KvasaroVersion of 11 October 2026. The Polish version governs; this translation is provided for convenience.
Controller
The controller is KVASARO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Hoża 86, lok. 410, 00-682 Warszawa, Poland, KRS 0001264777, NIP 7011330331. Contact us about personal data at business.kvasaro@gmail.com or by post.
Data and purposes
For purchases, we process your name, email, telephone number, delivery address, products, amounts, payment and delivery status, returns and related correspondence. This is needed to form and perform the sales contract, deliver the goods and handle complaints (GDPR Article 6(1)(b)). Accounting and tax records are processed to meet legal duties (Article 6(1)(c)). Complaint, product-safety and contact data may also be processed for legal duties or legitimate interests in defending claims (Article 6(1)(c) or (f), depending on the matter). Without the required delivery data we cannot fulfil an order.
An account is optional. For account users we store an email address, account identifier, protected password hash and any saved profile or address data, to provide the account (Article 6(1)(b)). Limited connection and security logs support availability and fraud prevention (Article 6(1)(f)). We do not run a newsletter or advertising profiling and do not make solely automated decisions with legal or similarly significant effects.
If you consent to analytics cookies, Google Analytics 4 measures page visits, product views, additions to cart, checkout starts, registrations and purchases. Browser identifiers and event data are sent to Google without your name, email address, telephone number or delivery address. The legal basis is consent (GDPR Article 6(1)(a)), which you can withdraw in the cookie settings.
Recipients and international transfers
Authorised staff and service providers access data only as needed. DigitalOcean hosts the shop in Amsterdam, home.pl provides domain services, and Tailscale protects administrative access. Stripe processes payment information; the shop does not store complete card numbers. Polkurier and the selected carrier receive the data needed to deliver parcels. The shop sends email through Google Gmail API from business.kvasaro@gmail.com. Advisers and authorities may receive data where required for a specific matter.
With analytics consent, Google Ireland Limited processes data about use of the shop in Google Analytics 4.
Global suppliers may process data outside the EEA under applicable transfer mechanisms, such as an adequacy decision or standard contractual clauses. Ask the controller for details of a specific transfer and a copy of the applicable safeguards. Supplier policies: Stripe, Google, DigitalOcean.
Retention
Order and accounting data are retained for statutory tax and accounting periods and, where necessary, applicable limitation periods. Account data are retained while the account operates; records with another legal basis may remain after closure. Correspondence is retained for handling the matter and necessary claim periods. The current access log and up to 14 daily archives support security. Encrypted backups are normally retained for 14 days, with the last valid backup preserved if new backups fail. Incident records are kept as long as needed to investigate the incident.
Your rights
You may request access, correction, deletion or restriction, and, where the law applies, data portability or object to processing based on legitimate interests. Send your request to the contact above. We verify identity proportionately to the risk; do not send a password or identity document unless we explain a specific need. You may complain to Poland's Personal Data Protection Office (UODO). See the cookie policy for technical cookies and browser storage.
Handling rights requests and withdrawal of consent
We respond to personal-data requests without undue delay, normally within one month of receipt. If the complexity or number of requests requires an extension of up to two further months, we will explain the reason within the first month. You can withdraw analytics consent in Cookie settings; withdrawal does not affect the lawfulness of earlier processing. Deleting an account or cookies does not automatically delete records that we must retain to comply with legal obligations.
Contact form and reviews
The contact form sends your name, email, optional order number and message to the shop mailbox so we can handle your enquiry. A review contains a rating, text and your account display name. Submission requires sign-in and a verified purchase; after moderation, the display name, rating and text become public. Your email is not published. Contact the shop to request a change or removal.
Obsługa wiadomości w CRM
Wiadomości wysłane formularzem kontaktowym zapisujemy również w wewnętrznym systemie obsługi klienta KVASARO. Dostęp mają wyłącznie upoważnieni pracownicy. Służy to udzieleniu odpowiedzi i powiązaniu zapytania z zamówieniem.
Return requests
The returns form collects the order number, the email address used for the purchase and an optional list of returned products. We store the details with the order and use them to process the withdrawal notice, correspondence and refund. For privacy requests, contact business.kvasaro@gmail.com.