Privacy policy (GDPR) - Grawerstwo Józef Kardyś

Template / placeholder. A working draft for layout. Adapt to your actual data flows, tools and processors, and have it reviewed before publishing.

1Data controller

The controller of your personal data is Grawerstwo Józef Kardyś, ul. Hetmańska 30a, 39-300 Mielec, NIP 000-000-00-00. Contact in data matters: [email protected].

2What data we collect

Order data: name, address, e-mail, phone, engraving content and files you upload.
Billing data for invoices: company name, NIP, address.
Technical data: IP address, cookies, basic analytics.

3Purposes & legal basis

Performing the sales contract - Art. 6(1)(b) GDPR.
Tax and accounting obligations - Art. 6(1)(c) GDPR.
Handling enquiries and the newsletter - consent, Art. 6(1)(a) GDPR.
Legitimate interest (claims, security) - Art. 6(1)(f) GDPR.

4Data recipients

Data may be shared with processors supporting the shop: payment operator (e.g. Przelewy24), courier companies, hosting and accounting providers - only to the extent necessary.

5Retention period

Order data is kept for the duration of the contract and for the period required by tax law (generally 5 years). Newsletter data - until consent is withdrawn.

6Your rights

Accessto your data and a copy of it

Rectificationof incorrect data

Erasure“right to be forgotten”

Restrictionof processing

Portabilityof your data

Objectionand withdrawal of consent

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

7Cookies

The site uses cookies necessary for its operation and, with your consent, analytics cookies. You can manage cookies in your browser settings.

8Newsletter

Signing up to the newsletter is voluntary and based on consent (double opt-in). You can unsubscribe at any time via the link in each message.

9Security & contact

We apply appropriate technical and organisational measures to protect your data. In any data matter, write to [email protected].