Privacy policy
ART&DOLL ONLINE STORE PRIVACY POLICY
This Privacy Policy applies to people using the online store available at artndoll.pl, referred to below as the “Store”.
It explains what personal data we process when you use the Store, create an account, place an order, make a payment, contact us or subscribe to the newsletter, if one is available.
If you have any questions about your personal data, please contact us at kontakt@artndoll.pl.
§ 1. DATA CONTROLLER
The controller of your personal data is Craft & Wonder Group sp. z o.o., with its registered office at ul. Wałowa 42A, 87-103 Mała Nieszawka, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001257311, NIP 8792778770 and REGON 545351795, referred to below as the “Controller”.
You can contact the Controller about the processing of your personal data:
- by email: kontakt@artndoll.pl;
- by post: Craft & Wonder Group sp. z o.o., ul. Wałowa 42A, 87-103 Mała Nieszawka, Poland.
The Controller has not appointed a Data Protection Officer.
§ 2. DATA PROTECTION LAW
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, known as the General Data Protection Regulation (“GDPR”), and other applicable laws.
Personal data means information relating to an identified or identifiable natural person.
§ 3. DATA WE PROCESS
When you place an order, we may process your name, billing and delivery addresses, email address, telephone number, order details, selected delivery method and payment status. If you make a purchase in connection with a business activity, we may also process your company name and Polish tax identification number (NIP).
If you create an account in the Store, we also process information connected with your account and order history.
If you contact us, we process the information included in your message and the details needed to respond and handle your enquiry.
If you subscribe to the newsletter, we process your email address and any other information you provide voluntarily when subscribing.
When you use the Store, technical data may also be processed, including your IP address, information about your device and browser, information about your use of the website and data stored in cookies. The scope of this data depends on the Store functions used and your consent settings.
§ 4. PURPOSES AND LEGAL BASES OF PROCESSING
We process personal data for the following purposes and on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Concluding and performing a sales contract, accepting and processing an order, contacting you about an order, arranging delivery and handling payment | Article 6(1)(b) GDPR — processing necessary to perform a contract or take steps at your request before entering into a contract |
| Creating and maintaining a customer account | Article 6(1)(b) GDPR — performance of the agreement to maintain the account |
| Handling withdrawals, returns and complaints, and fulfilling related statutory obligations | Article 6(1)(c) GDPR — compliance with a legal obligation; where applicable, also Article 6(1)(b) GDPR |
| Issuing and retaining sales documents and complying with tax and accounting obligations | Article 6(1)(c) GDPR — compliance with a legal obligation |
| Responding to enquiries that are not related to an existing contract | Article 6(1)(f) GDPR — our legitimate interest in handling correspondence; if the enquiry concerns entering into a contract, Article 6(1)(b) GDPR may apply |
| Establishing, pursuing or defending legal claims | Article 6(1)(f) GDPR — our legitimate interest |
| Keeping the Store secure and operating properly, and detecting errors or misuse | Article 6(1)(f) GDPR — our legitimate interest |
| Preparing basic statistics about the Store’s operation, where this does not require technologies subject to consent | Article 6(1)(f) GDPR — our legitimate interest |
| Sending newsletters and commercial information electronically | Article 6(1)(a) GDPR — your consent, where required; applicable electronic communications laws also apply |
| Using optional analytics or marketing tools based on cookies or similar technologies | Article 6(1)(a) GDPR — your consent, where required |
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.
§ 5. PAYMENTS
To handle payments, we provide the selected payment service provider with the data needed to carry out the transaction. The scope of data shared depends on the payment method you choose.
Autopay S.A. provides online payment processing within Shoper Payments Autopay. If you choose this payment method, the data needed to process your payment may be shared with Autopay S.A.
If you choose another available payment method, the data needed to process it may be shared with the relevant payment service provider or bank.
A payment service provider may also process the data it receives as a separate data controller, in accordance with the privacy information it provides.
§ 6. RECIPIENTS OF PERSONAL DATA
We share personal data only to the extent necessary for a particular purpose. Recipients may include:
- Shoper S.A., as a provider of the software and services used to operate the Store;
- Autopay S.A., other payment service providers and banks, depending on the payment method selected;
- courier companies, postal operators and logistics providers;
- providers of hosting, IT infrastructure, email services and technical support;
- accounting, tax and legal service providers;
- invoicing software providers;
- newsletter service providers, if we use such services;
- analytics and marketing service providers, where their use complies with applicable law and your consent settings;
- public authorities, where disclosure is required by law.
Some recipients process personal data on our behalf. Others act as separate data controllers, depending on the nature of the service they provide.
§ 7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
We primarily process personal data within the European Economic Area (“EEA”).
If we use a service provider whose services involve transferring data outside the EEA, we use an appropriate mechanism provided for under the GDPR. Depending on the circumstances, this may include a European Commission adequacy decision or standard contractual clauses.
You can ask us about the mechanism used for a particular transfer by emailing kontakt@artndoll.pl.
§ 8. HOW LONG WE KEEP PERSONAL DATA
We keep data relating to an order for the time needed to perform the contract and afterwards for the period required by law or needed to establish, pursue or defend legal claims.
We retain tax and accounting records for the period required by applicable law.
We process customer account data while the account is active. After the account is closed, we retain it only to the extent and for the time needed to comply with legal obligations or protect against claims.
We keep correspondence for the time needed to handle the matter and, where justified, for the time needed to establish, pursue or defend claims.
We process data based on consent until you withdraw that consent, unless another legal basis permits further processing.
We keep data processed on the basis of our legitimate interests until those interests cease to apply or you successfully object, taking into account any other applicable legal basis.
§ 9. YOUR RIGHTS
Where provided for under the GDPR, you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- request the erasure of your data;
- request the restriction of processing;
- receive or transfer your data in cases where the right to data portability applies;
- object to processing based on our legitimate interests;
- object at any time to the processing of your data for direct marketing, including profiling related to such marketing;
- withdraw your consent at any time where processing is based on consent;
- lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you believe that the processing of your data infringes the GDPR.
To exercise your rights, email us at kontakt@artndoll.pl.
§ 10. PROVIDING PERSONAL DATA
Providing personal data is generally voluntary. However, without the data needed to conclude and perform a contract, we may be unable to accept or fulfil an order, deliver a Product or maintain a customer account.
Providing information needed to issue documents required by law may be necessary under applicable regulations.
Providing data for the newsletter is voluntary. Refusing to subscribe does not affect your ability to place an order.
§ 11. NEWSLETTER AND WITHDRAWAL OF CONSENT
If the Store offers a newsletter, we send it to people who have subscribed and provided any consent required by law.
You can unsubscribe at any time using the unsubscribe link in an email, if available, or by contacting us at kontakt@artndoll.pl.
You can change or withdraw your consent to optional cookies and similar technologies using the consent management tool available in the Store.
§ 12. COOKIES AND SIMILAR TECHNOLOGIES
The Store uses cookies and similar technologies. These are pieces of information stored on or read from your device when you use the website.
The Store may use:
- essential cookies, needed for the Store, basket, session, login and security features to work;
- functional cookies, which remember selected settings and preferences;
- analytics cookies, which help us understand how the Store is used;
- marketing cookies, used, among other things, to measure advertising effectiveness and tailor marketing content.
Where required by law, optional cookies and similar technologies are used only after you give your consent. The consent management tool allows you to accept all optional categories, reject them or select individual categories.
You can later change or withdraw your cookie consent. You can also manage cookies through your browser settings. Restricting essential cookies may affect some Store functions.
If we use analytics or advertising tools that require consent, they operate in accordance with the settings you choose.
More detailed information about the cookies currently used, their providers and how long they remain active may be available in the Store’s consent management tool.
§ 13. SERVER LOGS AND PROFILING
The Store’s server may automatically record technical information in logs, including information about connections, devices, browsers, the date and time of events, and errors. We use this information primarily to keep the Store secure and operating properly.
If we use analytics or marketing tools, we may analyse how the Store is used, which Products are viewed or purchase history to tailor the content displayed, in accordance with applicable law and the consents given.
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
§ 14. DATA SECURITY AND UPDATES
We use technical and organisational measures appropriate to the risks involved in processing to protect personal data against unauthorised access, loss, alteration or destruction.
Access to personal data is limited to people who need it to carry out their duties and authorised service providers working with us.
If your details change, you can update them in your customer account, if this function is available, or contact us at kontakt@artndoll.pl.
§ 15. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy, particularly if the law, the way the Store operates, or the services and technologies we use change.
The current version of this Privacy Policy is available in the Store at artndoll.pl.
Last updated: 28 September 2026
Newsletter
