Privacy and Cookies Policy

1. Data controller

The controller is Michał Węgielski (unregistered business activity), address: ul. Ludwika Mroza 47, 34-730 Mszana Dolna, Poland, e-mail: wuchwycie@gmail.com. The Seller has not appointed a data protection officer (no such obligation).

2. What data, for what purpose and on what basis

Minimisation: only necessary data. E-mail addresses from marketplace transactions are not used for marketing; the newsletter is sent only with separate consent.

3. Data recipients

The Customer's personal data may be entrusted or disclosed to the following categories of recipients, solely to the extent necessary for the given purpose:

• Shipping operators and couriers: InPost, Furgonetka (shipping broker); depending on the method chosen - Poczta Polska / DPD / DHL / GLS.
• Sales platforms: Etsy (Etsy Ireland UC), Allegro (Allegro.pl, Allegro Lokalnie), eBay (eBay GmbH), to the extent that they are themselves controllers or processors of transaction data on their platform.
• Payment operators: the bank holding the Seller's account; for pay-by-link payments - the payment operator (for example Przelewy24 or PayU), where used.
• E-mail: Google (Gmail) - handling correspondence and order confirmations.
• Website hosting: Cloudflare, Inc. - operation of the wuchwycie.com website; processes technical data (IP address, server logs) necessary to display the site and to protect it against abuse.
• Contact-form handling: Web3Forms - delivery of a message sent through the form on the website (name, e-mail, content of the message) to the Seller's mailbox.
• Website analytics: PostHog, Inc. - counting visits to the wuchwycie.com website; the data is processed in the provider's EU instance (servers in Frankfurt am Main, Germany), without cookies and without storing anything on the user's device.

4. Transfers outside the EEA

When using platforms or tools established outside the EEA (for example Etsy, Cloudflare, Web3Forms - USA) data may be transferred to third countries on the basis of Standard Contractual Clauses (SCC) and, where applicable, the EU-US Data Privacy Framework. Data from the analytics tool is stored on servers in the European Union (Frankfurt am Main, Germany); the provider is established in the USA, so any administrative access from outside the EEA takes place on the same basis.

5. Retention period

We retain data no longer than necessary for the given purpose:

• Data necessary to perform the contract - for the duration of its performance and then until the limitation periods for claims arising from it expire (as a rule up to 6 years).
• Settlement and record-keeping data - for the period required by tax law, that is, as a rule 5 years counting from the end of the calendar year in which the tax obligation arose.
• Correspondence and enquiries - for the duration of the correspondence and then for the period necessary to evidence its course (no longer than until the limitation periods for any claims expire).
• Data processed on the basis of consent (for example the newsletter) - until the consent is withdrawn.
• Data for the establishment, pursuit or defence of claims - until the relevant limitation periods expire or the proceedings are finally concluded.

6. Rights of the data subject

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time (without affecting earlier processing). Contact: wuchwycie@gmail.com. Rights are exercised to the extent and on the terms of the GDPR; in particular, the right to erasure does not cover data that the Seller is obliged or entitled to retain under the law (for example tax settlements) or for the establishment, pursuit or defence of claims.

7. Complaint

The right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland. A data subject resident in another EU country may also lodge a complaint with the supervisory authority of their country of residence.

8. Voluntariness and profiling

Providing data is voluntary but necessary to conclude and perform the contract and to reply to an enquiry. There is no automated decision-making or profiling.

9. Cookies

The wuchwycie.com website does not use analytical or marketing cookies. Visit statistics are collected in a cookieless mode: the analytics tool stores no information on the user's device - neither cookies nor data in browser storage - and estimates the number of unique visits from an irreversible hash computed on the provider's servers. This does not allow a specific person to be identified or tracked across consecutive days. Apart from that, only technologies necessary for the correct and secure display of the site may be used (for example bot-protection mechanisms on the hosting provider's side) and the remembering of the language version chosen by the user - these do not require consent. Should analytical or marketing cookies be introduced in the future, they will be enabled only after prior consent (opt-in, granular, revocable), and this Policy will be updated. On marketplaces (Etsy, Allegro Lokalnie) cookies are handled by the relevant platform in accordance with its own policy.