), prevent fraud, and maintain the security of our website.
Third-Party Processors
We share personal data with the following processors who handle data on our behalf:
- Stripe — Payment processing (USA, certified under EU-US Data Privacy Framework)
- Hetzner — Server hosting (Germany)
- Cloudflare — CDN, DNS, and security (EU)
- Resend — Transactional emails (USA, Standard Contractual Clauses)
- Google — OAuth login (USA, certified under EU-US Data Privacy Framework)
- MeiliSearch — Product search engine (self-hosted on our infrastructure)
- Plausible Analytics — Privacy-friendly website analytics (self-hosted on our infrastructure, no cookies, no personal data collection)
Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Access your personal data (request a copy)
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing of your data in certain circumstances (Art. 18 GDPR)
- Export your data in a portable format (JSON)
- Object to processing based on legitimate interest
- Withdraw consent at any time (for consent-based processing)
- Lodge a complaint with the supervisory authority (PUODO, ul. Stawki 2, 00-193 Warsaw, Poland; or your local EU data protection authority)
To exercise your rights, email [email protected]. We respond within 30 days.
Data Retention
Order data: 5 years (tax law). Account data: until deletion request. Technical logs: 90 days. Cookie consent: 12 months.
International Transfers
Stripe (USA) — certified under the EU-US Data Privacy Framework. Other processors: EU-based or subject to adequate safeguards (Standard Contractual Clauses).
Custom Story Submissions
When you submit a custom story request through our form, we collect your name, email address, uploaded image (photo, drawing, or scan), optional story description, and size/finish preferences. This data is processed solely for the purpose of creating a design proposal for a custom steel panel. Legal basis: Art. 6(1)(a) GDPR — your explicit consent given via the form checkbox. Your data is transmitted to our email service provider (Resend) for delivery. If no order is placed, your submission data is retained for a maximum of 90 days and then deleted. You may request erasure of your data at any time by emailing [email protected]. We will process your request within 30 days.
Changes & Contact
We will notify you by email of material changes to this privacy policy. The last update date is shown at the top of this page. For privacy matters, contact us at [email protected].