Privacy Policy
In force from 6 August 2026.
1. Who is the controller
The controller of your personal data is:
Expanding Web Marcin Dancewicz ul. Malinowskiego 1, 59-600 Lwówek Śląski, Poland NIP: 616-145-54-47 · EU VAT: PL6161455447 · REGON: 369984358 Registered in CEIDG, the Polish central register of business activity
Contact for data protection matters: shop@pottery-store.com, tel. +48 666 669 510
We have not appointed a data protection officer, as we are not required to. All data protection matters are handled directly by the controller at the address above.
2. What we collect, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Performing your order and the sales contract | name, delivery address, e-mail, telephone, order details | Art. 6(1)(b) GDPR — performance of a contract | until claims under the contract become time-barred |
| Issuing and keeping accounting records | purchaser details, transaction data, VAT number where an invoice is issued | Art. 6(1)(c) GDPR — legal obligation (Polish accounting and VAT law) | 5 years from the end of the tax year |
| Handling complaints and withdrawals | contact details, order details, content of your request | Art. 6(1)(c) and (b) GDPR | until claims become time-barred |
| Running your customer account | e-mail, password (stored as a hash), order history | Art. 6(1)(b) GDPR | until you delete the account, or after 3 years of inactivity |
| Sending our newsletter | e-mail address | Art. 6(1)(a) GDPR — your consent | until you withdraw consent |
| Defending against and pursuing claims | order and correspondence data | Art. 6(1)(f) GDPR — our legitimate interest | until claims become time-barred |
| Keeping the Shop secure and working correctly | IP address, server logs | Art. 6(1)(f) GDPR — security of the service | 12 months |
Providing your data is voluntary, but without the data marked as required we cannot conclude or perform the sales contract.
3. Who receives your data
The list below is complete and reflects the actual situation as at the date this policy takes effect. It deliberately avoids phrases such as "trusted partners" — if a new recipient is added, this list will be updated before any data is transferred to them.
| Recipient | Role | What they receive | Location |
|---|---|---|---|
| Google Cloud EMEA Limited (Google Cloud Platform) | processor — hosting of the Shop server | all data stored in the Shop | europe-west4 data centre, Netherlands — within the EEA |
| Google Ireland Limited (Google Workspace) | processor — e-mail | content of correspondence, e-mail addresses | EU/EEA, with the possibility of support from third countries under Standard Contractual Clauses |
What we do not do:
- The Shop contains no Google Analytics, Google Tag Manager, Meta/Facebook pixel, or any
other analytics or advertising tool that tracks users. Verified as at the date of this policy.
- We do not carry out profiling and we do not take decisions about you based solely on
automated processing, including profiling with legal effects (Art. 22 GDPR).
- We do not sell or share your data with third parties for marketing purposes.
Recipients that will be added before sales go live (a payment provider and a carrier) will be entered in the table above before any data is passed to them, together with the basis for the transfer. Until then the Shop accepts no payments and ships no orders.
4. Transfers outside the EEA
The Shop's server and e-mail run on infrastructure located within the European Economic Area. Where our service providers access data from outside the EEA for technical support purposes, this takes place on the basis of Standard Contractual Clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to the controller.
5. Your rights
You have the right to:
- access your data and obtain a copy of it (Art. 15 GDPR),
- rectification of inaccurate or incomplete data (Art. 16),
- erasure — the "right to be forgotten" (Art. 17), except for data we are required to keep for accounting purposes or to defend against claims,
- restriction of processing (Art. 18),
- data portability — receiving your data in a machine-readable format and having it transmitted to another controller (Art. 20),
- object to processing based on our legitimate interest (Art. 21), including objecting to direct marketing at any time,
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3)).
To exercise any of these rights, write to shop@pottery-store.com. We respond without undue delay and in any event within one month.
Right to lodge a complaint. If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority of our place of establishment:
President of the Personal Data Protection Office (Prezes UODO) ul. Stawki 2, 00-193 Warsaw, Poland — https://uodo.gov.pl
You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.
6. Cookies
The Shop uses cookies that are:
- strictly necessary — maintaining your session, the contents of your basket, your store
and language selection, and protecting forms against abuse. These do not require consent, because the service cannot function without them;
- The Shop uses no analytics, advertising or tracking cookies. This is why you will not
see a cookie consent banner — there is nothing to consent to.
If we ever introduce cookies that require consent, a consent mechanism will appear before those cookies are set, not afterwards.
You can change cookie settings in your browser; disabling strictly necessary cookies will make it impossible to place an order.
7. Security
The connection to the Shop is encrypted (HTTPS). Passwords are stored only as cryptographic hashes — we do not know your password and cannot recover it. Access to data is limited to those who need it to operate the Shop.
8. Changes to this policy
We will give 14 days' notice of any material change — on the Shop's website and, for account holders, by e-mail as well. The date this policy takes effect is shown at the top.