Store Privacy Policy

1. Controller and scope

The controller is Miłosz Protyński Services, Polish tax ID (NIP) 8952072726, ul. Małopanewska 18a/5, 54-212 Wrocław, Poland. Contact: [email protected], +48 728 995 991. This document covers pawse.pl, the cart, checkout and order handling. It does not describe processing inside the Pawse mobile app. Visiting the website or purchasing does not grant analytics or advertising consent.

2. Data and sources

Order information includes name, email, telephone, delivery address or collection point, billing and business details provided, products, amounts and payment, delivery and return status. Contact enquiries include sender details and correspondence. Your browser transmits technical connection data; infrastructure may record it in logs, including an IP address. With the relevant consent, we also receive page views and selected actions, browser identifiers, product and campaign information and event values. These data are not anonymous if they can be connected to a person or device.

Data comes from you, your browser and providers fulfilling the order, such as Shopify, the payment provider and carrier. Enter card details in the payment provider’s secure form. Do not email them to us; the store uses transaction confirmations and statuses.

3. Purposes and legal bases

Article 6(1)(b) GDPR: steps you request before purchase and performance of the contract — cart, order, payment, delivery and related communication. Point (c): legal duties, particularly tax, accounting, statutory complaints and withdrawal, and data-rights requests.

Article 6(1)(f) GDPR: legitimate interests in protecting the store against abuse, establishing and defending claims, and answering correspondence unrelated to entering a contract. Point (a): voluntary consent to optional analytics and, separately, measuring and personalising Meta advertising. Refusing or withdrawing consent does not prevent shopping.

4. Providers and recipients

Shopify supplies the cart, checkout and order management. The selected payment provider and carrier, including InPost or DHL, receive data needed to fulfil your order. Authorised hosting, email, technical support and accounting providers may process data as needed for their tasks. We disclose data to public authorities where required by law. Shopify and other providers may also act as independent controllers for their own services and legal duties.

5. Website statistics

Basic server counters count requests by day, UTC hour, language, page category and broad traffic source. We classify campaign parameters or the request referrer into fixed categories such as Meta advertising, search or an unknown source; raw values are not retained in these counters. They do not store IP addresses, full URLs, browser identifiers or cookies, or connect visits by the same person. Infrastructure logs are separate from these counters.

Optional PostHog analytics starts after analytics consent and measures page views and selected actions such as cart changes and continuing to checkout. Session recording and automatic capture of all clicks are disabled. Identifiers may be stored in cookies or browser storage.

6. Meta and advertising

With “Advertising measurement (Meta + Shopify)” consent we use Meta Pixel, server-side Conversions API on the website and Shopify’s Facebook & Instagram integration. This choice includes Shopify analytics required for checkout advertising measurement; it does not enable PostHog. The website sends page views, product views and additions to cart. Shopify handles checkout and purchase events. The browser and server copies of each website event share an identifier to prevent double counting. Meta Platforms Ireland Limited may receive page, product, cart and purchase activity, event value and currency, and online identifiers. Shopify’s integration may transmit contact information for event matching, including hashed information. Hashing does not make personal data anonymous.

Meta may combine this information with data it holds to measure and personalise advertising, including advertising profiling. We do not use this to make decisions with legal or similarly significant effects on you. Website marketing consent does not subscribe you to a newsletter. Meta explains its own purposes, retention and choices in its privacy policy.

7. Refusing and withdrawing consent

Open Cookie settings in the footer to reject optional technologies or choose analytics and marketing separately. Withdrawal stops future website events from the relevant tools. It does not invalidate earlier lawful processing or automatically delete order data needed for contractual and legal duties.

When you next continue to checkout, we pass your current choice to Shopify. For an already-open checkout, also check its privacy settings: changing pawse.pl does not confirm a change in a separately open Shopify page. Choices are specific to the browser and device. See Cookies and privacy choices for browser-storage details.

8. Transfers outside the EEA

Providers may process data outside the European Economic Area. Transfers rely on an applicable European Commission adequacy decision or safeguards such as Standard Contractual Clauses. The EU–US Data Privacy Framework adequacy decision applies only to covered, currently certified US recipients. Contact [email protected] for information about applicable safeguards and how to obtain a copy.

9. Retention

We retain order data for fulfilment, complaints and returns, and thereafter as needed for legal duties and claims. Tax records are generally retained for five years after the end of the year in which tax payment was due, subject to statutory extensions. Data needed for claims are retained until the applicable limitation period ends, usually three or six years depending on the claim, accounting for interruptions or suspensions.

We keep correspondence until the matter is resolved and thereafter only where it documents a legal duty or claim. Cart identifiers and privacy choices remain in browser storage until removed or replaced, as explained in the cookie policy. Withdrawal stops new analytics and advertising events. Contact us about deletion of data already transmitted; independent controllers also apply their own retention and rights procedures.

10. Your rights

Subject to the GDPR, you may access and obtain a copy of your data, correct it, request deletion or restriction, and exercise portability. You may withdraw consent and object to legitimate-interest processing on grounds relating to your situation. You may object to direct marketing, including related profiling, at any time.

Email [email protected]. We may request information needed to verify your identity securely. We normally respond within one month; we will notify you within that period of any legally permitted extension and its reason. Deletion does not always cover legally required records. You may complain to the Polish President of the Personal Data Protection Office (UODO) without first contacting us.

11. Providing data

Providing data is voluntary, but without information required to enter and perform the contract we cannot accept or fulfil an order. Invoice details may be required by law. Additional information and analytics or advertising consent are not conditions of purchase. Do not provide others’ data without a lawful basis, or sensitive information unnecessary for your enquiry.

12. Updates and contact

We publish the current version here with its update date. Changing this document does not grant new consent or extend existing consent. Contact Miłosz Protyński Services about store data at [email protected] or ul. Małopanewska 18a/5, 54-212 Wrocław, Poland.