Privacy policy
PRIVACY POLICY
Effective 30 July 2026.
1. Data controller
The controller of personal data is Tyzon Victor Tyszlewicz, Zabór Mały 6, 55-330 Zabór Mały, Poland, NIP 9131642011, REGON 541820081.
Contact for data protection matters: sklep.tavora@gmail.com, tel. +48 667 926 505.
The controller has not appointed a data protection officer.
2. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Performing the order and sales contract | Art. 6(1)(b) GDPR | until completion, then until claims become time-barred |
| Issuing and keeping accounting records | Art. 6(1)(c) GDPR with tax and accounting legislation | 5 years from the end of the tax year |
| Handling complaints and withdrawals | Art. 6(1)(c) GDPR | until the matter is closed, then until claims become time-barred |
| Handling correspondence | Art. 6(1)(f) GDPR (legitimate interest in replying) | until the exchange ends, no longer than 12 months |
| Establishing, pursuing or defending claims | Art. 6(1)(f) GDPR | until claims become time-barred |
| Providing the customer account, including sign-in with Google | Art. 6(1)(b) GDPR | until the account is deleted |
| Newsletter and email marketing | Art. 6(1)(a) GDPR (consent) | until consent is withdrawn |
| Statistics and analytics (Google Analytics) | Art. 6(1)(a) GDPR (cookie consent) | until consent is withdrawn or cookies expire |
| Marketing via the Meta Pixel | Art. 6(1)(a) GDPR (consent) | until consent is withdrawn or cookies expire |
| Store security and abuse prevention | Art. 6(1)(f) GDPR | up to 12 months |
Providing the data needed to conclude and perform the contract is voluntary, but an order cannot be fulfilled without it. Providing data for marketing purposes is entirely voluntary.
3. Categories of data
Name, delivery address, billing address, email address, telephone number, order and payment details, tax number where an invoice is requested, IP address, cookie identifiers, and information about how the store is used. If you sign in with Google, this also includes the unique identifier of your Google account.
The controller does not process special categories of data, including health data. Please do not include such information in messages.
4. Recipients
Data may be disclosed to the following categories of recipient:
- Shopify International Limited (Ireland) — store platform, hosting, and newsletter delivery via Shopify Email
- The payment provider handling BLIK, card and online transfer payments, which receives the data needed to settle the transaction and acts as a separate controller for those activities
- InPost S.A. — the carrier, acting as a separate controller for delivery
- Google Ireland Limited — Google Analytics, and the "Sign in with Google" service where you choose to use it, acting as a separate controller for the sign-in itself
- Meta Platforms Ireland Limited — Meta Pixel
- The controller's accounting office
- Public authorities, where disclosure is required by law
5. Transfers outside the European Economic Area
Some recipients, in particular providers of analytics and marketing tools, may process data outside the EEA, including in the United States. Such transfers take place on the basis of a European Commission adequacy decision, or on the basis of standard contractual clauses adopted by the European Commission together with the supplementary measures applied by those providers.
A copy of the safeguards applied is available on request to sklep.tavora@gmail.com.
6. Cookies
- The store uses cookies and similar technologies.
- Essential cookies enable the basket, session handling and checkout. They are used without consent, on the basis of the legitimate interest in providing the service requested.
- Analytics and marketing cookies (Google Analytics, Meta Pixel) are used only after consent is given through the consent banner in the store.
- Consent may be withdrawn at any time by changing the consent settings in the store or deleting cookies in the browser.
- Restricting cookies in the browser may affect some store functions.
7. Signing in with Google
- You can sign in to your customer account using your Google account. This is optional. A one-time code sent to your email address works just as well, and you can order as a guest without an account at all.
- If you choose it, Google passes us your name, your email address and a unique identifier for your Google account. We never receive your Google password and we gain no access to your Gmail, Drive, contacts or any other Google service.
- The legal basis is Art. 6(1)(b) GDPR — processing necessary to provide the account you asked for. We keep this data until you delete your account.
- For everything that happens on Google's side of the sign-in, Google Ireland Limited is a separate controller and its own privacy policy applies.
- You can disconnect the store from your Google account at any time at google.com/permissions. Your store account and your order history stay intact, and you can sign in with an email code afterwards.
- Signing in with Google does not, by itself, give us any advertising or analytics data about you, and it is separate from the cookie consent described in section 6.
8. Profiling and automated decisions
Data used for marketing may be subject to profiling in order to tailor the advertising content displayed. The controller does not take decisions based solely on automated processing which produce legal effects concerning data subjects or similarly significantly affect them.
9. Your rights
You have the right to:
- access your data and obtain a copy,
- rectification,
- erasure,
- restriction of processing,
- portability of data processed on the basis of consent or contract,
- object to processing based on legitimate interest, including direct marketing,
- withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
Requests should be sent to sklep.tavora@gmail.com. We respond without undue delay and within one month at the latest.
You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
10. Security
The controller applies technical and organisational measures appropriate to the risk, including encrypted connections (SSL/TLS), restricted access to data, and the use of providers offering an adequate level of protection.
11. Changes
This policy may be updated. A new version takes effect on publication in the store. Changes material to data subjects will be communicated separately.