Privacy Policy

Draft policy. This is a starting template, not legal advice. Have it reviewed against GDPR by a Polish lawyer and complete every [TO ADD] item before taking live orders.

Who we are

The data controller for personal data collected through this store is:

[TO ADD: registered business name]
[TO ADD: full registered address]
[TO ADD: NIP]
Email: contact@reforium.com

What we collect

When you order: your name, email address, delivery and billing address, phone number, and order details. Payment card details are handled by our payment provider. We never see or store them.
When you contact us: your email address and whatever you write to us.
When you subscribe: your email address.
Automatically: your IP address, browser and device information, and pages viewed, via cookies and similar technologies.

Why we use it, and on what legal basis

To fulfil your order: performance of a contract. Without this data we cannot ship to you.
To handle returns, refunds and support: performance of a contract and our legal obligations.
To meet accounting and tax obligations: legal obligation under Polish law.
To send marketing emails: your consent, which you may withdraw at any time via the unsubscribe link in any email.
To detect fraud and keep the store working: our legitimate interests.

Who we share it with

We share personal data only with parties who need it to do their job for us:

Shopify hosts this store and processes orders.
Payment providers. [TO ADD: name them, e.g. Shopify Payments, PayPal, Przelewy24.]
Our fulfilment partner and shipping carriers deliver your order. Because our products ship from Asia, your name and delivery address are transferred outside the European Economic Area for this purpose. [TO ADD: name your supplier and confirm the safeguards relied on, typically Standard Contractual Clauses.]
Email and analytics providers. [TO ADD: name them if used.]

We do not sell your personal data.

How long we keep it

Order and invoice records are kept for 5 years from the end of the tax year, as required by Polish accounting law. Marketing consent records are kept until you withdraw consent, and for a short period afterwards to prove the withdrawal was honoured. Support correspondence is kept for 2 years.

Your rights

Under GDPR you have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. To exercise any of these, email contact@reforium.com. We respond within one month.

If you believe we have handled your data improperly, you may complain to the Polish data protection authority, the Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa.

Cookies

We use cookies that are necessary for the store to function, such as remembering your cart and keeping you logged in, and, where you consent, cookies for analytics and marketing. You can manage non-essential cookies through the banner shown on your first visit, and clear all cookies through your browser settings.