Privacy and Cookies Policy

This is an English translation of the Polish Privacy Policy. In case of any discrepancies, the Polish version prevails.

§ 1. General provisions

1. The controller of personal data collected through www.kufadesign.com is Katarzyna Fober, conducting business under the name Kufa.design, address: ul. Skrajna 19a/8, 43-400 Cieszyn, Poland, Tax ID (NIP): 5482426147, REGON: 524391970 (hereinafter: the “Controller”).

2. You can contact the Controller by e-mail: kufadesign.info@gmail.com.

§ 2. Purposes and legal bases of processing

1. Customers’ personal data (name, e-mail address, phone number, delivery address or chosen parcel locker) is processed in order to:

• fulfil orders, deliver them and handle payments (Art. 6(1)(b) GDPR — performance of the sales contract);
• handle complaints and returns and, where necessary, pursue claims (Art. 6(1)(c) and (f) GDPR);
• meet tax and accounting obligations (Art. 6(1)(c) GDPR — legal obligation);
• reply to messages sent via the contact form (Art. 6(1)(b) or (f) GDPR — steps taken before entering into a contract or our legitimate interest in replying to correspondence);
• protect the store against abuse, such as spam and fake orders — for this purpose the IP address is briefly stored (up to 24 hours) when forms are submitted (Art. 6(1)(f) GDPR);
• collect visit statistics with Google Analytics — only after you give consent in the cookie banner (Art. 6(1)(a) GDPR);
• send the newsletter with news and offers — only if you tick the consent box in the order form (Art. 6(1)(a) GDPR). We then process your e-mail address and first name. You can unsubscribe at any time using the link at the bottom of every newsletter or by writing to kufadesign.info@gmail.com.

2. Providing data is voluntary but necessary to place an order or send a message.

§ 3. Recipients of data

Personal data may only be shared with entities that help us run the store:

• Autopay S.A. (Sopot, Poland) — payment processing;
• InPost sp. z o.o. (Kraków, Poland) — parcel delivery and the parcel-locker map (see § 4);
• OVH sp. z o.o. — website hosting and sending e-mails from the store;
• Google Ireland Ltd. — the e-mail inbox (Gmail) that receives orders and messages and — only with your consent — Google Analytics;
• Sendinblue SAS (Brevo) (Paris, France) — storing the subscriber list and sending the newsletter;
• an accounting office — for accounting documents.

Google may also process data in the USA on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses.

§ 4. InPost parcel-locker map

1. When choosing parcel-locker delivery, the Customer can use the parcel-locker map provided by InPost sp. z o.o. The map loads only after clicking the button to choose a parcel locker on the map — until then the website does not connect to InPost servers.

2. When the map is opened, InPost receives technical data about the device (including the IP address and browser information) and the place typed into the map search, which are needed to display the map. The legal basis is the performance of a contract at the Customer’s request (Art. 6(1)(b) GDPR). Instead of using the map, you can type the parcel-locker code manually.

3. The way InPost processes data is described in InPost’s privacy policy available at inpost.pl.

§ 5. Data retention

• order data — for the period required by tax law (5 years from the end of the year in which the sale took place) and until the deadlines for complaints and limitation of claims have passed;
• messages from the contact form — until the correspondence ends, no longer than 12 months;
• IP addresses stored for spam protection — up to 24 hours;
• e-mail addresses on the newsletter list — until you unsubscribe or withdraw consent;
• Google Analytics data — according to the service settings, up to 14 months.

§ 6. Cookies and browser storage

1. The website uses browser storage (localStorage) and cookies for the following purposes:

• necessary: remembering the contents of your cart, discount code, chosen language (PL/EN) and your choice in the cookie banner. The store could not work without them, so they do not require consent;
• analytics (Google Analytics): website visit statistics — enabled only after clicking “Accept” in the cookie banner.

2. You can withdraw your consent to analytics cookies at any time by clearing the site data in your browser — the banner will then appear again. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

3. The website fonts are loaded from our own server — the website does not connect to Google Fonts.

§ 7. Rights of data subjects

Everyone has the right to access their data, rectify it, erase it, restrict its processing, data portability, object to processing based on legitimate interest and withdraw consent at any time. To exercise these rights, write to kufadesign.info@gmail.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

§ 8. Copyright

1. All sculpture designs, objects, photographs, descriptions and graphics presented on www.kufadesign.com are the property of the creators of the KUFA.design studio and are protected under the Polish Act on Copyright and Related Rights.

2. Copying, reproducing, distributing or using any materials without the Controller’s prior written consent is strictly prohibited.

← Back to the home page