Privacy Policy

The controller of your personal data is Karol Jaśkowiak, a sole trader registered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. Łagiewnicka 9, 50-512 Wrocław, Poland, VAT ID PL8982081316, REGON 384092757 (referred to below as "we", "us", "Perfumiarz").

Contact for data protection matters:

• e-mail: info@perfumiarz.pl
• postal address: ul. Łagiewnicka 9, 50-512 Wrocław, Poland
• telephone: +48 534 457 685
  
  

This policy covers our online store at perfumiarz.com and perfumiarz.pl (the "Store"), as well as our business correspondence, newsletter and social media profiles.

We have not appointed a Data Protection Officer — please contact us directly using the details above.

Data you give us:

• when placing an order: name, delivery address, e-mail address, phone number and, for business purchases, company name, address and VAT number;
• when creating an account: e-mail address and password (stored in encrypted form), optionally address details;
• when subscribing to the newsletter: e-mail address, optionally first name;
• when contacting us: whatever you include in your message (e-mail, contact form, chat, phone, social media);
• when filing a complaint or withdrawing from a contract: the data needed to handle the case, including your bank account number for the refund;
• when leaving a product review: your name or signature, rating, review text and optionally a photo.

Data collected automatically:

• IP address, browser type and version, operating system, country and language, referring page, date and time of visit, pages and products viewed, cookie identifiers;
• this data is collected by the Store software (Shopify) and, to the extent you consent, by the analytics tools described in section 9.

Special category data (such as health data) is not collected, and we ask you not to include it in your correspondence. If you ask us about skin sensitivity, allergies or tolerance to specific raw materials, we process that information solely in order to answer your question, on the basis of your explicit consent given by sending us such a message (Art. 9(2)(a) GDPR).

Third-party data. If you give us another person's data (for example a gift delivery address), we assume you are entitled to do so and that you have informed that person that their data has been passed to us and about this policy.

• Fulfilling your order and the sales contract, including delivery, payment, returns and complaints
  Legal basis: Art. 6(1)(b) GDPR — performance of a contract
  Retention: For the term of the contract, then until the applicable limitation periods expire
• Operating your user account
  Legal basis: Art. 6(1)(b) GDPR — performance of a contract for electronic services
  Retention: Until you delete the account or ask us to delete it
• Issuing and storing invoices and accounting records
  Legal basis: Art. 6(1)(c) GDPR — legal obligation (Polish Accounting Act, Tax Ordinance, VAT Act)
  Retention: 5 years from the end of the calendar year in which the tax payment deadline fell
• Handling complaints and withdrawals from contract
  Legal basis: Art. 6(1)(c) GDPR — legal obligation
  Retention: 5 years (accounting records) / until claims become time-barred
• Answering enquiries, including advice on fragrance raw materials
  Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in responding to enquiries addressed to us
  Retention: Up to 3 years from last contact, unless the correspondence is relevant to establishing or defending claims
• Sending the newsletter
  Legal basis: Art. 6(1)(a) GDPR — consent, in conjunction with Art. 398 of the Polish Electronic Communications Law
  Retention: Until you withdraw consent; proof of consent and its withdrawal is kept for up to 3 years afterwards
• Direct marketing of our products to customers (e.g. notice that a raw material is back in stock)
  Legal basis: Art. 6(1)(f) GDPR — legitimate interest; for electronic contact — consent under Art. 398 of the Electronic Communications Law
  Retention: Until you object or withdraw consent
• Inviting you to review a product you bought, and publishing the review
  Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in collecting and displaying reviews of our offer; for e-mail invitations — consent under Art. 398 of the Electronic Communications Law
  Retention: Reviews are published indefinitely, until you ask us to remove them or object
• Store analytics and statistics
  Legal basis: Art. 6(1)(a) GDPR — consent to analytics cookies
  Retention: As set out in the cookie table (section 9)
• Establishing, pursuing or defending claims
  Legal basis: Art. 6(1)(f) GDPR — legitimate interest
  Retention: 6 years (consumer and most civil claims) or 3 years (business-related claims), counted to the end of the calendar year
• Store security, fraud and payment abuse prevention
  Legal basis: Art. 6(1)(f) GDPR — legitimate interest
  Retention: Server and anti-fraud logs: up to 12 months

Where the same information is processed for several purposes, we keep it for the longest of the periods above.

Providing data is voluntary, but:

• without the data marked as required we cannot conclude a contract or ship your order;
• providing invoicing data is required by tax law;
• without an e-mail address we cannot create an account or send the newsletter.

We use service providers that process data on our behalf under data processing agreements (Art. 28 GDPR), or that act as separate controllers:

• Shopify International Limited (Ireland) and Shopify Inc. (Canada) — our e-commerce platform: hosting, order and account management, transactional e-mails and newsletter, store analytics;
• payment providers, acting as separate controllers for the transactions they handle:
• Stripe Payments Europe, Limited (Ireland),
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg),
• ING Bank Śląski S.A. (Poland) — the imoje payment service;
• Judge.me Ltd (United Kingdom) — product review system;
• carriers and postal operators: DHL, DPD, InPost, UPS, Poczta Polska;
• Kancelaria Podatkowo-Rachunkowa Agnieszka Kowalska — our accounting office;
• Google Ireland Limited — business e-mail and office tools (Google Workspace);
• Meta Platforms Ireland Limited — our Instagram and Facebook profiles;
• legal and debt collection service providers, where we need to pursue claims;
• public authorities, only where we are legally obliged to disclose data.
  
  

We do not sell your data and we do not share it with third parties for their own marketing purposes. We do not use Google Analytics or the Meta pixel.

Some of our providers process data outside the EEA. Any such transfer relies solely on the mechanisms set out in Chapter V GDPR:

• Shopify Inc. (Canada) — the European Commission's adequacy decision for Canada (for organisations subject to PIPEDA); our contracting entity is Shopify International Limited in Ireland;
• Shopify and Stripe, to the extent they use infrastructure in the United States — the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses together with supplementary safeguards;
• Judge.me Ltd (United Kingdom) — the European Commission's adequacy decision of 19 December 2025 confirming an adequate level of data protection in the United Kingdom;
• Google Ireland Limited and Meta Platforms Ireland Limited — our contracting entities are Irish; where data reaches infrastructure in the United States, the basis is the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.
  
  

You can request a copy of the safeguards we rely on by writing to info@perfumiarz.pl.

We collect reviews using Judge.me. We only invite people who actually bought the product, and only such verified reviews are published — so you can be confident the ratings come from real customers. We publish the name or signature given by the reviewer, the rating and the review text. You can ask us to remove your review at any time by writing to info@perfumiarz.pl. We do not send review invitations to anyone who has previously objected to such messages.

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). To the extent you consent in the cookie settings, we tailor content in the Store to you (for example recently viewed products and recommendations) based on your browsing and purchase history. You can withdraw that consent at any time by changing your cookie settings; withdrawal does not affect the lawfulness of processing carried out beforehand.

The Store uses cookies and similar technologies (local storage, pixels, tags). The legal basis is Art. 399 of the Polish Electronic Communications Law of 12 July 2024 and, as regards personal data, the GDPR.

Strictly necessary cookies are used without your consent — the Store will not work without them. They handle the cart, logged-in sessions, language and currency selection, payment, security and abuse prevention.

Analytics and functional cookies are only set after you consent in the banner shown on your first visit. Consent is voluntary, can be given partially and withdrawn at any time via the “Cookie settings” link in the Store footer. Refusing consent does not limit your ability to shop.

• Strictly necessary
  What they do: Cart, login, payment, currency and language, security and abuse prevention
  Providers: Shopify, Stripe, PayPal
  Retention: Session to 12 months
• Functional
  What they do: Remembering preferences, recently viewed products, correct display of the review widget
  Providers: Shopify, Judge.me
  Retention: Up to 12 months
• Analytics
  What they do: Visit statistics, traffic sources, content and campaign performance
  Providers: Shopify (built-in store analytics)
  Retention: Up to 12 months
  
  

You can also delete and block cookies in your browser settings (Chrome, Firefox, Safari, Edge) — see your browser's help pages. Blocking strictly necessary cookies may make it impossible to place an order.

You have the right to:

• access your data and obtain a copy of it;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten") — except for data we must keep under tax and accounting law;
• restriction of processing;
• data portability for data processed on the basis of a contract or consent, in a structured, machine-readable format;
• object to processing based on our legitimate interest, on grounds relating to your particular situation; an objection to direct marketing, including profiling, is always honoured without condition;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (newsletter — the unsubscribe link in every message; cookies — the settings link in the Store footer);
• lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

We handle requests without undue delay and within one month; for complex requests this may be extended by a further two months, and we will tell you if that happens. We may ask for additional information to confirm your identity.

We apply technical and organisational measures appropriate to the risk: SSL/TLS encryption of connections, access control based on permissions and two-factor authentication, written authorisations and confidentiality undertakings for our staff and contractors, data processing agreements with our providers, and regular backups.

We run profiles on Instagram and Facebook. For the statistics of those profiles we are joint controllers with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; how the platforms themselves process data is described in their own privacy policies. Data you send us in private messages is processed in order to answer your enquiry.

We may update this policy, for example when the law or the tools we use change. The current version is always available in the Store together with its effective date. We will inform registered users by e-mail about material changes.

Version history:

• 2.0 — 29 August 2026 — updated after the move to perfumiarz.com, aligned with the Polish Electronic Communications Law, with recipients, third-country transfers and retention periods clarified.

Want to exercise your rights or ask about this policy? Write to contact@perfumiarz.com.

This is a translation of the Polish-language policy. In case of any discrepancy, the Polish version prevails.