Privacy policy

DRAFT for legal review. Fields in [brackets] must be filled in before the shop opens. This is a translation; the Polish version prevails.

In force from: [SHOP LAUNCH DATE]

1. Who is responsible for your data

The controller of your personal data is PADVIO sp. z o.o., registered office in [CITY], [REGISTERED ADDRESS], KRS [KRS], NIP [NIP] ("we"). For anything about your personal data, write to info@padvio.com.

2. What data we collect

  • Orders: name, email address, phone number, delivery and billing address, the products ordered and personalisation details (name on the jersey, flag).
  • Payments: payments are handled by Stripe. We never see your full card details. We receive the payment status and basic payment details (for example the payment method and the last digits of the card).
  • Contact form and email: name, email address and your message.
  • Technical data: IP address and basic browser information, processed automatically by our hosting and payment providers to run and secure the site.

3. Why we use it, and on what legal basis

  • Fulfilling and delivering your order, contacting you about it, handling returns and complaints: Article 6(1)(b) GDPR (contract).
  • Issuing proof of sale, bookkeeping and tax: Article 6(1)(c) GDPR (legal obligation).
  • Answering contact-form messages and emails: Article 6(1)(f) GDPR (our legitimate interest in communicating with you).
  • Establishing, pursuing or defending claims, and preventing payment fraud: Article 6(1)(f) GDPR.

Giving us your data is voluntary, but without the details needed for an order we can't accept or deliver it. We don't make decisions based solely on automated processing, including profiling.

4. Who we share data with

We share data only as far as needed for each purpose:

  • Stripe Payments Europe Ltd. (Ireland): payment processing and the payment page.
  • Cloudflare, Inc.: website hosting.
  • [CARRIER]: parcel delivery.
  • Resend (Plus Five Five, Inc.): forwarding contact-form messages to our inbox.
  • Zoho Corporation B.V.: our email service.
  • [ACCOUNTING FIRM]: bookkeeping.
  • Google: the site's fonts (Google Fonts) load from Google's servers, which receive your IP address when they do.

Some of these providers are based or have servers outside the European Economic Area (for example in the USA). In those cases data is transferred under a European Commission decision (EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the European Commission.

5. How long we keep data

  • Order data: for the duration of the contract and the period of liability for conformity; accounting records for 5 years from the end of the tax year in which the tax obligation arose.
  • Data needed to pursue or defend claims: until the claims become time-barred.
  • Contact-form messages: as long as needed to reply, then no longer than [12 months], unless they concern an order or a complaint.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. To use these rights, write to info@padvio.com.

You can also complain to the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

7. Cookies and browser storage

  • The site saves your bag and your light/dark mode choice in your browser's storage (localStorage). This stays on your device, is not sent to us, and is needed for the site to work.
  • We don't use analytics tools or advertising cookies.
  • Stripe's payment page uses its own cookies, for example to prevent fraud. See Stripe's privacy policy: stripe.com/privacy.
  • You can delete data the site has saved at any time in your browser settings.

8. Changes

We'll announce significant changes to this policy on this page. The date of the last update is shown at the top. If the Polish and English versions differ, the Polish version prevails.