PRIVACY POLICY AND INFORMATION ON PERSONAL DATA PROCESSING

Miłość i Spokój Store – miloscispokoj.pl

1. Personal Data Administrator

The administrator of your personal data is Kreatywne Ścieżki Piotr Kaczorowski, ul. Filarskiego 5/51, 80-536 Gdańsk, NIP: 8882761402, e-mail: kontakt@miloscispokoj.pl, hereinafter referred to as the "Administrator" or "Seller".

In all matters concerning the processing of personal data and the exercise of rights related to their processing, you can contact the Administrator at the e-mail address provided.

2. How we collect data

We obtain personal data:

• directly from you when you place an order, send a message, use the contact form, AI Assistant, subscribe to the newsletter or submit a complaint;
• automatically when using the website, in particular via cookies, analytical tools and server logs;
• from payment operators or financing entities – regarding information regarding the status of payments, installments or leasing.

3. What data do we process?

Depending on the purpose, we may process the following data:

• name and surname;
• email address;
• phone number;
• delivery address;
• Tax Identification Number, company name and other data related to the business activity;
• order information, including the name and parameters of the handpan, selected design, payment method, delivery method and additional notes;
• information relating to a complaint or other product notification;
• the content of messages sent via the contact form, e-mail or AI Assistant;
• information regarding the status of a payment, a request for financing or the conclusion of a contract, if provided to the Seller by the payment operator or financing entity;
• technical data such as IP address, date and time of using the website, device type, operating system, browser type, cookie identifiers and information about how the website is used.

4. Purposes and legal basis of processing

We process personal data for the following purposes:

a) Conclusion and performance of the contract

Data is processed for the purpose of:

• acceptance and execution of the order;
• contact regarding the order;
• preparing the handpan in accordance with the established parameters;
• payment and delivery processing;
• take action at your request before concluding the contract.

The legal basis is Article 6(1)(b) of the GDPR.

b) Handling complaints and other notifications

The data is processed for the purpose of considering complaints, fulfilling obligations related to liability for the conformity of the goods with the contract, and handling other notifications regarding the product.

The legal basis is Article 6(1)(b) and (c) of the GDPR.

c) Fulfillment of legal obligations

Data are processed for the purpose of fulfilling tax, accounting and documentation obligations resulting in particular from the Tax Ordinance, the Goods and Services Tax Act and the Personal Income Tax Act.

The legal basis is Article 6(1)(c) of the GDPR.

d) Answering questions and conducting correspondence

If your inquiry does not directly concern the conclusion or performance of a contract, the data is processed on the basis of Article 6(1)(f) of the GDPR.

The legitimate interest of the Administrator is to ensure contact with website users, answer questions and conduct correspondence regarding the Store's activities.

e) Establishing, pursuing or defending claims

Data may be processed for the purpose of establishing, pursuing or defending against claims related to the activities of the Store.

The legal basis is Article 6(1)(f) of the GDPR. The Controller's legitimate interest is the protection of its rights and legal interests.

f) Ensuring the security of the website

Technical data and server logs may be processed to ensure website security, detect errors, prevent abuse and protect IT systems.

The legal basis is Article 6(1)(f) of the GDPR. The Controller's legitimate interest is to ensure the secure and proper operation of the website.

g) Newsletter and direct marketing

The e-mail address is processed for the purpose of sending the newsletter and information about new products, promotions and offers of the Store only after obtaining consent.

The legal basis is Article 6(1)(a) of the GDPR and the consent required under the provisions of the Electronic Communications Law.

h) Website analytics and determining the source of the visit

Data regarding website usage may be processed using Google Analytics and the WooCommerce Order Attribution mechanism (Sourcebuster) only after consenting to analytical cookies.

Google Analytics is used to analyze how the website is used, while the Sourcebuster mechanism allows us to determine the source of a user's visit and assign it to a possible order.

The legal basis is Article 6(1)(a) of the GDPR and consent to store information or access information stored on the user's device.

5. Voluntary provision of data

Providing data is voluntary, however:

• failure to provide the data necessary to conclude and perform the contract will make it impossible to accept or execute the order;
• failure to provide the data necessary to process the inquiry will make it impossible to provide a response;
• Providing a telephone number in the contact form is voluntary, but when ordering, it may be necessary for delivery;
• providing the Tax Identification Number and company details may be necessary when paying by instalments, leasing or issuing a sales document;
• subscribing to the newsletter and consenting to marketing are completely voluntary;
• Refusal to accept analytical cookies does not affect the ability to use the basic functions of the website.

6. Data recipients

Depending on the type of case, personal data may be transferred:

• courier companies and delivery entities;
• entities providing hosting, IT, service, postal and website maintenance services;
• providers of accounting, legal or advisory services;
• newsletter system providers – in the case of subscribing to the newsletter;
• Anthropic Ireland, Limited and entities acting on its behalf – to the extent necessary for the operation of the AI Assistant;
• Google Ireland Limited and entities from the Google group – in connection with the use of Google Analytics and Google reCAPTCHA;
• CookieYes Limited – in connection with the operation of the cookie banner, remembering settings and registering choices regarding consents;
• public authorities, courts and other authorized entities, if the obligation to provide data results from legal provisions.

If the customer is interested in making a payment or obtaining financing via Przelewy24 or LeaseLink, the Seller may send the customer a link leading to an external website of the relevant operator.

The data required in the form is provided directly by the client to PayPro SA or LeaseLink sp. z o. o. These entities are separate data controllers and process data in accordance with their own information obligations and privacy policies.

The seller may receive information from the operator regarding the status of a payment, a financing application or the conclusion of a contract.

Personal data is not sold or transferred to other entities for their own marketing activities.

7. Transfer of data outside the European Economic Area

Some technology service providers may also process data outside the European Economic Area.

In such cases, data is transferred using the mechanisms provided for in Chapter V of the GDPR, in particular:

• on the basis of a decision of the European Commission establishing an adequate level of protection;
• based on standard contractual clauses approved by the European Commission;
• using other safeguards permitted by personal data protection regulations.

Information on the security measures used and the possibility of obtaining a copy thereof can be obtained by contacting the Administrator at: kontakt@miloscispokoj.pl.

8. AI Assistant – Chatbot

The Store Assistant is available on the Store website – the Seller’s proprietary solution, which uses the Claude language model via the API to generate responses.

The service provider for the Seller is Anthropic Ireland, Limited.

When using the AI Assistant, the following may be processed:

• content of the entered message;
• e-mail address or telephone number, if you provide them in the conversation;
• information about the product or order you are interested in;
• technical data such as IP address and date and time of sending the message.

Data is processed for the purpose of responding to and handling your inquiry. The legal basis is:

• Article 6(1)(b) of the GDPR – if the inquiry concerns the conclusion or performance of a contract;
• Article 6, paragraph 1, letter f of the GDPR – for other inquiries. The Seller's legitimate interest is to ensure efficient communication with website users and to provide answers to questions.

The query content is passed to Anthropic to generate a response. With respect to data transmitted via the API, the Seller is the data controller, and Anthropic acts as a processor.

Data may be processed by entities within the Anthropic group and its subprocessors, including outside the European Economic Area. Processing is carried out in accordance with Anthropic's Data Processing Addendum, and data transfers to third countries – to the extent required – are carried out in particular on the basis of standard contractual clauses approved by the European Commission.

Do not enter special categories of data into the chat, such as information about health, ethnic origin, political opinions, religious beliefs or sexual life, or data about other people, unless necessary.

The AI Assistant's responses are generated automatically and may be incomplete or incorrect. Important information, particularly regarding price, availability, instrument specifications, and order terms, should be confirmed directly with the Seller.

9. Cookies and analytical tools

The website uses cookies and similar technologies.

Essential cookies

Necessary cookies are used to ensure the proper and secure operation of the website and to remember basic settings. Their use does not require consent to the extent they are necessary to provide the service requested by the user.

Analytical cookies

Analytical cookies are used to collect information about how the website is used, the number of visits, the subpages visited, the time of use of the website, and the type of device and browser.

Google Analytics is only enabled after you have consented to analytical cookies.

CookieYes

The CookieYes service is used to manage cookie consent. This tool allows us to remember user choices regarding specific cookie categories and document whether consent has been granted or denied.

You can manage your consent to optional cookies using the cookie banner available on the website. You can change or withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Detailed information about the cookies used, their suppliers, purpose and period of operation is available in the cookie settings panel.

You can also delete or block cookies using your browser settings. However, blocking essential cookies may prevent some website features from working properly.

Google reCAPTCHA

The website uses Google reCAPTCHA, a service used to protect forms and other website elements from spam, automated queries, and abuse. In connection with its operation, technical user data may be processed, in particular IP address, device and browser information, and data regarding website usage.

The basis for processing is Article 6(1)(f) of the GDPR. The Controller's legitimate interest is to ensure the security of the website and protect against spam and abuse.

WooCommerce Order Attribution (Sourcebuster)

The store uses the WooCommerce Order Attribution mechanism, which utilizes Sourcebuster technology. This tool allows you to determine the source of a user's visit, such as a search engine, another website, or a campaign, and assign this information to a potential order. Analytical cookies starting with sbjs_.

These files are only used after consenting to analytical cookies.

10. Newsletter and marketing

If you subscribe to the newsletter, your e-mail address will be used to send information about new products, promotions and offers from the Store.

Subscribing to the newsletter is voluntary. You can withdraw your consent at any time:

• via the unsubscribe link in the message;
• by contacting the Administrator at kontakt@miloscispokoj.pl.

Withdrawal of consent does not affect the lawfulness of communications sent before its withdrawal.

11. Data storage period

We store personal data for a period depending on the purpose of processing:

• data related to the order – for the time necessary to perform the contract and then until the expiry of the limitation period for claims related to it;
• tax and accounting documents – as a rule, for 5 years, counting from the end of the calendar year in which the tax payment deadline expired, unless the regulations require a longer period;
• data related to the complaint – for the duration of its consideration and then until the expiry of the limitation period for claims related to it;
• data from the contact form, e-mail or AI Assistant – for the time necessary to respond and complete the correspondence, and then, if the content of the correspondence may be relevant to the establishment, pursuit or defense of claims, until the expiry of the limitation period or until an effective objection is filed, if the basis for processing is the legitimate interest of the Controller;
• data used for the newsletter – until consent is withdrawn or the newsletter is unsubscribed;
• information confirming the granting of consent – for the period necessary to demonstrate the correctness of its obtaining and to defend against any claims;
• analytical data and information stored in cookies – for the period resulting from the settings of a given tool, indicated in the cookies panel, or until consent is withdrawn;
• server logs and security data – for the period necessary to ensure the security of the website, clarify an event or defend against claims.

The storage period may be extended accordingly if required by law, proceedings conducted by a competent authority or the need to pursue or defend claims.

12. Your rights

In cases provided for by law, you have the right to:

• obtain information about data processing and access to your data;
• rectification of incorrect data and supplementation of incomplete data;
• request deletion of data;
• request restriction of processing;
• data transfer;
• object to data processing based on Article 6(1)(f) of the GDPR;
• withdraw consent at any time if the data is processed on the basis of consent.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, please contact the Administrator at: kontakt@miloscispokoj.pl.

You also have the right to lodge a complaint with President of the Personal Data Protection Office, if you believe that your data is being processed in violation of the regulations.

13. Automated decision-making

The Administrator does not make decisions regarding users based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect them.

The AI assistant is used solely to automatically generate answers to questions. It does not make decisions about order acceptance, pricing, financing, complaint resolution, or contract conclusion.

14. Changes to the privacy policy

The privacy policy may be updated in particular in the event of changes in legal regulations, the way the website operates or the services and tools used.

The current version of the policy is always available on the Store's website.

Last updated: 04/08/2026.