Privacy Policy
## PRIVACY POLICY OF BRISTLELAB.PL ONLINE STORE
### 1. General Provisions
1. This Privacy Policy is for informational purposes and defines the rules for processing personal data of individuals using the online store available at [www.bristlelab.pl](http://www.bristlelab.pl), including Customers, individuals contacting the Seller, subscribing to the Newsletter, and using a Customer Account.
2. The Controller of personal data is:
BRISTLE LAB Vladyslav Hrabovskyi
ul. Hoża 86/410, 00-682 Warszawa
NIP (Tax ID): 1251806422
REGON (National Business Registry Number): 544367452
e-mail: contact@bristlelab.pl
phone: +48 780 112 165
3. Personal data are processed in accordance with applicable legal provisions, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
4. Providing personal data is voluntary; however, it may be necessary to the extent required for placing and fulfilling an Order, setting up and maintaining a Customer Account, handling payments, delivery, returns, or complaints, and subscribing to the Newsletter. Failure to provide required data in a given case may result in the inability to place an Order, conclude or perform a Sales Agreement, create a Customer Account, receive the Newsletter, process an inquiry, or provide a response.
### 2. What data may be processed
The Controller may process, in particular, the following personal data:
* first name and last name,
* delivery address and billing address,
* email address,
* phone number,
* company details and NIP (Tax ID), if provided for an invoice,
* data regarding Orders, payments, delivery, returns, and complaints,
* data related to the Customer Account,
* data related to Newsletter subscription and marketing preferences,
* technical data and activity information in the Store, including IP address, device data, browser, operating system, interactions with the website, and data saved using cookies and similar technologies.
### 3. Data Sources
Personal data may be obtained from:
* directly from the data subject,
* automatically when using the Store,
* payment operators regarding payment status information,
* delivery service providers regarding shipment fulfillment,
* providers of technological and marketing tools used in the Store.
### 4. Purposes and Legal Bases for Data Processing
Personal data may be processed for the following purposes:
1. conclusion and performance of a Sales Agreement, including handling of Orders, payments, delivery, returns, and complaints
legal basis: Art. 6(1)(b) GDPR
2. setting up and maintaining a Customer Account
legal basis: Art. 6(1)(b) GDPR
3. contact with the Customer regarding an Order, payment, delivery, complaint, return, or inquiry
legal basis: Art. 6(1)(b) GDPR, and for communication not directly related to the performance of the contract – Art. 6(1)(f) GDPR, where the legitimate interest of the Controller is to handle inquiries, ensure efficient communication, and protect against abuse
4. fulfillment of legal obligations, in particular tax, accounting, and consumer obligations
legal basis: Art. 6(1)(c) GDPR
5. establishment, exercise, or defense of claims
legal basis: Art. 6(1)(f) GDPR, where the legitimate interest of the Controller is to protect its rights, pursue claims, and defend against claims
6. sending the Newsletter and email marketing messages, including information about products, promotions, and special offers
legal basis: Art. 6(1)(a) GDPR
7. analytics, statistics, measurement of advertising effectiveness, and remarketing activities, including the use of Google Analytics and Meta Pixel
legal basis: Art. 6(1)(a) GDPR
8. prevention of abuse, ensuring the security of the Store, and detection of illegal activities
legal basis: Art. 6(1)(f) GDPR, where the legitimate interest of the Controller is to protect the security of the Store, users, and technical infrastructure
### 5. Transactional and Marketing Messages
1. The Controller may send messages related to the performance of the Agreement, in particular regarding:
* order confirmation,
* order acceptance for fulfillment,
* payments,
* shipping and delivery,
* returns and complaints,
* changes related to the Customer Account.
2. The above messages are sent regardless of marketing consent, as they are necessary for the performance of the contract or fulfillment of legal obligations.
3. Marketing messages, including the Newsletter, are sent only to individuals who have previously given appropriate consent. Consent may be withdrawn at any time.
### 6. Recipients of Data
Personal data may be transferred to entities supporting the Controller in operating the Store, solely to the extent necessary to achieve a given purpose, in particular:
* providers of the store platform and technical services, including Shopify,
* payment operators,
* carriers and logistics operators, in particular InPost, ORLEN Paczka, DPD, or other currently used delivery providers,
* providers of IT, hosting, email services, and tools supporting customer service,
* providers of accounting, legal, and advisory services,
* providers of analytical and marketing tools, in particular Google Analytics and Meta Pixel, if active in the Store,
* entities supporting the sending of the Newsletter or marketing communication, if used.
### 7. Shopify
1. The Store operates based on Shopify technology.
2. In connection with the use of the Shopify platform, personal data may be processed by Shopify to the extent necessary to ensure platform operation, order handling, payments, security, and functions related to running the Store.
3. The Controller uses privacy features available in Shopify, in particular Customer Privacy settings, cookie banner, and related tools for consent management.
4. If Shopify Network Intelligence is enabled in the Store and Enhanced Services are used, Shopify may also process Customer's personal data to provide enhanced services, including personalization, better ad targeting, and analysis of interactions with the Store and advertisements. In such a case, data regarding the Customer's activity in the Store may be shared with Shopify and third parties, including entities located outside the European Economic Area, for the purpose of providing these services.
5. Information about how Shopify processes personal data is available in the Shopify Consumer Privacy Policy at: [https://www.shopify.com/legal/privacy/consumers](https://www.shopify.com/legal/privacy/consumers)
6. Information about how to exercise rights related to data processing by Shopify, including the ability to withdraw consent or object to data processing by Shopify in connection with Enhanced Services, is available at: [https://privacy.shopify.com/pl](https://privacy.shopify.com/pl)
### 8. Data Retention Period
Personal data are stored for the period necessary to achieve the purpose for which they were collected, and then for the period required by law or needed to protect the Controller's rights, in particular:
* data related to an Order and Sales Agreement – for the duration of the contract, and then for the period required by tax, accounting, and civil law provisions,
* data related to the Customer Account – until the Account is deleted, and then for the period needed for settlements and defense against claims,
* data related to a complaint or return – for the period necessary to handle the request and for the period of limitation of claims,
* data related to the Newsletter and email marketing – until consent is withdrawn,
* data related to analytics and internet marketing – according to the lifespan of used cookies or until consent is withdrawn.
### 9. Profiling
1. The Controller may use personal data for profiling for analytical and marketing purposes, in particular to:
* match marketing content,
* measure ad effectiveness,
* present more tailored content and offers.
2. Profiling does not involve making decisions that produce legal effects concerning the User or similarly significantly affect him or her.
### 10. Cookies, Google Analytics, and Meta Pixel
1. The Store uses cookies and similar technologies for the purpose of:
* ensuring proper functioning of the website,
* maintaining user session and Customer Account functionality,
* remembering settings and preferences,
* conducting analytics and statistics,
* marketing and remarketing activities.
2. Cookies essential for the website's operation may be used without user consent if they are necessary to provide the service.
3. Analytical and marketing cookies, including those related to Google Analytics and Meta Pixel, are used only after obtaining user consent.
4. The Controller uses consent management functions available in Shopify. When using custom pixels or tags, the Controller strives to ensure that they operate in accordance with the Customer Privacy API settings and the user's choice expressed in the cookie banner.
5. The User can manage consents through the cookie banner and appropriate privacy settings available in the Store, as well as through their browser settings, with the proviso that restricting essential cookies may affect the operation of some website functions.
### 11. Transfer of Data Outside the EEA
1. In connection with the use of technological, payment, analytical, and marketing service providers, personal data may be transferred outside the European Economic Area.
2. In the event of data transfer outside the EEA, the Controller applies appropriate protection mechanisms provided by the GDPR, in particular:
* adequacy decisions, or
* standard contractual clauses approved by the European Commission,
* or other mechanisms compliant with applicable law.
3. The data subject may obtain information about the safeguards applied to data transfers outside the EEA, including a copy of these safeguards or information about where they have been made available, by contacting the Controller at: [contact@bristlelab.pl](mailto:contact@bristlelab.pl).
### 12. Rights of the Data Subject
The data subject has the right to:
* access their data,
* rectification of data,
* erasure of data,
* restriction of processing,
* data portability,
* object to data processing based on the Controller's legitimate interest,
* withdraw consent at any time, if processing is based on consent,
* lodge a complaint with the President of the Personal Data Protection Office.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
### 13. Contact and Complaints
1. In matters related to the processing of personal data, you can contact the Controller:
* e-mail: contact@bristlelab.pl
* phone: +48 780 112 165
* address: ul. Hoża 86/410, 00-682 Warszawa
2. The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office if they believe their data are being processed unlawfully.
### 14. Changes to the Privacy Policy
The Controller may amend this Privacy Policy in the event of changes in legal provisions, the operation of the Store, the implementation of new technological or organizational tools, or changes in the scope of provided services. The current version of the Privacy Policy is published on the Store's website.