1. Data controller
The controller of your personal data is stepien.store, Franciszkańska 30, 91-441 Łódź, Poland, email contact@stepien.store, phone +48 791 217 076. For any data protection matters, contact us at contact@stepien.store.
2. Legal framework
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act of 10 May 2018 and, for individuals in the United Kingdom, the UK GDPR and the Data Protection Act 2018.
3. Data we collect
Contact form: name, email address and message content. Clients: contact and billing details needed to perform the contract and issue invoices. Technical data: IP address, browser information and cookie identifiers, where you consent to non-essential cookies.
4. Purposes and legal bases
Responding to your enquiry and taking steps before entering into a contract (Art. 6(1)(b) GDPR); performing the contract (Art. 6(1)(b)); meeting tax and accounting obligations (Art. 6(1)(c)); establishing or defending claims and keeping our site secure (legitimate interest, Art. 6(1)(f)); analytics cookies (consent, Art. 6(1)(a)).
5. Retention
Enquiries are stored for up to 12 months after the last contact unless a contract follows. Contract and invoicing data are stored for the period required by tax law (generally 5 years from the end of the tax year). Consent-based data is kept until you withdraw consent.
6. Recipients
Your data may be shared with providers who help us run our services, such as hosting, database, email delivery and accounting providers, under data processing agreements. We never sell your personal data.
7. International transfers
Where data is transferred outside the EEA or the UK, we rely on adequacy decisions (including the EU–UK adequacy decision) or Standard Contractual Clauses / the UK International Data Transfer Addendum.
8. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting prior processing. To exercise your rights, email us. We reply within one month.
9. Right to complain
You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority of your country. In the UK, you may complain to the Information Commissioner's Office (ICO).
10. Automated decisions and changes
We do not use automated decision-making or profiling. We may update this policy; the current version is always available on this page.