DATA CONTROLLER

The controller of your personal data is Piotr Kolasa, conducting sales under the Kvazi brand as an an unregistered business activity - pursuant to Art. 5 of the Polish Act of 6 March 2018 — Entrepreneurs’ Law (działalność nierejestrowana — Art. 5 of the Polish Law on Entrepreneurs, Journal of Laws 2024, item 236), contact address: ul. Fabryczna 2, 45-349 Opole, Poland.

For matters concerning personal data, contact us at [email protected].

PURPOSES AND LEGAL BASIS FOR PROCESSING

We process your personal data for the following purposes:

Performance of the sales contract — processing necessary to perform the contract concluded with you or to take steps at your request prior to its conclusion (Art. 6(1)(b) GDPR). The data includes your name and surname, delivery address, phone number, e-mail address, and transactional data transmitted via Stripe.

Analytics on site traffic — processing is performed on the basis of your voluntary consent (Art. 6(1)(a) GDPR), expressed in the cookies banner. We use Google Analytics 4 to analyse user behaviour for the purpose of improving the service. You may withdraw your consent at any time.

Contact and answering enquiries — processing is based on our legitimate interest in communicating with persons who contact us (Art. 6(1)(f) GDPR).

Handling of withdrawal declarations — processing necessary to comply with a legal obligation on the controller (Art. 6(1)(c) GDPR), arising from the Polish Act of 30 May 2014 on Consumer Rights (Arts. 27-32), in connection with your statutory right to withdraw from a distance contract.

Handling of complaints (statutory warranty) — processing necessary to comply with a legal obligation on the controller (Art. 6(1)(c) GDPR), arising from the statutory-warranty provisions of the Polish Civil Code (Arts. 556-576).

RETENTION PERIODS

We retain order data — including the content of withdrawal declarations and complaint (statutory-warranty) records — for 5 years, counted from the end of the calendar year in which the tax payment deadline for the given order expired, until the tax obligation becomes time-barred (Art. 86 § 1 in conjunction with Art. 70 § 1 of the Ordynacja podatkowa / Polish Tax Ordinance).

Data processed for analytics purposes is retained for at most 26 months from the date of collection or until you withdraw your consent to analytics processing — whichever occurs first.

We retain e-mail correspondence for up to 3 years from the date of the last exchange, unless you ask for its earlier deletion.

DATA SUBJECT RIGHTS

You have the following rights in relation to the processing of your personal data:

Right of access (Art. 15 GDPR) — you may obtain confirmation as to whether we process your data, and if so, gain access to it and information about its processing.

Right to rectification (Art. 16 GDPR) — you may request the prompt correction of incorrect data or completion of incomplete data.

Right to erasure (Art. 17 GDPR) — you may request the deletion of data in the cases provided for by GDPR (e.g. when the data is no longer necessary for the purposes for which it was collected).

Right to restriction of processing (Art. 18 GDPR) — you may request restriction of processing in specific situations, e.g. when you contest the accuracy of the data.

Right to data portability (Art. 20 GDPR) — you may receive your data in a structured format and transmit it to another controller, where the processing is based on a contract or consent.

Right to object (Art. 21 GDPR) — you may object to processing based on our legitimate interest. After receiving an objection, we will cease processing unless we demonstrate compelling legitimate grounds overriding your interests.

Right to withdraw consent (Art. 7(3) GDPR) — if processing is based on consent (e.g. analytics), you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise the above rights, write to: [email protected]. We will respond without undue delay, and in any event within one month (Art. 12(3) GDPR).

RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with the supervisory authority competent for personal data protection in Poland — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

More information about how to lodge a complaint is available at: https://uodo.gov.pl.

DATA RECIPIENTS AND TRANSFERS OUTSIDE THE EEA

Your data may be shared with the following recipients:

Google LLC (USA) — the provider of Google Analytics 4, which we use to analyse traffic on the site. Data transfer to the USA is performed on the basis of Standard Contractual Clauses approved by the European Commission and under the Data Privacy Framework (DPF). Analytics data is processed only after you give consent.

Stripe Payments Europe Ltd (Ireland) — the payment processor through which transactions are made. Stripe may transfer data to Stripe, Inc. (USA) on the basis of Standard Contractual Clauses. The processing is necessary to perform the sales contract.

furgonetka.pl sp. z o.o. (Poland) — a logistics broker through which shipping carrier selection and parcel delivery (courier or parcel locker) is facilitated. The processing is necessary to perform the sales contract (Art. 6(1)(b) GDPR).

Cloudflare, Inc. (USA) — the hosting/infrastructure provider (Cloudflare Pages, the D1 database, and KV storage) on which our store runs. It holds the full order snapshot (name and surname, e-mail address, phone number, delivery address) as well as the content of withdrawal declarations. Data transfer to the USA is performed on the basis of the European Commission adequacy decision of 10 July 2023, confirming an adequate level of data protection under the EU-US Data Privacy Framework (DPF).

Resend (Plus Five Five, Inc.) (USA) — the transactional e-mail provider through which we send order-confirmation, shipment-status, and withdrawal-handling e-mails; these messages contain your e-mail address, name, and order details. Data transfer to the USA is performed on the basis of the European Commission adequacy decision of 10 July 2023, confirming an adequate level of data protection under the EU-US Data Privacy Framework (DPF).

Data is not sold to third parties.

AUTOMATED DECISION-MAKING

Your data is not subject to automated decision-making or profiling that produces legal effects on you or similarly significantly affects you, within the meaning of Art. 22 GDPR.

POLICY CHANGES

This Privacy Policy may be updated to reflect legal changes or changes in how data is processed. The current version is always available on this page.

Last updated: 2026-07-13.