Privacy policy

1. Data Controller
The data controller of your personal information is Jubsoft Piotr Zięba, operating under the name Jubsoft Piotr Zięba, located at ul. Małomickiej 13a, 54-079 Wrocław, NIP: 7692060966, REGON: 101028902. You can contact the administrator at the email address: info@casanookdecor.com. The administrator ensures the security of your data and processes it in accordance with applicable regulations, including GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) and Polish data protection law.

2. Scope and Sources of Personal Data
We process only the personal data necessary to achieve the purposes described in this policy. We may collect, in particular: first and last name, email address, billing address (in case of issuing an invoice), data necessary to process payments (e.g., transaction ID, order number), as well as cookies (more on this below). This data comes directly from you (provided during account registration, placing an order, or contacting us) or is collected automatically while using the site (e.g., IP address, device identifiers – through cookies).

3. Purpose and Legal Basis for Data Processing
Your personal data is processed for specific purposes, based on appropriate legal grounds:

  • Order Fulfillment and Customer Service – to enter into and execute the sales agreement for digital products in our store (legal basis: art. 6(1)(b) GDPR – necessity for the performance of a contract). This includes processing data needed to complete payments, ship orders, handle any complaints, and contact regarding the order.

  • Legal Obligations – to fulfill our legal obligations (basis: art. 6(1)(c) GDPR). This particularly relates to tax and accounting obligations (e.g., storing sales documentation for accounting purposes for the period required by law).

  • Marketing and Newsletter (with Consent) – if you have given separate consent, we may process your email address to send newsletters or marketing information about our products (basis: art. 6(1)(a) GDPR – consent). Remember, you have the right to withdraw your consent at any time, which does not affect the legality of processing carried out before its withdrawal.

  • Legitimate Interests – in certain situations, we process data based on our legitimate interest (art. 6(1)(f) GDPR), respecting your rights and freedoms. This includes ensuring the security of our site (server logs, fraud prevention), archiving correspondence from customer inquiries, or pursuing and defending against potential claims.

4. Data Sharing and Recipients
We do not sell your personal data to third parties. However, your data may be shared with entities whose services we use to operate the store, only to the extent necessary to achieve the specified purposes. Recipients of your data may include:

  • Online Payment Processor – to process payments for your order, your transaction data is shared with the payment operator Przelewy24, managed by PayPro S.A., ul. Pastelowa 8, 60-198 Poznań (payment service provider cooperating with our store). Data shared may include, for example, order ID, amount, and payment sender. This operator becomes a separate data controller in the scope of payment processing – please review their privacy policy on the Przelewy24 website.

  • IT Service Providers and Data Processors – e.g., the hosting company maintaining our server and email, companies providing mailing or analytical systems (like Google – when using Google Analytics, as described below). All these entities process data based on entrustment agreements and only according to our instructions.

  • Public Authorities – in case of a legal obligation, we may share your data with authorized bodies, e.g., tax offices or law enforcement, when they request it based on an appropriate legal basis.

5. Data Retention Period
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected or in connection with legal requirements.

  • Data related to the conclusion of the contract (order data, correspondence) – will be retained for the duration of the contract and then until the expiration of the limitation period for claims arising from the contract or related to it (which generally lasts up to 6 years from the performance of the contract). Additionally, some information from orders (e.g., invoices) must be retained for the statutory period of 5 years after the end of the financial year in which the transaction occurred – in accordance with tax regulations.

  • Data processed based on consent (e.g., newsletter) – we retain until you withdraw your consent for further processing. After withdrawing consent, data may be retained for the period necessary to demonstrate compliance with processing (i.e., for the limitation period of potential claims).

  • Data collected based on legitimate interest – for as long as this interest exists or until an effective objection is raised by the data subject.

  • Cookies – for the period specified in the Cookie Policy (varies depending on the type of cookies – details below and in a separate Cookie Policy).

After the specified periods, data is deleted or anonymized in such a way that it can no longer be linked to you.

6. Rights of Data Subjects
Under applicable regulations, you have a number of rights regarding your personal data. You can exercise them at any time by sending a relevant request to our email address. Your rights include:

  • Right of Access – you have the right to obtain information on whether we process your data, and if so, to receive a copy of it and information about the purposes, scope, and manner of processing (art. 15 GDPR).

  • Right to Rectification – if you notice that your data is outdated or incorrect, you have the right to request its correction or completion (art. 16 GDPR).

  • Right to Erasure (“Right to be Forgotten”) – in cases provided by law, you can request the deletion of your data (e.g., when the data is no longer needed for the purposes for which it was collected, or when you have withdrawn consent for processing and there is no other legal basis) – art. 17 GDPR. However, remember that in some situations we may not be able to delete data immediately, e.g., when we are obliged to retain it by law.

  • Right to Restrict Processing – you can request that we restrict the processing of your data (e.g., only to storage) in certain situations, e.g., when you contest the accuracy of the data or the basis for its processing (art. 18 GDPR).

  • Right to Data Portability – if we process your data based on consent or contract and in an automated manner, you have the right to receive your data in a structured, commonly used, machine-readable format (e.g., CSV) or request that we send this data directly to another controller, if technically feasible (art. 20 GDPR).

  • Right to Object – you have the right to object at any time to the processing of your data based on our legitimate interest (art. 21 GDPR). In such a case, we will cease processing this data for those purposes unless we demonstrate the existence of compelling legitimate grounds that override your rights or the basis for establishing, pursuing, or defending claims.

  • Right to Withdraw Consent – to the extent that we process your data based on granted consent, you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the legality of processing that we carried out before its withdrawal.

  • Right to Lodge a Complaint with a Supervisory Authority – if you believe we process your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw), who is the supervisory authority for personal data protection.

To exercise your rights, please contact us via email. We will strive to fulfill your request promptly, no later than within the timeframes set by regulations (generally within 1 month, with the possibility of extending up to 3 months in complex cases – we will inform you about this).

7. Cookies and Tracking Technologies
Our website uses cookies (so-called “cookies”) and other similar technologies to ensure the proper functioning of the service, improve its functionalities, and conduct visitor statistics analysis. Cookies are small text files sent by our server and stored on your end device (computer, smartphone, etc.), which can be read each time you connect from that device. Detailed information can be found in a separate Cookie Policy. Below are the basic details:

  • Necessary Cookies: we use technical cookies that are essential for the proper functioning of the store (e.g., remembering cart contents, language settings). These cookies are always installed, as our service cannot function correctly without them.

  • Analytical and Performance Cookies: with your consent (expressed through the cookie banner on your first visit), we use cookies that collect information about how users interact with the site. This allows us to improve our store and tailor it to visitors' preferences. An example is Google Analytics – a tool provided by Google LLC, which collects anonymous statistical information (e.g., number of visits, traffic sources, time spent on the site) through cookies. Data from Google Analytics may be transferred to Google servers located outside the European Economic Area – in such cases, appropriate safeguards required by law are applied (e.g., EU standard contractual clauses).

  • Marketing Cookies: our store does not display external ads, but we may use marketing tools (e.g., Facebook Pixel, Google Ads) for our advertising campaigns. These tools also use cookies to personalize ads and measure their effectiveness. These files are installed only if you consent through the settings on the cookie banner.

Remember, you have the option to manage cookies. During your first visit to the site, we present you with a cookie banner, where you can accept all cookies, reject non-essential cookies, or configure your own settings. You can later change your choices using your browser settings (most browsers allow you to delete or block cookies) or the relevant options available on our site. Please note that limiting the use of technical cookies may hinder or prevent the use of some functionalities of the store.

8. Data Security
We implement appropriate organizational and technical measures to protect your personal data from unauthorized access, loss, or destruction. Our site uses, among other things, the SSL protocol, which encrypts transmitted data (e.g., when filling out forms or during the ordering process). Access to your data is granted only to authorized persons who are obliged to maintain confidentiality. We regularly update our systems and monitor them for security.

9. Final Provisions
This Privacy Policy is effective from the moment it is published on the site and fulfills the information obligation towards data subjects, in accordance with art. 13 GDPR. The policy may be periodically updated to reflect changes in our store or in legal regulations. We will inform users of any significant changes through a notice on the site or via email (if we have the user's email address). We encourage you to regularly check the content of the Privacy Policy. By using the site after changes have been made, you accept the modified terms of the Policy.

In matters not regulated by this Policy, the provisions of GDPR and other applicable legal acts apply. If you have any questions or concerns regarding the Privacy Policy or the protection of your data in general, please contact us at info@casanookdecor.com – we will be happy to provide any information.