RYSTOR · A CONSIDERED CREATIVE EVERYDAY
Privacy Policy
Controller and contact
Rystor sp. z o.o., Słoneczna 21A, 86-031 Osielsko, Poland, is the data controller. Contact [email protected] or +48 691 661 771, or use our contact form.
Personal data we collect
Guest checkout collects first/last name, email, phone, delivery country and address, city, postal code, optional apartment and notes, order contents, currency and totals. We do not provide customer accounts or collect card details. Contact forms collect your name, email, optional order reference and message. Newsletter signup is not offered.
Necessary browser storage remembers your shopping bag, wishlist, chosen currency and cookie choices. Hosting/security providers may process limited technical information such as IP addresses, request times and browser information to deliver and protect the site.
Purposes and legal bases
We process order and delivery data to take steps at your request and perform a purchase contract (GDPR Article 6(1)(b)). Accounting and legally required records rely on legal obligations (Article 6(1)(c)). Service security, fraud prevention and proportionate handling of general enquiries may rely on legitimate interests (Article 6(1)(f)), subject to your rights and a balancing assessment. Any future non-essential analytics/marketing would rely on consent (Article 6(1)(a)), which can be withdrawn at any time.
Retention
Order and accounting records are retained for — details will be published soon. Enquiries are retained for — details will be published soon. Any historical subscription data must be reviewed and retained only where a lawful basis remains; no new subscriptions are collected. Technical logs are retained for — details will be published soon. The owner must determine, document and implement these periods before launch.
Recipients and processors
Hosting and database services are provided by Lovable Cloud. An email delivery processor will be used once configured — details will be published soon. Shipping carriers — details will be published soon. Professional accounting or legal advisers may receive records where necessary. Processors must be covered by appropriate agreements. No payment gateway operates in this version.
International transfers
If a provider processes data outside the EEA, the owner must document the destination and applicable safeguards, such as an adequacy decision or standard contractual clauses, and provide details on request — details will be published soon.
Security
Order records are not publicly listable. Guest confirmation links include a private access token; do not share that link. We use appropriate technical and organisational safeguards but no system can promise absolute security.
Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting prior lawful processing. Contact us via the contact form. We may request proportionate information to verify identity.
You may complain to your local supervisory authority or the competent authority for the controller — details will be published soon. There is no solely automated decision-making producing legal or similarly significant effects in this store.
How to make a privacy request
Contact us via the contact form with the right you wish to exercise and enough information to locate your records, such as an order reference. We normally respond within one month; lawful extensions for complex requests must be explained. Requests are generally free, subject to the limited exceptions permitted by GDPR. You do not need an account to exercise your rights.
Children and sensitive information
This store is not designed to knowingly collect children’s personal data. If you believe such data has been submitted, contact the controller. Do not send health details, identity documents or other sensitive information unless specifically and lawfully requested.
Data accuracy and minimisation
Please provide only the information necessary for your order or enquiry. Contact the operator if an address or other detail needs correction. Service providers should receive only the data needed for their role, and access must be limited appropriately.
Optional data and updates
Apartment and notes fields are optional. Required checkout information is necessary to process an order. Do not enter sensitive personal information in order notes. We will update this policy when processing changes.
