Privacy policy
PRIVACY POLICY
Effective 30 July 2026.
1. Data controller
The controller of personal data is Tyzon Victor Tyszlewicz, Zabór Mały 6, 55-330 Zabór Mały, Poland, NIP 9131642011, REGON 541820081.
Contact for data protection matters: sklep.tavora@gmail.com, tel. +48 785 686 971.
The controller has not appointed a data protection officer.
2. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Performing the order and sales contract | Art. 6(1)(b) GDPR | until completion, then until claims become time-barred |
| Issuing and keeping accounting records | Art. 6(1)(c) GDPR with tax and accounting legislation | 5 years from the end of the tax year |
| Handling complaints and withdrawals | Art. 6(1)(c) GDPR | until the matter is closed, then until claims become time-barred |
| Handling correspondence | Art. 6(1)(f) GDPR (legitimate interest in replying) | until the exchange ends, no longer than 12 months |
| Establishing, pursuing or defending claims | Art. 6(1)(f) GDPR | until claims become time-barred |
| Newsletter and email marketing | Art. 6(1)(a) GDPR (consent) | until consent is withdrawn |
| Statistics and analytics (Google Analytics) | Art. 6(1)(a) GDPR (cookie consent) | until consent is withdrawn or cookies expire |
| Marketing via the Meta Pixel | Art. 6(1)(a) GDPR (consent) | until consent is withdrawn or cookies expire |
| Store security and abuse prevention | Art. 6(1)(f) GDPR | up to 12 months |
Providing the data needed to conclude and perform the contract is voluntary, but an order cannot be fulfilled without it. Providing data for marketing purposes is entirely voluntary.
3. Categories of data
Name, delivery address, billing address, email address, telephone number, order and payment details, tax number where an invoice is requested, IP address, cookie identifiers, and information about how the store is used.
The controller does not process special categories of data, including health data. Please do not include such information in messages.
4. Recipients
Data may be disclosed to the following categories of recipient:
- Shopify International Limited (Ireland) — store platform, hosting, and newsletter delivery via Shopify Email
- The payment provider handling BLIK, card and online transfer payments, which receives the data needed to settle the transaction and acts as a separate controller for those activities
- InPost S.A. — the carrier, acting as a separate controller for delivery
- Google Ireland Limited — Google Analytics
- Meta Platforms Ireland Limited — Meta Pixel
- The controller's accounting office
- Public authorities, where disclosure is required by law
5. Transfers outside the European Economic Area
Some recipients, in particular providers of analytics and marketing tools, may process data outside the EEA, including in the United States. Such transfers take place on the basis of a European Commission adequacy decision, or on the basis of standard contractual clauses adopted by the European Commission together with the supplementary measures applied by those providers.
A copy of the safeguards applied is available on request to sklep.tavora@gmail.com.
6. Cookies
- The store uses cookies and similar technologies.
- Essential cookies enable the basket, session handling and checkout. They are used without consent, on the basis of the legitimate interest in providing the service requested.
- Analytics and marketing cookies (Google Analytics, Meta Pixel) are used only after consent is given through the consent banner in the store.
- Consent may be withdrawn at any time by changing the consent settings in the store or deleting cookies in the browser.
- Restricting cookies in the browser may affect some store functions.
7. Profiling and automated decisions
Data used for marketing may be subject to profiling in order to tailor the advertising content displayed. The controller does not take decisions based solely on automated processing which produce legal effects concerning data subjects or similarly significantly affect them.
8. Your rights
You have the right to:
- access your data and obtain a copy,
- rectification,
- erasure,
- restriction of processing,
- portability of data processed on the basis of consent or contract,
- object to processing based on legitimate interest, including direct marketing,
- withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
Requests should be sent to sklep.tavora@gmail.com. We respond without undue delay and within one month at the latest.
You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
9. Security
The controller applies technical and organisational measures appropriate to the risk, including encrypted connections (SSL/TLS), restricted access to data, and the use of providers offering an adequate level of protection.
10. Changes
This policy may be updated. A new version takes effect on publication in the store. Changes material to data subjects will be communicated separately.