Privacy policy
Version 1. This policy explains what personal data we collect, why, on what legal basis, and for how long we keep it. It is written to Articles 13 and 14 of the GDPR — Regulation (EU) 2016/679.
1. Controller
| Controller | Marcin Staniszczak For Creation |
| Address | Wiolinowa 7, 97-500 Radomsko, Poland |
| NIP (Polish tax id) | 7722014446 |
| marcin@staniszczak.pl |
We have not appointed a data protection officer: this business does not fall into a category for which the GDPR requires one. Data matters are handled by the controller, at the address above.
2. Purposes, legal bases and retention
| purpose | legal basis | how long |
|---|---|---|
| Fulfilling an order: taking it, shipping it, contacting you about it | Art. 6(1)(b) — performance of a contract | for as long as the order runs, then until contractual claims are time-barred — 6 years, counted to the end of the calendar year (Art. 118 of the Polish Civil Code) |
| Handling complaints and withdrawals | Art. 6(1)(b) and (c) — legal obligation | 6 years from the close of the matter, on the same basis; never less than the 2 years of liability for conformity of the goods |
| Accounting and tax records | Art. 6(1)(c) — legal obligation under Polish accounting and tax law | 5 years from the end of the year in which the tax fell due (Art. 74 of the Accounting Act, Art. 86 of the Tax Ordinance) |
| Newsletter | Art. 6(1)(a) — consent | until consent is withdrawn; the proof of consent for as long as claims can be brought |
| Visit statistics (self-hosted, cookieless) | Art. 6(1)(f) — legitimate interest in knowing which pages are used | raw data for up to 12 months; aggregate figures, from which no single visit can be reconstructed, indefinitely |
| Server logs and security | Art. 6(1)(f) — legitimate interest in detecting abuse | 12 months |
| Consent records | Art. 6(1)(c) — accountability, Art. 5(2) | for as long as we must be able to show what you agreed to and when |
These periods come from statute rather than from our discretion, and the basis is named beside each one so an accountant or a lawyer can check them without asking us.
Accounting retention outlasts the right to erasure. If you ask us to delete your data and it relates to a completed order, we will anonymise your customer record, but the invoice stays — keeping it is a statutory duty we cannot set aside.
3. What data
- Order data: name, delivery address, email address, telephone number, what you ordered, the amount.
- Billing data: invoice details, including a tax number if you give one.
- Account data: email address and a password stored as an irreversible hash.
- Newsletter: email address, the date and time you confirmed, the IP address at confirmation, and the exact consent wording you were shown.
- Technical data: IP address, browser type, the page you came from — in server logs.
We collect no special category data (Art. 9) and ask for none in any form.
4. Recipients and processors
| who | what for | where |
|---|---|---|
| Stripe Payments Europe, Ltd. | payment processing, including BLIK | Ireland (EEA) |
| Mailgun Technologies, Inc. (EU region) | transactional email and confirmations | European Union (EEA) |
| Hetzner Online GmbH | server and backup hosting | Germany (EEA) |
| Listmonk (on our own server) | newsletter delivery | Germany (EEA) |
| Our accountants | bookkeeping | Poland (EEA) |
| Postal and courier operators | delivering your parcel | EEA |
Payments. We never see or store your card number. Card details go straight to Stripe; we receive confirmation of payment and the last four digits.
Digital file sales will in future run through an intermediary acting as merchant of record. When that happens this policy gets a new version naming that company — we will not change this one quietly.
5. Transfers outside the EEA
Your data does not leave the European Economic Area. The server, the backups and newsletter delivery are all in the European Union. Transactional email goes out through Mailgun in its EU region, chosen when the account was created; message data is processed and stored on infrastructure inside the European Union.
If a transfer outside the EEA ever became necessary, it would be made under standard contractual clauses approved by the European Commission, and this policy would get a new version naming the company and the basis. We will not change this version quietly.
6. No tracking, and therefore no consent banner
We use no third-party analytics, no advertising cookies and no cross-site tracking. Statistics are collected on our own server with no identifier that would let us recognise you on a later visit. Embedded video does not contact the provider until you click play.
That is why this site shows no cookie consent banner: consent is required for cookies that do not exist here. The Cookie information page has the detail.
7. Your rights
You have the right of access to your data, and to its rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. You may withdraw consent to the newsletter at any time — every message carries the link, and withdrawal does not affect the lawfulness of what we did before it.
Write to marcin@staniszczak.pl. We answer without undue delay and within one month.
You may also complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
8. Automated decisions
We take no decisions about you based solely on automated processing, and we do not profile you.