Privacy Policy
In force from 25 September 2026 (previous version: 6 August 2026).
1. Who is the controller
The controller of your personal data is:
Expanding Web Marcin Dancewicz ul. Malinowskiego 1, 59-600 Lwówek Śląski, Poland NIP: 616-145-54-47 · EU VAT: PL6161455447 · REGON: 369984358 Registered in CEIDG, the Polish central register of business activity
Contact for data protection matters: shop@pottery-store.com, tel. +48 666 669 510
We have not appointed a data protection officer, as we are not required to. All data protection matters are handled directly by the controller at the address above.
2. What we collect, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Performing your order and the sales contract | name, delivery address, e-mail, telephone, order details | Art. 6(1)(b) GDPR — performance of a contract | until claims under the contract become time-barred |
| Issuing and keeping accounting records | purchaser details, transaction data, VAT number where an invoice is issued | Art. 6(1)(c) GDPR — legal obligation (Polish accounting and VAT law) | 5 years from the end of the tax year |
| Handling complaints and withdrawals | contact details, order details, content of your request | Art. 6(1)(c) and (b) GDPR | until claims become time-barred |
| Running your customer account | e-mail, password (stored as a hash), order history | Art. 6(1)(b) GDPR | until you delete the account, or after 3 years of inactivity |
| Sending our newsletter | e-mail address | Art. 6(1)(a) GDPR — your consent | until you withdraw consent |
| Defending against and pursuing claims | order and correspondence data | Art. 6(1)(f) GDPR — our legitimate interest | until claims become time-barred |
| Handling orders placed on Amazon or in the InPost mobile app | name, delivery address, telephone where the marketplace provides it, order details — received from the marketplace, not collected by us | Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR for accounting records | accounting records 5 years; we do not copy the delivery address into our own databases — it stays with the marketplace and with the shipping broker and carrier |
| Answering you in the Shop's chat | the content of your messages and anything you choose to write in them (e.g. e-mail, order number); if you ask for a person, the conversation is passed to our help desk | Art. 6(1)(b) GDPR (questions before and after a purchase) and Art. 6(1)(f) GDPR (customer service) | the Shop does not store chat conversations; help-desk tickets until the matter is closed and claims become time-barred |
| Keeping the Shop secure and working correctly | IP address, server logs | Art. 6(1)(f) GDPR — security of the service | 12 months |
Providing your data is voluntary, but without the data marked as required we cannot conclude or perform the sales contract.
3. Who receives your data
The list below is complete and reflects the actual situation as at the date this policy takes effect. It deliberately avoids phrases such as "trusted partners" — if a new recipient is added, this list will be updated before any data is transferred to them.
| Recipient | Role | What they receive | Location |
|---|---|---|---|
| Google Cloud EMEA Limited (Google Cloud Platform) | processor — hosting of the Shop server | all data stored in the Shop | europe-west4 data centre, Netherlands — within the EEA |
| Google Ireland Limited (Google Workspace) | processor — e-mail, including order e-mails sent by the Shop | content of correspondence, e-mail addresses | EU/EEA, with the possibility of support from third countries under Standard Contractual Clauses |
| Stripe Payments Europe, Limited, Dublin (Stripe) | payment service provider — card and online payments (including BLIK) | payment and transaction data, e-mail, billing address, IP address; card details go directly to Stripe, we never see them | Ireland; possible transfer to Stripe, LLC (USA) — see section 4 |
| InPost sp. z o.o., ul. Pana Tadeusza 4, 30-727 Kraków (InPost) | InPost Pay payments, delivery to Paczkomat® parcel lockers and by courier, orders placed in the InPost mobile app | name, telephone, e-mail, delivery address or locker ID, order and payment data | Poland |
| Richert KurJerzy sp. k., Gdańsk (KurJerzy.pl) | shipping broker — we buy courier labels through it | name, delivery address, telephone, e-mail, parcel contents and declared value | Poland |
| The carrier chosen for your parcel — DHL, FedEx or UPS (ordered through KurJerzy.pl) | delivery of your parcel | label data: name, delivery address, telephone and e-mail where the carrier requires them; customs data for deliveries outside the EU | EU; for deliveries outside the EEA also the carrier's companies in the destination country — see section 4 |
| Amazon (Amazon EU S.à r.l. / Amazon Services Europe S.à r.l., Luxembourg) | marketplace — separate controller; the source of orders placed on Amazon | shipping confirmation and tracking number of your Amazon order | EU; Amazon UK Services Ltd for amazon.co.uk (UK adequacy decision) |
| Anthropic, PBC (USA) | AI model provider for the Shop's chat | the content of your chat messages | USA — see section 4 |
| OpenRouter, Inc. (USA) and OpenAI (USA) | AI model providers for our internal assistants that help us run the catalogue, Amazon listings and orders | the order details the assistant works with (order number, products, destination city, postal code and country); no card data | USA — see section 4 |
| IFIRMA S.A., Wrocław (ifirma.pl), our accounting office and the Polish National e-Invoicing System (KSeF) | accounting and invoicing | purchaser data on invoices, transaction data | Poland |
What we do not do:
- The Shop contains no Google Analytics, Google Tag Manager, Meta/Facebook pixel, or any other analytics or advertising tool that tracks users. Verified as at the date of this policy. We count visits with a statistics tool that runs on our own server (Umami): it sets no cookies, stores no identifiers and does not keep full IP addresses.
- We do not carry out profiling and we do not take decisions about you based solely on automated processing, including profiling with legal effects (Art. 22 GDPR).
- We do not sell or share your data with third parties for marketing purposes.
4. Transfers outside the EEA
The Shop's server and e-mail run on infrastructure located within the European Economic Area. Stripe, Anthropic, OpenRouter and OpenAI are based in the USA: transfers to them rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses in the provider's data processing terms. Carriers deliver parcels outside the EEA under Art. 49(1)(b) GDPR, because the transfer is necessary to perform your contract. Where our service providers access data from outside the EEA for technical support purposes, this takes place on the basis of Standard Contractual Clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to the controller.
5. Your rights
You have the right to:
- access your data and obtain a copy of it (Art. 15 GDPR),
- rectification of inaccurate or incomplete data (Art. 16),
- erasure — the "right to be forgotten" (Art. 17), except for data we are required to keep for accounting purposes or to defend against claims,
- restriction of processing (Art. 18),
- data portability — receiving your data in a machine-readable format and having it transmitted to another controller (Art. 20),
- object to processing based on our legitimate interest (Art. 21), including objecting to direct marketing at any time,
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3)).
To exercise any of these rights, write to shop@pottery-store.com. We respond without undue delay and in any event within one month.
Right to lodge a complaint. If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority of our place of establishment:
President of the Personal Data Protection Office (Prezes UODO) ul. Stawki 2, 00-193 Warsaw, Poland — https://uodo.gov.pl
You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.
6. Cookies
The Shop uses cookies that are:
- strictly necessary — maintaining your session, the contents of your basket, your store and language selection, and protecting forms against abuse. These do not require consent, because the service cannot function without them;
- The Shop uses no analytics, advertising or tracking cookies. This is why you will not see a cookie consent banner — there is nothing to consent to.
If we ever introduce cookies that require consent, a consent mechanism will appear before those cookies are set, not afterwards.
You can change cookie settings in your browser; disabling strictly necessary cookies will make it impossible to place an order.
7. Security
The connection to the Shop is encrypted (HTTPS). Passwords are stored only as cryptographic hashes — we do not know your password and cannot recover it. Access to data is limited to those who need it to operate the Shop.
8. Changes to this policy
We will give 14 days' notice of any material change — on the Shop's website and, for account holders, by e-mail as well. The date this policy takes effect is shown at the top.