Privacy policy

ATROPHY privacy policy

Version: 20 October 2026.

1. Data controller

The controller is Paulina Kołodziejczyk, trading as Paulina Kołodziejczyk, ul. Piotrkowska 276A, 90-361 Łódź, Poland. For personal data matters, contact hello@atrophy.pl or write to that address.

2. Data, purposes and legal bases

Depending on how you use the store, we process information supplied when ordering, contacting us, creating an account or subscribing to a newsletter, and information needed for operation and security. This can include name, email, delivery and billing address, telephone number required for a selected service, business details, order and payment status, correspondence, IP address and browser information. Payment providers process payment data necessary for transactions.

• Orders and accounts: performance of a contract or pre-contractual steps, GDPR Article 6(1)(b).
• Accounting, tax records and statutory complaint obligations: legal obligations, Article 6(1)(c).
• Enquiries not directly connected with a contract, fraud prevention and establishment, exercise or defence of claims: legitimate interests, Article 6(1)(f).
• Newsletters and other consent-based activities, including non-essential tracking: consent, Article 6(1)(a). Direct marketing of our own products may rely on legitimate interests where consent is not required for the processing. This does not replace prior consent to marketing communications or device access where required by Polish electronic communications law.

Providing data is voluntary, but fields identified as necessary are needed to conclude or perform a contract or answer an enquiry. Newsletter and non-essential cookie consent is optional and is not a condition of purchase. Consent can be withdrawn and direct marketing objected to without affecting the lawfulness of earlier processing.

If data are obtained from another source, we provide the information required by GDPR, including the source, data categories, purposes, legal bases and rights. Documents supplied with customer enquiries are used for handling the matter, legal obligations and possible claims; supplying them is not marketing consent.

3. Recipients and service providers

Data may be provided to platform, hosting and IT providers, payment operators, delivery companies, accounting and legal advisers, and communication, analytics and marketing providers, only where justified by the service and an appropriate legal basis. Authorities receive data when required by law.

The store uses Shopify. See the Shopify privacy policy and consumer privacy information. The confirmed payment services are ING Pay (ING Bank Śląski S.A.) and Shopify Payments; deliveries are handled by InPost. Payment operators receive information necessary to process, authorise and settle the selected payment and meet legal obligations. InPost receives recipient, address or pickup-point details and contact information needed for the selected delivery service. Shopify processes platform and transaction data as relevant to the service.

Providers may act as processors or independent controllers according to applicable law and their service terms. We do not share data unrelated to the purpose of a payment or delivery service. An external warehouse or fulfilment partner may receive data needed to prepare, dispatch or return an order, under an appropriate legal basis and a processing agreement where required. This does not authorise its unrestricted use for the partner's own marketing.

4. Transfers outside the EEA

International providers, particularly Shopify, may transfer data outside the European Economic Area. Transfers require an appropriate basis, such as a European Commission adequacy decision or standard contractual clauses with necessary safeguards. Contact the controller for information about safeguards and how to obtain a copy.

5. Retention

Order data are retained for contract performance, legally required accounting periods and the period needed for claims. Tax records are generally retained until the tax liability limitation period expires, usually five years from the end of the year in which payment was due; statutory circumstances may change that period. Account data are kept until deletion, except data still needed for legal obligations or claims. Correspondence is kept for handling the matter and related claims. Consent-based data are kept until withdrawal or the end of the purpose, with consent evidence retained as necessary to demonstrate compliance. Legitimate-interest direct marketing data are kept until an effective objection.

6. Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and portability, and may object to legitimate-interest processing and at any time to direct marketing. Withdraw consent by email, newsletter unsubscribe link or cookie settings, as appropriate. You may complain to the President of Poland's Personal Data Protection Office: uodo.gov.pl. We respond within GDPR time limits, normally one month. Where justified doubts exist, we may request information necessary to verify identity.

7. Cookies, analytics and advertising

The store may use cookies and similar technologies essential for carts, payments, login and security, and, depending on active features and your choices, analytics and marketing technologies. Non-essential technologies require prior consent where the law requires it. Simply using the website does not constitute consent.

Non-essential consent must be separate from accepting the terms. Refusal does not prevent an ordinary purchase, and withdrawal should be as easy as giving consent. Use the store's consent controls to manage your choices. Browser settings can additionally restrict or delete cookies; blocking essential cookies may affect functionality. Information about active technologies, providers, purposes and durations should accompany the consent choice. Depending on active tools and consent, activity may be used to personalise recommendations and advertising. You can refuse or withdraw the relevant non-essential consent.

8. Updates

This policy may be updated as services and legal duties change. A policy change does not by itself constitute consent to a new processing purpose.