Privacy Policy

Date of publication: 12.10.2026

PRIVACY POLICY

Zofia Chylak-Widmańska trading as Zofia Chylak-Widmańska, ul. Mokotowska 46a/23, 00-543 Warsaw, Poland, EU VAT number PL 118 159 70 53, Polish Statistical Identification Number REGON 146974571, is the data controller in respect of personal data of the Store’s Users (the “Controller”).

USE OF PERSONAL DATA

The User personal data is processed for the purposes of:

Conclusion and performance of orders and contracts of sale between the Controller and the User on the terms described herein (Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”);
Marketing of the Controller’s own Products and services, including sending, upon prior consent, messages containing commercial information, in particular in the form of Newsletter, in the form of Availability Notification;
The sending of commercial communications by electronic means within the meaning of the Act of 18 July 2002 on the provision of electronic services (Journal of Laws of 2020, item 344, and of 2024, item 1222) – subject to separate consent.
Other purposes, arising from the legitimate interests of the Controller.

Providing personal data by Users is voluntary, but necessary to make transactions in the Store. When Users subscribe to the newsletter, electronic mailing with commercial information about promotions and new Products available in the Store will be sent to their e-mail address. When placing an order in the Store, Users provide the following personal data:

• Email address;

• Address details – home address, zip code, city;

• Phone number;

• Name and surname.

When using the Newsletter or Availability Notification service, Users provide only their e-mail addresses.

Navigation data may also be collected from Users, including information about links and hyperlinks they decide to click, or other activities undertaken in the Store. If requested, the Controller will provide personal data to authorized state authorities.

The User personal data is secured by the Controller against unauthorized use, modification or destruction by the use of appropriate technical and organizational measures.

The Controller collects usage data (that exclude personal data) of the User. The data is used to generate statistical reports and advertising services. The Controller collects data that includes page views, user journey, website feature usage, session duration, device and browser information, geographical location and interests.

The usage data can be used for the purpose of online advertising tailored to User’s interests. The Controller utilizes retargeting, in order to display advertising content that matches the User’s interests. The advertising selection is based on User’s activity in the Store. The Controller utilities third party advertising platforms, including Facebook, Google and Instagram, that adapt the advertising to match the User’s profile, stored in their database.

SPECIFIC PURPOSES OF PERSONAL DATA PROCESSING AND THEIR STORAGE PERIOD

The User’s personal data are processed in accordance with and stored for a period consistent with the following provisions of the GDPR:

• Name and surname, email address, phone number, address, the company’s name and its registered office are processed in order to handle the User’s purchases, including information about the order status and delivery (Article 6(1)(b) of the GDPR);

• Name and surname, phone number, address, as well as other data needed to operate the service selected by the User are processed in order to handle additional services provided by the Store (Article 6(1)(b) of the GDPR, in connection with a consent to contact);

• Name and surname, address, the company’s name and its registered office, Tax Identification Number, bank account number are processed for the purpose of issuing sales documents and fulfilling statutory obligations related to tax settlements (Article 6(1)(c) of the GDPR in connection with Article 74 of the Polish Accounting Act and Article 70 § 1 of the Polish Tax Ordinance);

• Name and surname, email address, phone number, address, the company’s name and its registered office, Tax Identification Number, bank account number are processed for the purpose of handling complaints, returns and warranty claims, including information on the status of the application (Article 6(1)(c) of the GDPR in connection with the Polish Consumer Rights Act and the Polish Civil Code).

To handle purchases, the Controller uses the following orders management tools: Shopify (https://shopify.com/) and BaseLinker (https://baselinker.com/). In this scope, the User’s data mentioned in the previous paragraph, processed by the Controller, will be transferred to these external platforms in order to handle purchases (including information about order status and delivery), handle additional services provided by the Store, issue sales documents and fulfill statutory obligations related to tax settlements, handle complaints, returns and warranty claims (including information on the status of the application). The method of data processing by these tools is described here: https://www.shopify.com/legal/privacy and https://baselinker.com/pl-PL/klauzule-rodo/.

The data indicated above, as well as other data necessary to handle the matter, will be processed in order to implement the Controller’s legitimate interest, which consists in particular in debt collection or conducting and handling court, mediation and arbitration cases (Article 6(1)(f) of the GDPR).

The scope of the User’s data (depending on the document) is processed for the purpose of archiving documentation in electronic and paper form for the period provided for by law, and if the law does not specify such a period – for the time during which their storage is within the Controller’s legitimate interest, regulated by the time for pursuing claims (Article 6(1)(c) of the GDPR).

The period of data processing by the Controller depends on the type of service provided and the purpose of processing. In principle, data is processed for the duration of the service provision, until the consent is withdrawn or an effective objection to data processing is raised in cases where the legal basis for data processing is the Controller’s legitimate interest.

The data processing period may be extended if processing is necessary to establish and pursue possible claims or defend against claims, and after that time only if and to the extent required by law. After the processing period, the data is irreversibly deleted or anonymized.

OTHER FORMS OF CUSTOMER SERVICE

User data is also processed in the event of contact with the store via email, chat/messenger, phone or via social media.

In the case of an email, the following data is processed:

• Email address;

• Details of the person who signed the email;

• Data included in the footer;

• Other data provided by the User.

In the case of contact via phone, the User’s phone number and any other identifying data provided by the User are processed.

In the case of contact via chat or messenger, as well as other forms of contact, i.e. a direct message sent via social media, the following information is processed:

• Name and surname (or online username (handle) from which the direct message was sent);

• Details of the person who signed the message;

• Other identifying data indicated by the User.

All the data indicated above are processed for the sake of contacting the User for purposes related to the performance of a contract or the provision of additional services until the User resigns from the services (Art. 6(1)(b) of the GDPR) and in order to pursue the Controller’s legitimate interest consisting in handling a customer complaint that is not directly related to the contract until the matter is finally resolved or an effective objection is submitted (Article 6(1)(f) of the GDPR).

COOKIES

The Controller uses cookies. Cookies are IT data that are stored on the User’s end device and are intended for the use of websites. Cookies usually contain the name of the website from which they originate, their storage time on the end device, standard login information, such as IP address, search engine type, language, access hours, address of the website from which the User was redirected and a unique number. The Controller is the entity placing cookies on the User’s end device and accessing them.

Cookies are used for the following purposes:

• Creating statistics that help understand how Users use the Store’s websites, which allows us to improve the Store’s structure and content;

• Adapting the Store’s content to the User’s preferences and optimizing the use of websites; e.g. cookies allow in particular to recognize the User’s device – its type (e.g. laptop, smartphone, tablet) and properly display a website adapted to the end device;

• Making sure that Users have read information about Cookies.

• Establishing the User profile in order to display product recommendations and advertising, using advertising systems including Google LLC, Google Ireland Limited and Facebook Ireland Ltd. The cookies enable displaying advertisements and promotions based on website usage. Thanks to the cookies, the advertising content better matches the User’s interests and preferences. Marketing cookies can also be utilized to track advertising campaign results.

Users may independently and at any time change the settings for cookies, specifying the conditions for their storage and access by cookies to the User’s device. Restrictions on the use of cookies may, however, affect some of the functions available on the Store’s website.

We can distinguish two categories of cookies:

Due to the lifetime of cookies: (i) Permanent files that are stored on the User’s end device for a specified period contained in the file parameters or until they are physically removed from the end device by the User; (ii) Session files are temporary files that are stored on the User’s end device until (s)he leaves the Store’s website.

Due to the purpose for which cookies files are used, we divide them into: (i) Statistical files that are used to collect anonymous statistics for the Store; (ii) Cookies that are used to ensure data security and confidentiality; (iii) Functional files that make it possible to remember preferred functionalities of the Store; (iv) Advertising files, allow tailoring advertising content to match the User’s interests.

Users may, at any time, delete cookies by withdrawing all or some of the consents and modifying the settings using the manufacturer’s instructions for the respective web browser.

THIRD PARTY COOKIES

The Controller cooperates with third party entities, including social media platforms, in order to publish online advertisements. For this purpose, the User’s browser stores cookies generated by the entities. The cookies enable tailoring the advertising shown by these entities to match User’s interests. The entities can assign the User’s visit in the Store to the User’s profile maintained by the entities. In order to perform marketing services, the Controller utilizes the service of the following third party entities, that utilize cookies:

• Google LLC, Google Ireland Limited

• Facebook Ireland Ltd., Facebook Inc.

Additional information regarding the use of cookies by these entities can be found in their privacy policies. The User can prevent the user of third party cookies by adjusting their browser settings.

TRANSFER OF PERSONAL DATA TO OTHER ENTITIES

The User personal data is transferred to service providers used by the Controller when running the Store. In particular, personal data may be transferred to payment operators (e.g. PayPal or tpay.com) to make payments and to courier companies (e.g. UPS) to deliver the Product to the indicated address. If the User subscribes to the Newsletter or to the Availability Notification, the User’s email address and preferred language version will be forwarded to MailChimp. Personal data will not be made available by the Controller to other entities, except for those with an appropriate legal basis, in particular if personal data is necessary to perform the contract to which the User is a party.

INTERNATIONAL TRANSFER OF PERSONAL DATA

The Seller’s servers are located in the European Union. The User data may be transferred to countries outside the European Economic Area. All of them meet the required rules for the storage and processing of personal data of citizens of EU Member States.

The User personal data will be stored by the Controller as long as it is necessary to perform the contract, and after that time for a period corresponding to the period of limitation of claims (in the scope of performance of contracts concluded by the User, e.g. contact details, correspondence and transaction records), until the User withdraws his/her consent (to the extent that data is processed on the basis of consent) or until the User objects.

Users can withdraw their consent to data processing for marketing purposes or consent to sending commercial information at any time by sending an e-mail containing information about withdrawal of consent with the indication which consent is withdrawn at: help@chylak.com. After withdrawing consent(s), the User will not receive marketing materials or commercial information from the Controller. The withdrawal of consent(s) does not affect the lawfulness of the processing that was carried out based on consent before its withdrawal (Article 21 of the GDPR).

It is possible to object to the processing of personal data by the Controller by sending an email message containing such objection to the following address: help@chylak.com

Once the objection has been submitted, the User will not receive any marketing materials from the Controller.

Users have the right to access their data and rectify, delete, limit processing and object to the processing. For this purpose, Users should contact the Controller by email at help@chylak.com

In addition, the User has number of other rights. The User may, at any time, check the scope of personal data being processed, for what purposes it is processed, what are the legal basis for the processing of particular types of data, to whom the data is made available and what is the envisaged period of their storage. The Controller will provide the User with this type of information after the User declares his or her willingness to receive it (Article 15 of the GDPR). The User may also exercise the right to transfer data when, based on the consent expressed by him or her or based on the contract concluded between the User and the Controller, personal data is processed in an automated manner. The User then has the right to receive a copy of his or her data from the Controller in a structured, commonly used and readable format (Article 20 of the GDPR). The User also has the right to rectify and supplement his or her personal data if it is incomplete or incorrect (Article 16 of the GDPR). In addition, the User has the right to delete personal data that is processed by the Controller from the website. There are, however, some exception, namely: if the order has not yet been shipped (or only partially shipped); if the order is unpaid (or partially paid); if the User made a purchase in the store (data is kept for reporting and accounting purposes); if the Controller has to secure data on the basis of a request submitted by authorized bodies (e.g. the police); if the User’s data is necessary to establish, pursue or defend against claims (Article 17 of the GDPR).

The User has the right to request the restriction of the personal data processing in the following instances: if (s)he does not agree to the processing of data on the basis of the Controller’s legitimate interest; if (s)he reports incorrect personal data; if the processing of personal data is unlawful; if the Controller does not need the User’s personal data, but the User reports that it is needed to establish, pursue or defend claims (Article 18 of the GDPR).

At the User’s request, the Controller will notify the User about rectification, erasure of data or restriction of processing (Article 19 of the GDPR), and about the identity of the recipient of the User’s personal data.

The User has the right to submit a complaint to the supervisory authority if (s)he believes that the Controller is processing his or her personal data improperly. Complaints should be lodged to the Personal Data Protection Office with its registered office in Warsaw at ul. Stawki 2, 00-193 Warsaw.

PRIVACY POLICY UPDATE

The Seller may update the Privacy Policy by publishing a new version on the Store’s website, with the date of publication.