Privacy Policy

§1 Personal Data Administrator

The administrator of personal data is Verano Szwedzicki Spółka Komandytowo Akcyjna with its registered office at ul. Styrska 20, 04-188 Warsaw, entered into the National Court Register under KRS number 0000951761, NIP 5252894838, REGON 521179257, owner of the Ars Tattoo online store available at arstattoo.pl, hereinafter referred to as "the Administrator."

The Administrator processes personal data in accordance with applicable law, in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Personal Data Protection Act.

For matters concerning personal data processing, you can contact the Administrator via e-mail at: sklep@arstattoo.pl.

The Administrator has not appointed a Data Protection Officer.

§2 Scope of Processed Personal Data

The Administrator may process Users' and Customers' personal data to the extent necessary for using the Store, fulfilling orders, providing electronic services, and fulfilling obligations arising from legal provisions.

Depending on the purpose and method of using the Store, the Administrator may process, in particular:

• first and last name,

• e-mail address,

• phone number,

• delivery address,

• billing address,

• company name,

• tax identification number (NIP),

• EU VAT number,

• data regarding orders and purchase history,

• payment data,

• data regarding returns and complaints,

• data provided via forms available in the Store,

• data related to the Customer Account,

• data related to Newsletter subscription,

• data regarding activity in the Store,

• IP address,

• device identifiers,

• data regarding the web browser and operating system,

• information collected using cookies and similar technologies.

Providing personal data is voluntary, but in some cases it may be necessary to conclude or perform a contract, create a Customer Account, fulfill an order, handle a complaint or return, use selected Store functionalities, or fulfill obligations resulting from legal provisions.

§3 Purposes and Legal Bases for Personal Data Processing

The Administrator processes personal data for the following purposes:

  1. Order fulfillment and sales contract performance.

Legal basis:
Article 6(1)(b) of the GDPR.

  1. Creation and maintenance of a Customer Account.

Legal basis:
Article 6(1)(b) of the GDPR.

  1. Handling returns, complaints, and service requests.

Legal basis:
Article 6(1)(b) and (c) of the GDPR.

  1. Handling inquiries sent via contact form, e-mail, or phone.

Legal basis:
Article 6(1)(f) of the GDPR.

  1. Issuing accounting documents, maintaining accounting records, and fulfilling tax obligations.

Legal basis:
Article 6(1)(c) of the GDPR.

  1. Fulfilling obligations arising from legal provisions.

Legal basis:
Article 6(1)(c) of the GDPR.

  1. Sending Newsletters and marketing information.

Legal basis:
Article 6(1)(a) of the GDPR.

  1. Direct marketing of the Administrator's own products and services.

Legal basis:
Article 6(1)(f) of the GDPR.

  1. Analysis of traffic in the Store, statistics, measurement of marketing effectiveness, and development of Store functionalities.

Legal basis:
Article 6(1)(a) or (f) of the GDPR, depending on the type of technology used.

  1. Pursuing claims, defending against claims, and protecting the Administrator's rights.

Legal basis:
Article 6(1)(f) of the GDPR.

§4 Recipients of Personal Data

Personal data may be transferred to entities cooperating with the Administrator only to the extent necessary to achieve the purposes described in this Privacy Policy.

Recipients of data may include, in particular:

• Shopify Inc. and related entities responsible for operating the Shopify platform,

• payment operators, including Shopify Payments, PayPal, Imoje, PayU, and LeaseLink,

• courier and logistics companies, in particular InPost and FedEx,

• providers of accounting, legal, and IT services,

• providers of marketing and analytical services,

• Judge.me, which supports the product review system,

• Reputon, which supports the presentation of Google reviews,

• entities providing newsletter and communication services,

• public authorities authorized to receive data based on legal provisions.

§5 Transfer of Data Outside the European Economic Area

Due to the Administrator's use of technological service providers operating globally, in particular Shopify, Meta, Google, TikTok, and Microsoft, personal data may be transferred outside the European Economic Area.

When transferring data outside the EEA, the Administrator applies legally required measures for personal data protection, in particular standard contractual clauses approved by the European Commission or other mechanisms compliant with applicable legal provisions.

§6 Personal Data Retention Period

Personal data is stored for the period necessary to achieve the purpose for which it was collected.

In particular:

• data related to order fulfillment is stored for the period required by tax and accounting regulations,

• data related to complaints, returns, and claims is stored for the period necessary for their handling and the expiration of any claims,

• Customer Account data is stored until the Customer Account is deleted or an effective objection is lodged,

• data processed based on consent is stored until its withdrawal,

• data related to the Newsletter is stored until the subscription is canceled.

§7 Rights of Data Subjects

The person whose personal data is processed by the Administrator has rights resulting from applicable law, in particular:

• the right to access their personal data,

• the right to rectification of personal data,

• the right to erasure of personal data ("right to be forgotten"),

• the right to restriction of processing,

• the right to data portability,

• the right to object to data processing,

• the right to withdraw consent at any time, if processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise their rights, the data subject can contact the Administrator via e-mail: sklep@arstattoo.pl.

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that the processing of personal data violates applicable law.

§8 Newsletter

The User can voluntarily subscribe to the Newsletter to receive information about news, promotions, products, events, and other activities related to Ars Tattoo's operations.

Providing personal data for Newsletter subscription is voluntary, but necessary for the service provision.

The legal basis for processing personal data in connection with Newsletter delivery is the User's consent, in accordance with Article 6(1)(a) of the GDPR.

The User can unsubscribe from the Newsletter at any time by clicking the appropriate link in the e-mail or by contacting the Administrator.

§9 Marketing, Analytics, and Profiling

The Administrator uses tools that enable traffic analysis in the Store, evaluation of marketing effectiveness, content personalization, and advertising activities.

For this purpose, the Administrator may use, in particular:

• Google Analytics,

• Google Ads,

• Meta Pixel,

• TikTok Pixel,

• Microsoft Clarity,

• Shopify's analytical and marketing tools.

These tools may collect information about the User's activity in the Store, visited pages, source of visit, device used, approximate location, and actions taken.

The Administrator may use the collected information to conduct marketing, remarketing, and statistical activities.

To the extent required by law, these activities are carried out solely based on the User's consent expressed through the cookie management mechanism.

The Administrator does not make decisions that produce legal effects concerning Users solely by automated means.

§10 Cookies and Similar Technologies

The Store uses cookies and similar technologies to ensure the proper functioning of the website, enhance security, analyze traffic, personalize content, and conduct marketing activities.

Cookies may be stored by both the Administrator and by third parties providing services to the Administrator.

The Store may use, in particular:

• essential cookies,

• functional cookies,

• analytical cookies,

• marketing cookies.

The User can manage cookie settings using the tool provided by the Store or their web browser settings.

Restricting the use of certain cookies may affect the proper functioning of selected Store features.

Detailed information regarding the use of cookies can be found in the Cookie Policy.

§11 Final Provisions

The Administrator reserves the right to make changes to this Privacy Policy in the event of changes in legal provisions, methods of personal data processing, implementation of new services, functionalities, or tools used in the Store.

Changes to the Privacy Policy do not affect the rights of data subjects arising from applicable law.

The current version of the Privacy Policy is published on the Store's website.

The Privacy Policy is effective from June 15, 2026.