1. Data controller
The data controller is Marek Cezary Lisowski store, a Polish sole proprietorship operated by Marek Cezary Lisowski, address: ul. Słoneczna 26, lok. 31, 82-300 Elbląg, Polska, Poland, Tax ID (NIP): 5782869630, email: support@marekcezary.store, phone: +48 579 272 574.
For privacy matters, contact support@marekcezary.store.
2. Data we process
Depending on how you contact us, we may process your name, company name, buyer tax ID, email, phone, delivery address, country, request content, selected products and quantities, delivery preferences, information required for a sales document and correspondence history.
The server may automatically record limited technical data such as IP address, browser type, timestamps and error information where needed for security and website maintenance.
3. Purposes and legal bases
- Handling a request and pre-contract steps — Article 6(1)(b) GDPR.
- Performing a contract, delivery and after-sales contact — Article 6(1)(b) GDPR.
- Tax, accounting and consumer-law duties — Article 6(1)(c) GDPR.
- Website security, legal claims and basic contact records — legitimate interests, Article 6(1)(f) GDPR.
- Electronic marketing — only with separate voluntary consent if introduced.
Providing data is voluntary, but omitting required fields may prevent us from replying or preparing sale terms.
4. Recipients and transfers
Data may be processed by hosting and form providers, email and IT providers, accountants and — after delivery is agreed — logistics providers. Data may be disclosed to public authorities where required by law. Each recipient receives only what is necessary.
Website forms may be technically handled by the Netlify hosting platform or its successor. Where a provider outside the European Economic Area is used, required safeguards such as an adequacy decision or standard contractual clauses are applied where appropriate.
5. Retention
- requests not resulting in a contract — normally up to 12 months after correspondence closes, unless longer retention is needed for claims;
- contract and accounting data — for periods required by tax, accounting and limitation laws;
- security data — for the time needed to detect abuse and investigate incidents;
- consent-based data — until consent is withdrawn, without affecting earlier lawful processing.
6. Your rights
Within the GDPR, you may request access, correction, erasure, restriction, portability, object to processing and withdraw consent. Send requests to the controller’s email. Identity verification may be required.
You may also lodge a complaint with the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or the supervisory authority in your EU country.
7. Profiling and automated decisions
The website does not make solely automated decisions producing legal effects and does not carry out marketing profiling. The request list is stored locally in the user’s browser until removed.
8. Security and updates
The controller uses reasonable technical and organisational measures proportionate to the business, including access controls and an encrypted HTTPS connection after correct deployment. No transmission method can guarantee absolute security.
This policy may be updated when law, website operation or suppliers change. The current date appears at the top.