Privacy policy
In short
We only collect data we need to ship your order, issue an invoice and — with your consent — send our newsletter. We do not sell your data. We do not profile you algorithmically for decisions with legal effects.
Controller
ARCALION Sp. z o.o., ul. Jantarowa 1 lok. 25, 89-600 Chojnice, Poland. VAT EU: PL5552147867. KRS 0001240447. GDPR contact: arcaliongroup@gmail.com.
Data Protection Officer
Not appointed (not required at our scale — GDPR art. 37). All requests are handled directly by the Controller.
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Order fulfilment | name, address, e-mail, phone, payment data | art. 6(1)(b) GDPR (contract) | 6 years (limitation period) |
| Invoicing | name/company, VAT ID, address | art. 6(1)(c) GDPR (Polish VAT Act) | 5 years |
| Complaints & returns | order data + ticket content | art. 6(1)(b) and (c) GDPR | 3 years after closure |
| Newsletter | e-mail, first name | art. 6(1)(a) GDPR (consent) | until withdrawal |
| Analytics | anonymous cookies | art. 6(1)(f) GDPR / consent — see Cookies | up to 24 months |
Recipients
Shopify Inc. (store platform, USA — EU SCC); payment processors (Stripe, Przelewy24); couriers (InPost, DPD, DHL, Polish Post); our accountant; Meta and Google — only with your marketing-cookies consent.
Transfers outside the EEA
Some processors (Shopify, Google, Meta) handle data in the USA. Transfers rely on the European Commission's Standard Contractual Clauses (June 2021) and — for Google/Meta — on their EU-US Data Privacy Framework certification. A Transfer Impact Assessment is available on request.
Your rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time. Right to lodge a complaint with the Polish DPA (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). To exercise rights — arcaliongroup@gmail.com.
Version of 28 May 2026.