1. General information
This Privacy Policy explains how we process your personal data when you use our online store at miniaturia.eu (the “Store”). It follows the EU General Data Protection Regulation, Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”).
2. Data controller
The controller of your personal data is:
MINIATURIA X AIRLAB Spółka z ograniczoną odpowiedzialnością (a Polish limited liability company)
ul. Stanisławowska 47, 54-611 Wrocław, Poland
KRS: 0001192690, NIP: 8943268068, REGON: 542660024
Contact for personal data matters:
- E-mail: [email protected]
- Phone: +48 503 503 790
- Postal address: as above.
The Controller has not appointed a Data Protection Officer. For all matters relating to the processing of personal data, please use the contact details above.
3. Personal data we process
The data we process depends on how you use the Store. It can include:
a) Identity and contact details: first name, surname, e-mail address, phone number.
b) Addresses: delivery and billing address (street, house or flat number, postal code, city, country).
c) Invoice details for businesses: company name, tax ID, registered office address.
d) Order details: order history, amounts, and the payment and delivery methods you chose.
e) Login details: your e-mail address and encrypted password, only if you create an account.
f) Technical data about your visit: IP address, device ID, browser type and version, operating system, cookie data, and the pages you visited.
g) Your messages: what you send us through the contact form or by e-mail.
h) Marketing data: your marketing consents, newsletter subscription history, and how you respond to our campaigns.
We do not process special categories of personal data, such as data about your health, religion or political views.
4. Purposes and legal bases of processing
We process your personal data for the following purposes and on the following legal bases:
Purpose | Legal basis (GDPR) | Retention period |
Conclusion and performance of the sales contract, including order handling, delivery, payment processing, communication about the order | Art. 6(1)(b) GDPR — performance of a contract | Until the limitation period of contractual claims expires (generally 6 years) |
Operating a Customer account in the Store | Art. 6(1)(b) GDPR — performance of a contract for electronic services | Until the Customer deletes the account |
Issuing and storing invoices and other accounting documents, tax settlements | Art. 6(1)(c) GDPR — legal obligation (Polish Tax Ordinance, Accounting Act, VAT Act) | 5 years from the end of the calendar year in which the tax payment deadline expired |
Handling complaints and returns | Art. 6(1)(b) and (c) GDPR | Until the limitation period expires (generally 6 years) |
Newsletter distribution and marketing of our own products and services | Art. 6(1)(a) GDPR — consent | Until consent is withdrawn |
Handling enquiries sent via the contact form or e-mail | Art. 6(1)(f) GDPR — legitimate interest (responding to enquiries) | Up to 12 months after correspondence ends |
Ensuring the security of the Store, fraud detection, traffic analysis, statistics | Art. 6(1)(f) GDPR — legitimate interest | Up to 12 months |
Pursuit and defence of claims | Art. 6(1)(f) GDPR — legitimate interest | Until the limitation period expires |
5. Recipients of personal data
We may share your personal data with the following categories of recipients, only to the extent necessary to achieve the purposes listed above:
a) payment service providers — Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) — to the extent necessary for payment processing;
b) carriers and courier companies — InPost S.A., DPD Polska Sp. z o.o., DHL Parcel Polska Sp. z o.o., Poczta Polska S.A. — to the extent necessary for delivery;
c) store platform and hosting provider — Odoo S.A. (Chaussée de Namur 40, 1367 Grand-Rosière, Belgium);
d) CDN and security provider — Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA);
e) accounting firm — to the extent necessary to maintain accounting documentation and tax settlements;
f) e-mail service provider — Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland;
g) marketing and analytics tool providers — if used (e.g., Google Analytics — Google Ireland Limited);
h) public administration and judicial authorities — in cases provided for by law.
All recipients listed above process data on the basis of data processing agreements (art. 28 GDPR) or on the basis of legal provisions.
6. International transfers (outside the EEA)
Some of our service providers are based, or process data, outside the European Economic Area (EEA). This applies mainly to the United States (Cloudflare and possibly Google). We transfer data to them only on one of these bases:
a) an adequacy decision of the European Commission, for providers registered under the EU-U.S. Data Privacy Framework;
b) Standard Contractual Clauses (SCC) approved by the European Commission, in all other cases.
To get a copy of these safeguards, e-mail us at [email protected].
7. Your rights
In connection with the processing of personal data, you have the following rights:
a) right of access (art. 15 GDPR) — the right to obtain information about whether and what of your data we process and to receive a copy;
b) right to rectification (art. 16 GDPR);
c) right to erasure ("right to be forgotten", art. 17 GDPR);
d) right to restriction of processing (art. 18 GDPR);
e) right to data portability (art. 20 GDPR);
f) right to object (art. 21 GDPR) — including against profiling, for processing based on legitimate interest;
g) right to withdraw consent (art. 7(3) GDPR) — at any time, without affecting the lawfulness of processing carried out before the withdrawal (applies only to data processed on the basis of consent, e.g., newsletter);
h) right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.
To exercise the above rights, please contact: [email protected]. We will respond without undue delay and no later than within 1 month of receipt of the request (this period may be extended by another 2 months in justified cases).
8. Providing your data is voluntary
You do not have to give us your personal data. But we need it to conclude and carry out your purchase contract, create your account, issue an invoice, or send you our newsletter. Without the required data, we cannot do these things.
9. Automated decision-making and profiling
We do not make decisions in a fully automated manner, including by profiling, that would produce legal effects or similarly significantly affect you (within the meaning of art. 22 GDPR).
10. Cookies
You can read about the cookies our Store uses in our Cookie Policy: miniaturia.eu/cookie-policy.
11. Changes to the Privacy Policy
We reserve the right to amend this Privacy Policy. We will inform you of changes by publishing a new version on the Store's website and — in justified cases — by e-mail. The current version of the Policy is always available at miniaturia.eu/privacy-policy
12. Contact
If you have any questions about this Privacy Policy or the way we process your personal data, please contact:
- E-mail: [email protected]
- Postal address: MINIATURIA X AIRLAB Sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław