Privacy Policy of the Stary Drukuje Online Store

1. General Information

1.1. This Privacy Policy applies to the website operating at:
https://starydrukuje.pl
(hereinafter referred to as the “Website”).

1.2. The data controller is: Sara Setlak operating a business under the name
Stary Drukuje,
Kuyavian-Pomeranian Voivodeship, Świecie County, Świekatowo Municipality, Świekatowo, Stawowa Street, no. 3, 86-182,
NIP: 5543031763, REGON: 540573143,

email:
starydrukuje@gmail.com,

Tel.:
+48 790 362 100
(hereinafter referred to as the “Controller” or “Seller”).

1.3. Contact for personal data matters:
starydrukuje@gmail.com.

1.4. The Controller processes data in accordance with Regulation (EU) 2016/679 (GDPR) and national regulations.

2. Scope, Purposes, and Legal Basis for Data Processing

2.1. We process data voluntarily provided on the Website and data collected automatically (cookies, logs).

2.2. Data categories:

identification and contact data (e.g., name and surname, email, phone, delivery/billing address),
billing data (e.g., Tax ID for invoice),
order data (including technical parameters and dimensions necessary for the production of individual 3D prints),
payment data processed by the payment operator (PayU) – the Controller receives payment confirmation, but does not store full card data,
technical data (IP address, cookie identifiers, browser data).

2.3. Purposes and legal bases:

order / contract fulfillment (Art. 6(1)(b) GDPR),
handling complaints and claims, accounting, taxes (Art. 6(1)(c) GDPR),
contact via form / email / phone (Art. 6(1)(b) or (f) GDPR – legitimate interest: handling inquiries),
own marketing (e.g., newsletter, if implemented) – only with consent (Art. 6(1)(a) GDPR), with the possibility of withdrawal at any time,
traffic analysis, security, statistics, claims pursuit (Art. 6(1)(f) GDPR).

2.4. Data required for order fulfillment is necessary for the conclusion and performance of the contract; without providing them, the order will not be possible.

2.5. Registering an account on the Website or making a purchase signifies consent to receive electronically
marketing information regarding products or services available on the Website, especially those
related to the placed order (e.g., accessories, parts compatible with purchased items, promotions, or offer updates).
This consent may be withdrawn at any time.

3. Data Recipients

3.1. We may transfer data only to the extent necessary for the purposes outlined in point 2:

payment operator: PayU S.A. (electronic payment processing),
carriers: DHL and InPost (delivery fulfillment),
IT/hosting/service companies (maintenance and security of the Website),
accounting office, law firms (performance of legal obligations and defense of claims),
authorized employees/collaborators of the Controller.

3.2. Data is generally not transferred outside the EEA. Should such a transfer occur (e.g., cloud tools), the Controller will ensure appropriate safeguards (including standard contractual clauses).

4. Data Retention Period

order and billing data – until the expiry of the limitation periods for claims and tax-accounting obligations (generally 6 years from the end of the financial year),
correspondence – for the period necessary to provide a response and demonstrate proper handling,
marketing data – until consent is withdrawn,
technical data/logs – in accordance with the security policy and system retention.

5. Rights of Data Subjects

You have the right to: access data, rectify them, erasure (“to be forgotten”), restriction of processing,
data portability, object to processing (including direct marketing). You have the right to lodge a complaint with
President of the Personal Data Protection Office (UODO) (Stawki Street 2, 00-193 Warsaw). We process requests at:
starydrukuje@gmail.com.

6. Automated Decision-Making and Profiling

We do not make decisions producing legal effects concerning you solely by automated means.
We may conduct basic analysis of purchases/cookies to tailor content (marketing with consent).

7. Security

We apply, among others, transmission encryption (SSL), access control, pseudonymization of design data (dimensions/parameters),
regular system updates and backups.

8. Cookies and Analytics

The rules for using cookies are described in a separate document
Cookie Policy available on the Website.

9. Policy Changes

The current version is published on the Website. Significant changes will be communicated transparently
(e.g., a notice on the Website or email).