SkarbyPRLu Privacy Policy

• Orders and contract fulfilment: name, email, phone number, delivery address, order data and selected delivery options. The basis is taking steps at the customer's request and performance of a contract (Article 6(1)(b) GDPR).
• Payments: email address, amount, description and order or payment-link identifier. Data is processed to perform the contract and confirm and secure the payment (Article 6(1)(b) and (f) GDPR).
• Accounting and invoices: data required by tax law, including company details and tax number when an invoice is requested. The basis is the controller's legal obligation (Article 6(1)(c) GDPR).
• Enquiries and individual quotations: name, email, optional phone number, message, photos and furniture details. The basis is pre-contractual steps or the legitimate interest in handling correspondence (Article 6(1)(b) or (f) GDPR).
• Newsletter: email address and selected language. The basis is voluntary consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.
• Website security: basic technical information such as IP address, request time and error information where necessary to protect the service and diagnose problems. The basis is the controller's legitimate interest (Article 6(1)(f) GDPR).
• Website analytics: after voluntary consent, Google Analytics may process information about visited pages, approximate device information, traffic source and actions such as adding a product to the cart or submitting a form. We do not send names, email addresses, phone numbers or delivery addresses to Analytics. The legal basis is consent (Article 6(1)(a) GDPR).

Online payments are processed through Paynow. Online card payments are processed by Autopay S.A. We provide payment operators only with the information necessary to create, settle, confirm and secure the transaction, in particular the email address, amount, description and payment identifier.

The customer enters card data directly in the payment operator's environment. SkarbyPRLu does not receive or store the full card number, CVC/CVV code or online banking authentication credentials.

Data may be entrusted or disclosed only as necessary to the following categories of recipients:

• Paynow and Autopay S.A. — online and card payment processing;
• Supabase — database and application data storage;
• Google Cloud — website and server-service hosting;
• Google Ireland Limited — Google Analytics, only after consent to analytics has been granted;
• Brevo and email providers — transactional email and newsletter delivery;
• accounting service providers or public authorities where required by law;
• the selected carrier — information required to carry out the accepted delivery.

Processors acting on our behalf operate under appropriate agreements and our documented instructions.

• order data — for the duration of the contract and then until the applicable limitation periods expire;
• accounting records — for the period required by tax law, generally 5 years;
• enquiries — until correspondence ends, and longer only where necessary to establish or defend claims;
• newsletter data — until consent is withdrawn or the newsletter service ends;
• security logs — for the period necessary to protect and diagnose the website.
• Google Analytics data — according to the configured user-level data retention period, up to 14 months, unless consent is withdrawn earlier;

Where provided by the GDPR, you have the right to:

• access your data and receive a copy;
• rectify your data;
• request erasure or restriction of processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent at any time without affecting prior lawful processing.

Requests may be sent to kontakt@skarbyprlu.pl. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.

The website uses data necessary for operation, including maintaining the cart, selected language and secure administrator session. This does not require consent because without it some shop functions could not work correctly.

Google Analytics is enabled only after selecting “Accept analytics”. Before that, the Google script is not downloaded and the website does not send analytics data to Google. Consent is voluntary and does not affect browsing products, using the cart, placing orders or sending enquiries.

The choice can be changed at any time using the “Cookie settings” link in the footer. After consent is withdrawn, further analytics collection stops and available Google Analytics cookies are removed from the browser. Cookies can also be deleted or restricted in browser settings.

This policy may be updated when the law, service providers or website operation changes. The current version and effective date are always published on this page.