Privacy policy

1. General Information

This policy applies to the website (the "Service") operating at the URL: vestes-sacrae.com

The Operator of the Service and the Data Controller is:
NEXTLEVEL STUDIO GRZEGORZ ZAWADA
ul. Nadbrzeżna 15, 66-470 Kostrzyn nad Odrą, Poland
Tax ID (NIP): 5992845127, Business Registry Number (REGON): 08016850400000

Contact details:
Phone: +48 791 444 015
Email: g.zawada@yahoo.pl

The Operator is the Controller of your personal data with respect to data voluntarily provided within the Service.

The Service uses personal data for the following purposes:
- Operating the newsletter,
- Preparing, packaging, and shipping goods,
- Fulfilling ordered services,
- Handling returns and complaints.

The Service collects information about users and their behavior in the following ways:
- Through data voluntarily entered in forms, which is entered into the Operator's systems and the Shopify platform on which the Service operates.
- By storing cookies on users' end devices.

2. Data Security

The Service operates on the Shopify platform, which, as the infrastructure provider, is responsible for the technical security of hosting, including encryption of data transmission (SSL/TLS certificate), securing servers and databases, and applying authentication mechanisms (including two-step verification) for administrative login to the Shopify admin panel. The Operator relies on these safeguards and does not independently store customers' personal data on its own servers or in its own databases.

The Operator ensures data security by:
- Using a trusted service provider (Shopify Inc.), which holds relevant security certifications (including PCI DSS for payment processing),
- Restricting access to the store's administrative panel to authorized persons only,
- Regularly updating the applications and integrations used within the Service.

3. Hosting

The Service is hosted (technically maintained) by: Shopify Inc., 151 O'Connor Street, Ottawa, ON K2P 2L8, Canada, and its affiliated entities (Shopify International Limited in the EU/EEA).

Shopify acts as a data processor within the meaning of the GDPR to the extent that it processes data on behalf of the Operator, under a data processing agreement concluded between the Operator and Shopify. Detailed information on how Shopify processes data is available in Shopify's Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers

As part of hosting and operating the Service, the following may be recorded, among other things:
- Resources identified by URL (addresses of requested resources – pages, files),
- Time of arrival and time of sending a response to a request,
- Information about errors that occurred during the execution of HTTP transactions,
- The URL of the page previously visited by the user (referrer link),
- Information about the user's browser and IP address,
- Information related to the handling of email correspondence sent to and from the Operator.

4. Your Rights and Additional Information on the Use of Data

In certain situations, the Controller has the right to transfer your personal data to other recipients, if necessary to perform the contract concluded with you or to fulfill obligations incumbent on the Controller. This applies to the following categories of recipients:
- Shopify Inc. as the provider of the e-commerce platform and hosting, on the basis of data processing entrustment,
- Payment operators handling payments within the Service (Shopify Payments, Stripe),
- Courier and logistics companies fulfilling order deliveries,
- Authorized employees and associates who use the data to carry out the purpose of the website's operation,
- Companies providing marketing and analytics services to the Controller (Google, Meta).

Your personal data will not be processed by the Controller for longer than is necessary to carry out related activities as specified by separate regulations (e.g., on accounting). With respect to marketing data, the data will not be processed for longer than 3 years.

You have the right to request from the Controller:
- Access to your personal data,
- Rectification thereof,
- Erasure,
- Restriction of processing,
- And data portability.

You have the right to object to the processing of personal data carried out for the purposes of the Controller's legitimate interests, including profiling, provided that the right to object cannot be exercised where there are valid, legitimate grounds for processing that override your interests, rights, and freedoms, in particular the establishment, exercise, or defense of legal claims.

You have the right to lodge a complaint regarding the Controller's actions with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

Providing personal data is voluntary but necessary for the operation of the Service.

You may be subject to automated decision-making, including profiling, for the purpose of providing services under the concluded contract and for the purpose of the Controller's direct marketing.

Personal data may be transferred outside the European Economic Area (including to Canada and the USA, where Shopify's servers and those of entities such as Google and Meta are located). Such transfers are carried out on the basis of appropriate legal mechanisms, including standard contractual clauses approved by the European Commission, ensuring an adequate level of data protection.

5. Information Provided in Forms

The Service collects information voluntarily provided by the user, including personal data, if provided.

The Service may record connection parameters (timestamp, IP address).

Data provided in a form is processed for the purpose resulting from the function of the specific form, e.g., to process an order, subscribe to the newsletter, or handle a business inquiry. In each case, the context and description of the form clearly indicate its purpose.

6. Administrator Logs

Information about user behavior within the Service may be logged by the Shopify platform. This data is used for the purpose of administering the Service and ensuring its proper functioning.

7. Key Marketing Techniques

The Operator uses statistical traffic analysis through Google Analytics (Google LLC, USA). The Operator does not transfer personal data enabling direct identification to the provider of this service, only anonymized or aggregated information. This service relies on the use of cookies on the user's end device. Regarding information about user preferences collected by Google's advertising network, the user may review and edit information resulting from cookies using the following tool: https://myadcenter.google.com/

The Operator uses the Meta (Facebook) Pixel (Meta Platforms, Inc., USA). This technology allows the Meta platform to know that a person registered with it is using the Service. Meta acts as a separate data controller in this respect and is itself responsible for the lawfulness of its processing. This service relies on the use of cookies on the user's end device.

The Operator operates a newsletter, for which subscription requires the voluntary provision of an email address and separate consent. The email address is used exclusively to send commercial and marketing information, until consent is withdrawn.

The Operator may use remarketing techniques, allowing advertising messages to be tailored to user behavior on the website, based on cookies and the tools mentioned above (Google, Meta).

8. Cookie Information

Cookies placed on the User's end device may also be used by entities cooperating with the Operator, in particular: Google (Google Inc., based in the USA) and Facebook (Facebook Inc., based in the USA).

9. Managing Cookies – How to Grant and Withdraw Consent in Practice

If the user does not want to receive cookies, they may change their browser settings. Please note that disabling cookies necessary for authentication, security, and maintaining user preferences may hinder, and in extreme cases prevent, the use of the website.

To manage cookie settings, select the web browser you use from the list below and follow the instructions:
Edge
Internet Explorer
Chrome
Safari
Firefox
Opera

Mobile devices:

Android
Safari (iOS)
Windows Phone