Privacy policy

Privacy Policy

In force from 1 August 2026. This policy explains what personal data we collect at palkdot.com, why, on what legal basis, who we share it with and what you can do about it. It is written under Regulation (EU) 2016/679 (GDPR / RODO).

1. Who is the controller of your data

The controller is:

Mikita Rusak Dev
Plac Hallera 5/22, 03-464 Warszawa, Poland
NIP: 1133074179, REGON: 523367477
E-mail: shop@palkdot.com
Phone: +48 511 421 615

We have not appointed a Data Protection Officer. In any matter concerning your data, write to the address above — that mailbox is read by the owner of the business.

2. What data we collect

  • Order data — first and last name, delivery address, billing address, e-mail address, phone number, order contents, order value, payment method, order history.
  • Billing data — the data needed on an invoice, including a company name and NIP if you ask for a company invoice.
  • Correspondence — whatever you write to us and whatever we write back, including complaint and withdrawal files and the photographs you attach.
  • Newsletter data — e-mail address, if you subscribe.
  • Technical data — IP address, browser and device type, operating system, referring page, pages viewed, time on site, cookie identifiers.

We do not collect or store your payment card number, CVV or bank credentials. Those go straight to the payment operator (section 5).

3. Why we process it and on what basis

Purpose Legal basis How long
Concluding and performing the sales contract — processing the order, delivery, contact about the order Art. 6(1)(b) GDPR — performance of a contract Until the contract is performed, then for the limitation period for claims (up to 6 years)
Issuing and keeping invoices, tax and accounting obligations Art. 6(1)(c) GDPR — legal obligation (Polish Accounting Act, Tax Ordinance) 5 years from the end of the tax year in which the invoice was issued
Handling withdrawals and complaints Art. 6(1)(c) GDPR — legal obligation under the Consumer Rights Act Until the case is closed, then for the limitation period for claims
Establishing, pursuing or defending claims Art. 6(1)(f) GDPR — our legitimate interest Until claims are time-barred
Answering messages that are not about an order Art. 6(1)(f) GDPR — our legitimate interest in replying to you Up to 12 months from the last message
Sending the newsletter Art. 6(1)(a) GDPR — your consent Until you withdraw consent or unsubscribe
Site analytics and advertising measurement Art. 6(1)(a) GDPR — your consent given in the cookie banner Until consent is withdrawn, no longer than the cookie lifetime in section 7
Security of the store, fraud prevention Art. 6(1)(f) GDPR — our legitimate interest Up to 12 months

Providing data is voluntary, but without order and delivery data we cannot conclude or perform a sales contract, and without billing data we cannot issue an invoice.

4. Who we share it with

We do not sell personal data. We share it only with entities that need it to do work for us, and only to the extent needed:

  • Shopify International Ltd. — the platform on which this store runs, hosting and order processing.
  • Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland (company number 560279) — payment processing under Shopify Payments, for card, BLIK, Bancontact, MobilePay, Klarna, Shop Pay, Apple Pay and Google Pay.
  • PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, KRS 0000347935, NIP 7792369887 — payment processing for payments made through Przelewy24. PayPro is a separate controller of the data you give it when paying.
  • Carriers — InPost S.A., DPD Polska sp. z o.o., GLS Poland sp. z o.o., UPC, and the equivalent carriers for deliveries outside Poland, to the extent needed to deliver your parcel.
  • Our accounting service — inFakt sp. z o.o., for issuing and keeping invoices.
  • E-mail and analytics providers — the providers of the store's mailing and traffic-measurement tools, including Google (Google Analytics, Google Ads), where you have consented.
  • Public authorities — where the law obliges us to disclose data.

5. Payments

The store uses two payment operators, and which one handles your payment depends on the method you choose at checkout: Shopify International Limited (Shopify Payments) or PayPro S.A., operator of Przelewy24 and a national payment institution supervised by the Polish Financial Supervision Authority (entry IP24/2014). The operator is identified on the payment screen before you confirm.

In both cases you enter your payment details on the operator's page, not on ours. We receive only the result of the transaction and the data needed to match the payment to the order. Each operator processes your data as a separate controller under its own privacy notice — Shopify's at shopify.com, PayPro's at przelewy24.pl.

6. Transfers outside the European Economic Area

Some of our providers — Shopify and Google among them — process data on servers outside the EEA, including in the United States. Such transfers take place on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision covering the recipient. You may ask us for a copy of the safeguards used, at the address in section 1.

7. Cookies

  1. The store uses cookies — small text files stored on your device.
  2. Necessary cookies keep the cart, the session, the chosen language and currency, and the security of the checkout. They are used on the basis of Art. 6(1)(f) GDPR and cannot be switched off, as the store would not work without them.
  3. Analytics and marketing cookies measure traffic and the effectiveness of advertising. They are used only after you consent in the cookie banner, and you can withdraw that consent at any time from the same banner or from your privacy choices page.
  4. You can also block or delete cookies in your browser settings. Blocking the necessary ones will break the cart and checkout.
  5. Cookie lifetimes range from the length of a browsing session to 24 months, depending on the cookie.

8. Your rights

Under the GDPR you have the right to:

  • access your data and receive a copy of it (Art. 15);
  • rectify data that is wrong or incomplete (Art. 16);
  • erase your data, where we no longer need it and no legal obligation requires us to keep it (Art. 17);
  • restrict processing (Art. 18);
  • data portability — receive the data you gave us in a machine-readable format, or have it sent to another controller (Art. 20);
  • object to processing based on our legitimate interest, including profiling for direct marketing (Art. 21);
  • withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3)).

To exercise any of these, write to shop@palkdot.com. We answer within one month; if a request is complex we may extend that by two further months and will tell you why. Exercising your rights is free of charge.

9. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with:

Prezes Urzędu Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl

If you live in another EU or EEA country, you may also complain to your local supervisory authority.

10. Automated decisions and profiling

We do not take decisions about you that produce legal effects or similarly significantly affect you based solely on automated processing. Where you consent to marketing cookies, advertising you see may be selected automatically on the basis of pages you have viewed; this has no legal effect on you and you can object at any time.

11. Children

The store is not addressed to children. We do not knowingly collect data of persons under 16. If you are a parent or guardian and believe your child has given us data, write to us and we will delete it.

12. Security

The store runs over an encrypted connection (SSL/TLS). Access to order data is limited to the owner of the business and to the providers listed in section 4, each bound by a data processing agreement. No method of transmission is perfectly secure — please do not send us documents or payment details by e-mail.

13. Changes to this policy

We may update this policy when the law, our tools or the way the store works change. The current version is always on this page with the date it entered into force. Material changes affecting consent-based processing are announced before they take effect.

14. Contact

Any question about your data: shop@palkdot.com, or Mikita Rusak Dev, Plac Hallera 5/22, 03-464 Warszawa, Poland.