1. Controller
The controller responsible for processing your personal data is Tom-Par sp. z o.o., Chabrowa 36, 05-080 Mościska, Poland, [email protected], +48 696 852 321. Please send privacy requests to [email protected].
2. Personal data we collect
Checkout
When you place an order: first and last name, email address, phone number, delivery address (country, address, apartment/suite, city, postal code), optional order notes, the products ordered, prices, currency, delivery method and any promo code.
Contact form
Your name, email address, optional order number and your message.
Browser storage
Your cart, wishlist, selected currency, recently viewed products and cookie preferences are stored locally in your browser. Order confirmation details are held in session storage. The products and details needed to place an order are sent when you submit checkout. See our Cookie Policy.
3. Purposes and legal bases
- Processing and delivering orders — performance of a contract (Art. 6(1)(b) GDPR).
- Answering enquiries — performance of a contract or pre-contractual steps, or our legitimate interest in responding (Art. 6(1)(b)/(f)).
- Accounting and tax obligations — legal obligation (Art. 6(1)(c)).
- Optional analytics/marketing cookies — your consent (Art. 6(1)(a)); not used unless you opt in.
4. Retention
Order data is retained to fulfil your order, handle complaints and satisfy applicable accounting and tax obligations. The retention period depends on the record and applicable law. Contact us to request information about the retention of your records or their deletion where permitted.
5. Processors and recipients
Hosting and order storage are provided through Lovable Cloud. Delivery carriers receive the information needed to deliver your parcel. Email correspondence uses the store's email service. Contact us for information about the providers handling your order data.
6. International transfers
Hosting or communication providers may process information outside the European Economic Area. Contact us for details of the locations and transfer safeguards applicable to your records.
7. Security
We use technical and organisational measures to protect your data, including encrypted connections, restricted server-side access to order data and access controls that prevent customers' data being read by other visitors.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. To exercise your rights, contact [email protected].
9. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
10. Changes
We may update this policy. The current version is always available on this page.