Privacy Policy and Cookie Policy of onvinylstore.com
Version in force from 20 October 2026. This Privacy Policy explains how we process personal data of visitors and customers of the online shop onvinylstore.com (the “Shop”) and of our physical store WINYLOWA, and what rights you have under Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).
1. Data controller
The controller of your personal data is:
OnVinylStore.com Tomasz Sikora ul. Gustawa Morcinka 5/17, 01-496 Warsaw, Poland NIP (tax ID): 8461272953 E-mail: [email protected] ·
In all matters concerning personal data you can contact us at the above e-mail or postal address. We have not appointed a data protection officer, as we are not required to do so.
2. What data we collect
- Account and order data: first and last name, e-mail address, phone number, delivery and billing address, company name and VAT number (business customers), order history, payment method chosen, correspondence with us.
- Payment data: payment is processed by our payment providers (Stripe, PayPal). We receive only confirmation of payment, the last four digits of the card, the payment method and the transaction identifier. We never receive or store full card numbers.
- Technical data: IP address, browser type and version, device type, operating system, language, pages visited, date and time of visit, referring website, and identifiers stored in cookies (see section 9).
- Marketing data: your e-mail address and newsletter preferences, if you have subscribed to our newsletter.
- Reviews and messages: content of product reviews, contact-form messages and e-mails you send us.
Providing account and order data is voluntary, but necessary to create an account and to conclude and perform a sales contract. Without this data we cannot process your order.
3. Purposes and legal bases of processing
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating and maintaining your customer account | Performance of a contract – Art. 6(1)(b) GDPR | Until you delete the account, and afterwards for as long as claims may be raised |
| Processing and delivering your orders, handling payments, contacting you about the order, pre-order and release-date updates | Performance of a contract – Art. 6(1)(b) GDPR | Duration of the contract and the limitation period for claims (up to 6 years) |
| Issuing invoices and receipts, bookkeeping, tax reporting (including EU VAT OSS) | Legal obligation – Art. 6(1)(c) GDPR (Polish accounting and tax law) | 5 years from the end of the tax year in which the transaction took place |
| Handling withdrawals, returns, complaints and the legal guarantee of conformity | Legal obligation – Art. 6(1)(c) GDPR and legitimate interest – Art. 6(1)(f) GDPR | Up to 2 years after delivery plus the limitation period for claims |
| Establishing, exercising or defending legal claims; fraud prevention; shop security | Legitimate interest – Art. 6(1)(f) GDPR | Limitation period for claims; security logs up to 12 months |
| Sending our newsletter and commercial information by e-mail | Your consent – Art. 6(1)(a) GDPR and Art. 13 of Directive 2002/58/EC | Until you withdraw consent |
| Replying to your enquiries sent by e-mail, contact form or messenger | Legitimate interest – Art. 6(1)(f) GDPR | Up to 2 years after the last message |
| Website analytics and measuring the effectiveness of advertising | Your consent to cookies – Art. 6(1)(a) GDPR (see section 9) | Depending on the cookie, up to 24 months |
| Publishing product reviews you submit | Your consent – Art. 6(1)(a) GDPR | Until you withdraw consent or the product is removed |
4. Recipients of your data
We share your data only to the extent necessary with the following categories of recipients, who process it on our behalf under data-processing agreements or as independent controllers where the law requires:
- E-commerce platform and hosting: Shoper (DreamCommerce S.A., Kraków, Poland), which hosts the Shop and the customer database.
- Payment providers: Stripe Payments Europe, Ltd. (Dublin, Ireland) and, where you choose it, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). They process your payment data as independent controllers under their own privacy policies.
- Carriers: InPost sp. z o.o., Poczta Polska S.A. and international courier companies (e.g. DHL, UPS, FedEx, GLS) used for the delivery method you select; they receive your name, delivery address, phone number and e-mail for delivery notifications.
- Order management, invoicing and accounting: providers of order-management software, invoicing software and our accounting office.
- E-mail and newsletter services: providers of transactional e-mail and newsletter delivery.
- Analytics and advertising partners: only if you consent to the respective cookies (see section 9), e.g. Google (Google Analytics, Google Ads, Google Merchant Center) and Microsoft Advertising.
- Public authorities: tax authorities, courts and other bodies, where we are legally obliged to disclose data.
We do not sell your personal data.
5. Transfers outside the European Economic Area
Our core systems are located in the European Union. Some of our service providers (in particular payment, analytics and advertising providers) may transfer data to the United States or other countries outside the EEA. In such cases the transfer is based on a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or on the Standard Contractual Clauses approved by the European Commission, with additional safeguards where necessary. If you order delivery to a country outside the EEA, your delivery data are necessarily transferred to the carrier and customs authorities in that country for the performance of the contract (Art. 49(1)(b) GDPR).
6. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it;
- rectify inaccurate or incomplete data (you can edit most data yourself in your account);
- erase your data (“right to be forgotten”), unless we must keep it under a legal obligation or for legal claims;
- restrict processing in the cases provided by law;
- data portability – receive the data you provided to us in a structured, commonly used, machine-readable format;
- object to processing based on our legitimate interests, including direct marketing, at any time;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You can unsubscribe from the newsletter using the link in every newsletter e-mail or by writing to us. Cookie consent can be changed in the cookie settings available in the footer of the Shop;
- lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also complain to the supervisory authority in the EU country of your habitual residence or place of work.
To exercise your rights, write to [email protected]. We respond within one month; in complex cases this period may be extended by a further two months, of which we will inform you.
7. Automated decision-making and profiling
We do not take decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. Product recommendations in the Shop are based on cookies and browsing behaviour and are not linked to your identity unless you consent to marketing cookies.
8. Data security
We apply technical and organisational measures appropriate to the risk, including TLS encryption of the Shop, access control to the customer database, password hashing, regular backups and restricted access for staff who need the data to process your orders. Payment data are handled exclusively by PCI DSS-certified payment providers.
9. Cookies and similar technologies
- The Shop uses cookies – small text files stored on your device – and similar technologies (local storage, pixels). Cookies may be session cookies (deleted when you close the browser) or persistent cookies (stored for a set period).
- We use the following categories of cookies:
- Necessary cookies – required for the Shop to work: session, login, shopping basket, language and currency selection, security, cookie-consent settings. These are set on the basis of our legitimate interest and Art. 173(3) of the Polish Telecommunications Law and cannot be switched off in the Shop.
- Analytics cookies – help us understand how visitors use the Shop (pages visited, time spent, errors), e.g. Google Analytics. Set only with your consent.
- Marketing cookies – used to measure the effectiveness of our advertising and to show relevant ads on other websites, e.g. Google Ads and Microsoft Advertising. Set only with your consent.
- When you first visit the Shop, a cookie banner lets you accept all cookies, accept only necessary cookies, or customise your choice. You can change your choice at any time via the cookie settings link in the Shop footer, and you can delete cookies in your browser settings. Blocking necessary cookies may prevent you from logging in or placing an order.
- Cookies set by our partners are governed by their own privacy policies: Google, Microsoft, Stripe, PayPal.
10. Children
The Shop is intended for adults. We do not knowingly collect personal data from persons under 16 years of age. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this Policy
We may update this Privacy Policy when our processing activities or the law change. The current version is always available at onvinylstore.com/en_US/i/Privacy-policy/33. Significant changes affecting registered customers are announced by e-mail.