Privacy policy

This English translation is provided for convenience. The Polish version is binding.

1. Controller

The controller of personal data is Sebastian Rivera Studio (brand INKANDELAS), ul. Krzywe Koło 2/4, 00-270 Warsaw, Poland, NIP: 5223092757, REGON: 36737124900000 (the “Controller”). Contact about personal data: kontakt@inkandelas.com or by post to the address above.

We process data in line with Regulation (EU) 2016/679 (GDPR), the Polish Act on Providing Services by Electronic Means and the Polish Personal Data Protection Act.

2. What data we process and why

1. Shop orders – name, delivery address, email, phone number, invoice details, order details. Purpose: concluding and performing the sales contract, delivery and payment (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR).
2. Workshop bookings – name, email, phone number, number of people, date and time, any notes. Purpose: performing the workshop contract, sending the confirmation and allowing date changes (Art. 6(1)(b) GDPR).
3. Customer account (if created) – login details, order and booking history (Art. 6(1)(b) GDPR).
4. Contact form – name, email, message. Purpose: replying to the message (Art. 6(1)(f) GDPR – the Controller’s legitimate interest in communicating with people who contact it).
5. Newsletter – email address, sign-up date. Purpose: sending news about new pieces and events (Art. 6(1)(a) GDPR – consent, which can be withdrawn at any time).
6. Complaints, returns and claims – data needed to handle them (Art. 6(1)(b), (c) and (f) GDPR).
7. Visit statistics (only if you agree in the cookie banner) – data about how the website is used, collected by Google Analytics. Purpose: understanding how visitors use the website (Art. 6(1)(a) GDPR – consent, which you can withdraw under “Cookie settings”).
8. Website security – IP address and basic technical data in server logs, to protect against abuse (Art. 6(1)(f) GDPR).

Providing data is voluntary, but necessary to place an order, make a booking or receive a reply.

3. Recipients

We share data only as far as needed for the purposes above:

• the payment operator PayPro S.A. (Przelewy24) – online payments,
• InPost sp. z o.o. – parcel delivery,
• Google (Google Workspace, Google Analytics) – the Controller’s email and booking calendar, and visit statistics,
• Spectro Web Solutions – website administration and maintenance, under a data processing agreement,
• the hosting provider – storing the website’s data,
• accounting service providers – for sales documents.

Some of these providers (e.g. Google) may process data outside the European Economic Area. This happens under GDPR mechanisms such as a European Commission adequacy decision or standard contractual clauses.

4. How long we keep data

• orders and bookings – for the period required by tax and accounting law and until any claims are time-barred,
• contact form messages – until the conversation ends, and then as long as needed for any follow-up on the same matter,
• newsletter email address – until consent is withdrawn,
• customer account – until it is deleted.

5. Your rights

You have the right to access your data, correct it, have it erased, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To use these rights, write to kontakt@inkandelas.com.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw).

6. Cookies

Information about cookies is in the Cookies policy.