Documents
Privacy policy
Status
Draft — this document is awaiting legal review and may change before the store opens.
1. Controller. CALBO sp. z o.o., ul. Józefa Piłsudskiego 23, 32-050 Skawina, Poland, KRS 0001081633, NIP 9442286423. Contact: [do uzupełnienia]. [do uzupełnienia]. Pre-launch exception: until Calbo's own payment account is live, test- order payments are received by [do uzupełnienia] via Stripe, which therefore also processes the payment data as [do uzupełnienia].
2. Purposes, legal bases, retention. Contract and delivery — art. 6(1)(b) GDPR, kept until the limitation period ends (generally 6 years, to year-end). Test orders (payment, automatic refund, refund e-mail, founding code) — art. 6(1)(b); limits and fraud prevention — art. 6(1)(f), using IP address, normalised e-mail, a Cloudflare Turnstile token and the card fingerprint provided by Stripe (we never store card numbers), kept for [do uzupełnienia]/[do uzupełnienia]. Tax and accounting — art. 6(1)(c), 5 years from the end of the tax year. Complaints and withdrawals — art. 6(1)(b),(c),(f). Account — art. 6(1)(b), until deletion. Waitlist e-mails — consent, art. 6(1)(a), until withdrawn (double opt-in). Feed-safety reports — art. 6(1)(c),(f). Cookieless statistics (Plausible) and error diagnostics (Sentry, no form contents or card data) — art. 6(1)(f). Legal claims — art. 6(1)(f). No solely automated decisions with legal effect, except the automatic decline of a test order over the limit, whose only effect is a full refund; you can ask for human review. We don't sell data, profile for marketing or use ad pixels.
3. Recipients. Stripe (Stripe Payments Europe, Limited for EEA accounts; processor for payment processing and independent controller for its own legal duties; possible transfers to the US under DPF/SCCs) · Resend, Inc. (US; transactional e-mail; SCCs) · Cloudflare, Inc. (DNS, CDN, WAF, Turnstile, e-mail forwarding; DPF/SCCs) · Plausible Insights OÜ (Estonia; cookieless analytics, IP not stored; EU hosting) · InPost sp. z o.o. (Kraków; carrier, independent controller) · Hetzner Online GmbH (Germany; hosting) · Saleor runs on our own server (no data goes to Saleor Commerce) · Sentry (Functional Software, Inc.; error reports; EU data region; SCCs) · KSeF (only for structured invoices, e.g. on a business's request) · accountants, lawyers, public authorities as required. Ask [do uzupełnienia] for a copy of transfer safeguards.
4. Your rights. Access, rectification, erasure, restriction, portability, objection, withdrawal of consent (arts. 15–21, 7(3) GDPR) and complaint to the Polish supervisory authority, Prezes UODO, ul. Stawki 2, 00-193 Warsaw (art. 77). We answer within one month (art. 12(3)).
5. Cookies. See the cookie policy. 6. Security. HTTPS/HSTS; card data is entered on Stripe's page, not stored by us; admin access behind extra authentication; encrypted backups. 7. Changes. Announced on the site and by e-mail to account holders and subscribers.