Privacy policy

kacperogaza.com
Last updated: July 22, 2026

1. Data Controller

The controller of your personal data is: Kacper Ogaza Bacho Ska, operating an individual business activity.

NIP (Tax ID): 9542677324
REGON: 389353040
Address (for correspondence only): ul. Ks. bpa Stanisława Adamskiego 6/34, 40-069 Katowice
E-mail: kacper.ogaza@gmail.com
Phone contact: +48 796 423 431 (available on business days, 10:00 AM–6:00 PM)

2. Legal Bases and Purposes of Processing

I process personal data in accordance with the GDPR for the following purposes:

  • Order fulfillment and shipping: (Art. 6(1)(b) GDPR) – necessary to deliver the purchased painting.
  • Handling complaints and returns: (Art. 6(1)(b) and (c) GDPR) – exercising your consumer rights.
  • Tax and accounting obligations: (Art. 6(1)(c) GDPR) – issuing invoices and retaining financial records.
  • Newsletter: (Art. 6(1)(a) GDPR) – informing you about new works and exhibitions, based on your consent.
  • Product reviews: (Art. 6(1)(a) GDPR) – publishing your review on the site with your consent.
  • Legitimate interest: (Art. 6(1)(f) GDPR) – establishing, pursuing, and defending against claims, maintaining anonymous traffic statistics, and evidentiary purposes (demonstrating GDPR compliance).

3. Data Requirements

  • Delivery address: Due to the nature of the business (shipping only, no option for in-person pickup), providing a delivery address is a necessary condition for fulfilling the contract.
  • Voluntariness: Providing your data is voluntary; however, without it, I will not be able to fulfill your purchase or send you the newsletter.

4. Data Retention Periods

  • Invoices and tax records: For 5 years, counted from the end of the calendar year in which the tax payment deadline fell.
  • Order data: Until the statute of limitations for claims arising from the sales contract expires (in accordance with the Polish Civil Code).
  • Newsletter: Until consent is withdrawn, and thereafter for evidentiary purposes for as long as necessary to defend against claims.
  • Server logs and technical data: Up to 90 days.

5. Recipients of Data

I share your data only with trusted external entities:

  • Shopify Inc. (technical maintenance of the store).
  • Payment operators (e.g., Stripe, PayPal, Klarna).
  • Logistics and courier service providers (delivery of the painting).
  • Accounting office (financial administration).
  • Mailchimp (The Rocket Science Group LLC) – solely with respect to the e-mail addresses of newsletter subscribers.

6. Transfer of Data Outside the EEA (USA/Canada)

Due to the technical infrastructure used by the Store, your data may be transferred to third countries:

  • to Canada (Shopify Inc.) – based on the European Commission's adequacy decision confirming an appropriate level of personal data protection in Canada (Art. 45 GDPR),
  • to the USA (Mailchimp) – based on Standard Contractual Clauses (SCCs) and certification under the EU-U.S. Data Privacy Framework.

Both mechanisms guarantee a level of data security required by the GDPR.

7. Cookies and Browser Technologies

The Store uses cookies and Local/Session Storage technologies necessary for the proper functioning of store features (e.g., shopping cart sessions). I do not currently use advanced marketing tools (Meta Pixel, Google Ads) – should I introduce them, this Policy will be updated and you will be asked for your consent.

8. Your Rights

You have the right to:

  • Access your data and obtain a copy of it (Art. 15 GDPR).
  • Rectification of your data (Art. 16 GDPR).
  • Erasure of your data – the "right to be forgotten" (Art. 17 GDPR).
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR).
  • Object to processing (Art. 21 GDPR).

You may withdraw any consent given for data processing (including for the newsletter and for the publication of reviews) at any time, without affecting the lawfulness of processing carried out before its withdrawal.

9. Complaints and Contact

You have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). However, I encourage you to contact me first: kacper.ogaza@gmail.com – I will do my best to resolve any matter amicably.