Shop privacy policy — beta

DRAFT FOR REVIEW BEFORE LAUNCH. Requires confirmation by the data controller.

Controller

Willa Słoneczna sp. z o.o., ul. Słoneczna 16, 43-426 Dębowiec, Poland, tax number 5482755342. Data enquiries: biuro@willasloneczna.pl (contact to be confirmed).

Data and purposes

We process account and order details: name, e-mail, phone, optional delivery address, company billing details, order and payment information. Tickets may include participant details and attendance. We also record language, document acceptance, communication history and technical security information. Do not submit sensitive information in additional answers unless the organiser provides a separate procedure for collecting it.

Accounts, orders and operational communication rely on performance of a contract or steps before entering it (GDPR Article 6(1)(b)). Accounting and tax obligations rely on law (c). Security, fraud prevention and legal claims rely on legitimate interests (f). Optional marketing requires separate consent (a); refusal does not prevent a purchase, and consent can be withdrawn.

Recipients and security

Authorised staff and necessary service providers may receive data: hosting and e-mail services, Tpay, SMSAPI, Fakturownia when invoicing is enabled, and carriers for shipped orders. Cloudflare Turnstile is used when form protection is enabled. Disclosure is limited to each service's purpose. Camera QR decoding runs on the device; images are not sent to the server.

Retention

Account data is retained while the account is operated; after closure, only as needed for legal obligations or claims. Accounting records are kept for statutory tax retention periods, and claims-related information until applicable limitation periods expire. Consent-based marketing ends on withdrawal. Specific deletion periods for logs, attendance and unverified submissions must be added before launch.

Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, or object to processing based on legitimate interests. Withdrawing consent does not affect earlier lawful processing. You may complain to the Polish UODO or another competent supervisory authority. Providing required order data is voluntary but necessary to fulfil the order; optional fields are marked.

Review required

Confirm providers and roles, processing agreements, any transfers outside the EEA and safeguards, retention periods, profiling or automated decision-making, and cookies and analytics. This draft does not confirm unverified transfers or external service settings.