Privacy policy

Privacy Policy of the artafon.com shop

Version 2026-10-27, effective from 2026-10-27

This policy explains in plain language what data we collect, why, how long we keep it, who we pass it on to and what rights you have. It also covers cookies (Section 16). You do not accept this policy – it is information that we are obliged to give you.

Section 1. Who is responsible for your data

The controller of your personal data is ARTAFON Artur Kiryłowicz, ul. Asnyka 32 d, 40-696 Katowice, NIP 9541915394, EU VAT number: PL9541915394, REGON (statistical number) 273269667 (referred to below as “we” or “ARTAFON”). We run the artafon.com shop and are the manufacturer of the products sold in it.

For any matter concerning your data, write to contact@artafon.com, call +48 729 881 097 (working days 8–16) or send a letter to the address above. We have not appointed a data protection officer – you contact us directly.

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). “Electronic Communications Law” means the Polish Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej; Journal of Laws – Dz.U. 2024, item 1221).

Section 2. Key points in brief

• We only collect the data needed for a purchase, an account, a reply to a message or the newsletter.
• You sign in to your account with a password or with Google, and a one-time code from an e-mail only confirms your address when you create an account or change the password; we never see your password – we store only its encrypted hash. We do not see your card details – payments are handled by payment providers.
• We do not sell data. We do not profile customers, we do not do remarketing and we have no social media pixels on the website.
• Google Analytics and Google Customer Reviews only work if you give your consent in the cookie banner. Without consent, the website does not load their scripts.
• We load a YouTube (Google) video on an installation instructions page only after you click “Play video”. Until then, your browser does not connect to YouTube or Google in connection with the video (Section 9).
• We only send the newsletter once you have confirmed your subscription in the e-mail. You can unsubscribe at any time.
• We only send an e-mail asking for your opinion about your purchase on Google with your voluntary consent given at checkout: at most one message per order. You can withdraw your consent at any time (Section 8).
• In the shop's database, we keep the IP address only for the limits that protect against abuse, for no longer than 24 hours.
• Among other things, you have the right to access your data, to correct it and to have it deleted (Section 14).

Section 3. Where we get data from and whether you have to provide it

You give us most of the data directly: at checkout, in your account, in forms and when you subscribe to the newsletter. Some data is created when you use the shop, e.g. the order number and date, the history of its statuses and the log of e-mails sent.

From other parties, we only receive:

• from the payment provider – confirmation of payment: the transaction ID, amount, currency and payment status;
• if you have a partner account – the result of the verification of your VAT number in the EU VIES system or in the UK VAT register.

Providing data is voluntary. However, without the data marked as required in the form, we will not accept an order, create an account, reply to a message or subscribe you to the newsletter. We have to keep some order data because tax law requires it (Section 11).

Section 4. Purchases and payments

You can place an order as a guest or when signed in. We keep the cart of a person who is not signed in (products, delivery country, the discount code entered) for 60 days from the last change, and then delete it. For an order, we collect:

• your e-mail address and phone number;
• your first name, last name and delivery address (for collection in person in Katowice, we do not collect a delivery address);
• if you want an invoice for a company – the company name, tax ID (NIP) and billing address;
• order notes, the language and currency, the products ordered, the delivery and payment method and the discount code used.

The order receives a number and a link with an access key, which we send in an e-mail – it lets you view the order without signing in. If you later sign in with the same e-mail address, orders placed as a guest will appear in your account. We record the use of a discount code together with the e-mail address so that the code works once per address (the code rules are set out in the Terms and Conditions).

Payments. We do not see your card details or your online banking login details – you give them directly to the payment provider. We pass on to the provider only what it needs:

• Przelewy24 (PayPro SA) – e-mail address, country, language, amount and order number;
• PayPal – amount, currency and order number (you give your own details directly on the PayPal website);
• Revolut – e-mail address, amount, currency and order number.

For a traditional bank transfer, we see the details of your transfer (sender, account number, payment reference, amount) in the history of our bank account. For cash on delivery, the courier collects the amount, and for collection in person – we do. Payment providers also process data as separate controllers, under their own privacy policies, e.g. in connection with the rules on payment services.

Delivery. We send parcels by DPD courier. We pass on to the carrier the data needed for delivery: first name and last name, company name (if you give it), address, phone number and e-mail address, and for cash on delivery also the amount to be paid. For shipments outside the European Economic Area (e.g. to the United Kingdom or the United States), the address data and the description and value of the goods also go to carriers and to the customs authorities of the country of delivery (Section 13).

Partner account. If you buy on the terms for businesses, we verify your VAT number in the EU VIES system (run by the European Commission) or – for the United Kingdom – in the UK VAT register. We record the date, the result and the confirmation number of the verification.

Invoices. We issue invoices outside the shop, in accounting software. We copy into it the data needed for the invoice (Section 12).

Section 5. Customer account

You sign in to your account with your e-mail address and a password, or with Google. You create the account by confirming your address with a one-time code that we send to your e-mail address (the code is valid for 10 minutes) and setting a password; you set a new password the same way if you forget the old one. We never see your password – we store only its encrypted hash in the database. You stay signed in for 180 days, unless you sign out earlier; when you change the password, we sign the account out on all devices.

Signing in with Google. If you choose “Continue with Google”, your browser goes to a Google page (Google Ireland Limited), where you sign in to your Google account; before that it does not connect to Google because of signing in. From Google we receive only the verified e-mail address and the identifier of your Google account – we do not see your Google password. We store that identifier in your account and link it to the shop account with the same e-mail address, or create a new account. For the duration of the hand-off we store a technical cookie in your browser (Section 16) and, for 10 minutes, a one-time marker of the hand-off in the database. Google is responsible for further processing on its side, according to Google's Privacy Policy. Signing in with Google is voluntary – you can always use a password.

In the account, we store: your e-mail address, first name, last name, phone number, company name and tax ID (NIP) (if you give them), saved addresses, the garage (motorcycles added for matching parts), favourite products, the language of messages and your order history. For a partner account – also the account type and the discount assigned to your group.

Accounts from the old shop. We have transferred accounts created in our previous artafon.com shop to this shop: e-mail address, first name, last name, phone number, company name and tax ID (NIP), addresses, orders since 2021 and the hash of your previous password. The controller is the same. Your previous password works at your first sign-in, after which we replace its hash with a new one; we delete the old hash after 180 days at the latest. After the transfer, the account waits for you to accept the Terms and Conditions. When you confirm, we record the date, the version of the Terms and Conditions and the language version that was displayed. This is our proof of acceptance (Art. 6(1)(f) GDPR – our interest: protection against claims). We keep it with the account and, after the account is deleted, in the anonymised account record, without personal data.

Without signing in, the garage stays only in your browser (Section 16). When you sign in, we move it to your account.

You can delete your account yourself in your account details (the “Delete account” button) or by asking us by e-mail at contact@artafon.com. Deletion ends your sign-ins and deletes your saved addresses, garage and favourites, and we anonymise the remaining account data, which means we remove from it everything that could identify you. Orders remain for the period stated in Section 11, because tax law requires it.

Section 6. Contact, complaints and withdrawal from the contract

Contact form. We collect the subject, e-mail address and content of the message. We treat messages and complaints sent to us by e-mail in the same way. No consent is needed – we reply because you ask us to.

Withdrawal form. We collect your first name and last name, the order number or date, your e-mail address and – if you provide it – the list of products being returned. We record the exact time the statement was submitted according to the server clock – this is proof that the statement was submitted on time. We send a confirmation by e-mail.

In both forms, we also record the IP address – solely to limit the number of submissions from one address. We keep it for no longer than 24 hours. The forms also have a hidden trap field for bots; it does not collect any data.

Section 7. Newsletter

You subscribe to the newsletter in the page footer by giving your e-mail address. In it, we send information about new products and offers in the shop. We do not give a discount code for subscribing.

Subscribing has two steps. When you give your address, we send an e-mail asking you to confirm. You confirm your subscription with the button on the page that the link in the e-mail leads to; the link is valid for 7 days. Without confirmation, we do not send the newsletter, and we keep an unconfirmed subscription for no longer than 30 days and then delete it.

We record: the e-mail address, language, subscription status, the dates of subscription, confirmation and unsubscription, the version of the consent text shown when you subscribed and the source of the subscription (the footer form or a subscription carried over from the previous version of the shop). We add each step – subscription, sending the e-mail, confirmation, unsubscription – to the subscription history. This is our proof that we have your consent. We do not record the IP address in the database; we only use it for the limit on subscriptions from one address (Section 10).

We send the newsletter through the Sender.net service (UAB Sender.lt, Lithuania). Once you confirm your subscription, we pass on your e-mail address to it. We send the newsletter without tracking opens and clicks.

You can unsubscribe at any time – using the link in every newsletter or by e-mail to contact@artafon.com. Once you unsubscribe, we stop sending the newsletter. We keep the subscription history for a further 3 years from unsubscribing, in case of a dispute over whether the newsletter was sent with consent. The e-mail address itself stays on the list of unsubscribed addresses, so that the newsletter does not reach you again without new consent. If you subscribe again, this will be a new consent, and the earlier history will be kept.

Section 8. E-mails from the shop

We send the e-mails needed for customer service: the confirmation code (creating an account, changing the password), the order confirmation (with the Terms and Conditions attached), bank transfer details, reminders about unpaid orders, payment confirmation, order status changes and the tracking number, confirmation of withdrawal from the contract, confirmation that we have received a message sent via the form, and a request to confirm your newsletter subscription. These are not advertising messages.

Payment reminders. If an order with online payment (Przelewy24, PayPal, Revolut) is not paid, we send at most two reminders. They show the order number, amount and contents, a link to complete the payment and the date by which you can still pay. For this, we only use data that is already in the order: e-mail address, first name, language, number, amount and products ordered. These are service messages about an order you have placed, without advertising, so we do not need your consent for them (Section 11). We do not send them once the order has been paid or cancelled, nor for a traditional bank transfer, for which we send the transfer details separately.

Review request on Google. At checkout, you can tick an optional box consenting to one e-mail asking for your opinion about your purchase on Google, that is, in our Google Business Profile (in Google Search and Google Maps). This is not the same as Google Customer Reviews in Section 9: we send this message ourselves, through our transactional e-mail provider (Section 12), and Google does not receive any of your data from us. Consent is voluntary: without it, we do not send the request, and we fulfil your order in the same way. If you agree, we send at most one such message per order, no earlier than 10 days after the order has been dispatched or collected in person. We do not send it while a complaint or another matter concerning the order is open, and we do not send it at all after the order has been cancelled or refunded or after withdrawal from the contract (details in the Terms and Conditions). To send it, we use the e-mail address, first name, number and language of the order, and as proof of consent we record in the order the time you gave it and the version of the consent wording. The link in the message leads to a Google page: if you leave a review, you publish it under your Google account, and Google processes your data as a separate controller, under the Google Privacy Policy.

You can withdraw your consent to the review request at any time: using the opt-out link in that message or by e-mail to contact@artafon.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. We keep an exclusion list: we add to it the e-mail address of a person who has opted out of review requests or with whom there is a dispute, together with the reason and the date of the entry, so that we do not send a review request to that address for any order.

We keep a sending log: recipient, type of e-mail, time, sending status and any error. It lets us check whether an e-mail has gone out and resend it. We keep log entries for 12 months. We keep the full content of the order confirmation and of withdrawal confirmations for as long as the order – this is proof of exactly what we sent.

E-mails are sent through an external transactional e-mail provider (Section 12).

Section 9. Statistics (Google Analytics), Google Customer Reviews and YouTube videos

Google Analytics 4 is switched on only if you consent to the “Analytics” category in the cookie banner. Without this consent, the Google script does not load.

Once you consent, Google Analytics collects: the browser identifier stored in the _ga cookies, the pages visited, the traffic source (e.g. a search engine), the approximate location determined from the IP address, the type of device and browser, and events in the shop: adding to the cart, going to checkout and purchase (order number, value, products, discount code). We do not pass your first name, last name, e-mail address or delivery address to Google, and we mask the address of the order page before it is sent to Google.

We use the data only in aggregate statistics – which pages and products are viewed and how the shop is working. We always keep Google's advertising signals (the advertising consents in Consent Mode) switched off, so the statistics data is not used for advertising or remarketing. Google keeps user and event data for no longer than 14 months. The service is provided by Google (Google Ireland Limited and Google LLC); data may be transferred to the USA (Section 13).

Google Customer Reviews is the only service in the “Marketing” category. If you consent to it, once you have placed an order, we load a Google script on the confirmation page. It shows a pop-up asking whether you want to receive a survey about your purchase from Google. The script receives your e-mail address, order number, delivery country and estimated delivery date. The survey is sent by Google, and the ratings collected may be shown in Google services. Google processes this data as a separate controller, under the Google Privacy Policy. Taking part is voluntary: you can decline in the pop-up or opt out later via the link in the message from Google. The shop does not display reviews on its pages.

YouTube videos. On the installation instructions pages, we show videos from YouTube (Google). Until you click “Play video”, you see only a cover image from our own server, and your browser does not connect to YouTube or Google in connection with the video. Once you click, we load the video in YouTube's Privacy Enhanced Mode (the youtube-nocookie.com address). According to Google, in this mode watching the video is not used to personalise YouTube or ads – but this does not mean that Google receives no data. Google then receives your IP address and browser data and, once the video loads, may store cookies or other data in your browser (e.g. in browser storage). Your consent is the click itself – under the cover image, we state that clicking means consent and what will happen. Your consent covers one load of the video: we do not record who clicked and do not ask for this consent in the cookie banner, so you click again for each video and after each page refresh. We do keep the successive versions of the text shown under the cover image and a description of how this mechanism works, so that we can demonstrate how we collect consent. For loading the video and passing this data to Google at the moment you click, we are responsible jointly with Google (joint controllers, Article 26 GDPR): we are responsible for collecting your consent and for the information in this policy, and you can contact us about it (Section 1); you can also contact Google. Google alone is responsible for its further processing of this data, under the Google Privacy Policy; for people in the EEA, the controller on Google's side is Google Ireland Limited. If you do not want the video to load, do not click: you can download the instructions as a PDF from the same page, or watch the video directly on YouTube using the “Watch on YouTube” link (YouTube's own rules then apply). After you refresh or close the page, the video does not load until you click again. You can delete cookies and other data already stored by Google (for the youtube-nocookie.com and youtube.com sites) in your browser settings (Section 16).

Section 10. Security, logs and backups

• The connection to the shop is encrypted (HTTPS). Traffic passes through Cloudflare, which protects the shop against attacks and bots.
• We do not store passwords in plain form or card details. We store passwords, sign-in and cart keys and confirmation codes in the database only in the form of a cryptographic hash, which cannot be read back.
• Only the shop owner and an authorised employee have access to customer data. They sign in to the shop's management system with a password or with Google, and every change made there is recorded in a log (who changed what and when). We keep log entries for 5 years.
• We count the limits on orders, confirmation codes, sign-in attempts and newsletter subscriptions by IP address (the limits on orders and sign-in attempts also by e-mail address). These counters exist only in the server's memory – we do not save them in the database or on disk. Each attempt counts for no longer than 24 hours, and all these counters disappear when the server is restarted. We count the limit on form submissions using the IP address saved with the submission, which we delete within 24 hours at the latest (Section 6).
• The server records technical logs: time, page address, response code and errors. They may contain the IP address and the browser type. Order access keys and data searched for by shop staff are masked in the logs. We keep the server logs for 14 days and then delete them.
• Before changes that cannot be undone with a single click (e.g. a bulk price change), the system makes a copy of the database on the server. We keep database backups for no longer than 90 days and then delete them. Data deleted from the database disappears from a copy when we delete that copy.

Section 11. Purposes, legal bases and retention periods

Purpose	Legal basis	How long
Order: conclusion and performance of the contract, payment, delivery, e-mails about the order (Section 4, Section 8)	Article 6(1)(b) GDPR – contract	until the contract has been performed (delivery, payment, complaints, withdrawal); afterwards we keep the data for the purposes in the rows “Invoices, accounting records and tax settlements” and “Establishing, pursuing and defending claims”, and once the periods in those rows have passed, we anonymise the order
Invoices, accounting records and tax settlements (Section 4)	Article 6(1)(c) GDPR – obligation under tax law	6 years from the end of the year in which the order was placed
Withdrawal from the contract (Section 6)	Article 6(1)(c) GDPR – obligation under the Polish Consumer Rights Act (ustawa o prawach konsumenta), for accepting and settling the withdrawal; afterwards Article 6(1)(f) GDPR – our legitimate interest: protection against claims	6 years from the end of the year in which the order was placed
Messages and complaints – form and e-mail (Section 6)	complaints: Article 6(1)(c) GDPR – obligation under consumer law (replying to the complaint), afterwards Article 6(1)(f) GDPR – our legitimate interest: protection against claims; other matters: Article 6(1)(f) GDPR – our legitimate interest: replying to your message	3 years from sending the message
Customer account (Section 5)	Article 6(1)(b) GDPR – account contract (Terms and Conditions)	until the account is deleted
Newsletter (Section 7)	Article 6(1)(a) GDPR – consent; Article 398 of the Electronic Communications Law	until you unsubscribe; unconfirmed subscription: 30 days
Proof of newsletter consent and list of unsubscribed addresses (Section 7)	Article 6(1)(f) GDPR – our legitimate interest: demonstrating consent and respecting unsubscription	subscription history: 3 years from unsubscribing; address on the list of unsubscribed addresses: for as long as we send the newsletter
E-mail sending log (Section 8)	Article 6(1)(f) GDPR – our legitimate interest: checking whether an e-mail has gone out	12 months
Reminders about unpaid orders (Section 8)	Article 6(1)(b) GDPR – performance of the contract (payment for the order); Article 6(1)(f) GDPR – our legitimate interest: completing the order	we send reminders only within the payment period, that is, for no longer than 14 days from when the order was placed; after that, we keep the order data as in the row “Order”
Review request on Google (Section 8)	Article 6(1)(a) GDPR – consent; Article 398 of the Electronic Communications Law	until the one message is sent or consent is withdrawn
Proof of consent to the review request and exclusion list (Section 8)	Article 6(1)(f) GDPR – our legitimate interest: demonstrating consent and not sending requests to people who have opted out or with whom there is a dispute	proof of consent: together with the order, for the periods in the row “Order”; address on the exclusion list: for as long as we send review requests, unless we remove it from the list earlier
Google Analytics (Section 9)	Article 6(1)(a) GDPR and Article 399(1) of the Electronic Communications Law – consent	until consent is withdrawn; at Google no longer than 14 months
Google Customer Reviews (Section 9)	Article 6(1)(a) GDPR – consent	passed on once; after that, under Google's rules
YouTube videos after a click (Section 9)	Article 6(1)(a) GDPR and Article 399(1) of the Electronic Communications Law – consent given by clicking “Play video”	one-off, when the video loads; we do not record who clicked or any playback data (we keep only the versions of the text under the cover image); after that, under Google's rules
Protection against abuse: limits and bot traps (Section 6, Section 10)	Article 6(1)(f) GDPR – our legitimate interest: security of the shop	IP address: no longer than 24 hours
Server logs and backups (Section 10)	Article 6(1)(f) GDPR – our legitimate interest: security and restoring data after a failure	server logs: 14 days; database backups: no longer than 90 days
Log of shop staff activity: who changed an order or customer data, and when (Section 10)	Article 6(1)(f) GDPR – our legitimate interest: control over who changes data and when	5 years
Establishing, pursuing and defending claims	Article 6(1)(f) GDPR – our legitimate interest: protection against claims	within the periods stated above
Cookies and browser storage necessary for the shop to work (Section 16)	Article 6(1)(b) and (f) GDPR; Article 399(3)(2) of the Electronic Communications Law	according to the table in Section 16

The period for orders results from tax law: documents are kept until the tax liability becomes time-barred (Article 86 § 1 of the Polish Tax Ordinance Act – Ordynacja podatkowa), that is, 5 years from the end of the year in which the tax payment deadline passed (Article 70 § 1 of that Act). After this time, we delete the personal data from the order; only data that cannot identify you (products and amounts), needed for sales statistics, remains.

Section 12. Who we pass data on to

We pass on data only when this is necessary for the given purpose, and only to the extent necessary. Service providers (server, Cloudflare, e-mail, newsletter, accounting, Google Analytics) process data on our behalf, under data processing agreements (Article 28 GDPR). The payment providers, the carrier and Google for Google Customer Reviews are separate controllers. Google also processes, as a separate controller, the data you give it yourself when you leave a review after clicking the link in a review request; we do not pass any data to Google for this (Section 8). For YouTube videos, we are responsible jointly with Google for loading the video and passing on data at the moment you click, and Google alone is responsible for further processing (Section 9).

Recipient	Why and what data	Outside the EEA? (basis)
Hetzner Online GmbH (Germany)	the server on which the shop and the database run – all the data in this policy	no
Cloudflare, Inc. (USA)	domain handling, encryption and protection of traffic – everything you send to the shop passes through Cloudflare, including the IP address	yes – Commission Decision (EU) 2023/1795 (Data Privacy Framework) and standard contractual clauses
Resend, Inc. (USA)	sending e-mails from the shop – e-mail address and content of the e-mail	yes – standard contractual clauses adopted by the Commission (Article 46(2)(c) GDPR), included in the data processing agreement
Zoho Corporation B.V. (Netherlands) – Zoho Mail	the contact@artafon.com mailbox – your correspondence with us	yes – the Zoho group may transfer data to countries outside the EEA, on the basis of standard contractual clauses adopted by the Commission (Article 46(2)(c) GDPR)
PayPro SA – Przelewy24 (Poland)	Przelewy24 payment – data from Section 4	no
PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)	PayPal payment – data from Section 4	no (recipient in the EEA; onward transfers under its own policy)
Revolut Bank UAB (Lithuania)	Revolut payment – data from Section 4	no (recipient in the EEA; onward transfers under its own policy)
DPD Polska sp. z o.o. and the companies it works with in the country of delivery	delivery of the parcel – data from Section 4	for delivery outside the EEA – Article 49(1)(b) GDPR
UAB Sender.lt – Sender.net (Lithuania)	sending the newsletter – e-mail address	no
Google Ireland Limited and Google LLC	Google Analytics, only with consent – data from Section 9	yes – Commission Decision (EU) 2023/1795 and standard contractual clauses
Google (Google Customer Reviews)	purchase survey, only with consent – data from Section 9	yes – Google LLC (USA): Commission Decision (EU) 2023/1795 (Data Privacy Framework)
Google (YouTube): Google Ireland Limited (Ireland)	YouTube video, only after clicking “Play video” – data from Section 9	for people in the EEA the recipient is in the EEA, and Google passes data on to Google LLC (USA) – according to Google, on the basis of Commission Implementing Decision (EU) 2023/1795 (Data Privacy Framework) and standard contractual clauses (Section 13); for people outside the EEA, under Google's privacy policy
Accounting office (Poland) and the provider of the Saldeo accounting software (Poland)	invoices and accounting records – invoice data	no
Public offices, courts and other public authorities	only when the law requires it	no

Section 13. Transfers of data outside the European Economic Area

The European Economic Area (EEA) is the European Union plus Iceland, Liechtenstein and Norway. Data may be transferred outside the EEA in the following situations:

• Cloudflare and Google Analytics (USA) – on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU–US Data Privacy Framework (Article 45 GDPR), for companies on the list of that Framework, and of standard data protection clauses adopted by the Commission (Article 46(2)(c) GDPR);
• delivery outside the EEA – the transfer of data to the carrier and to the customs authorities of the country of delivery is necessary for the performance of the contract (Article 49(1)(b) GDPR);
• Google for Google Customer Reviews (Google LLC, USA) – on the basis of Commission Implementing Decision (EU) 2023/1795 (Data Privacy Framework, Article 45 GDPR), as a separate controller, under its own privacy policy;
• Google for YouTube videos – for people in the EEA, the recipient is Google Ireland Limited (Ireland), and according to its privacy policy Google may transfer data to Google LLC in the USA on the basis of Commission Implementing Decision (EU) 2023/1795 (Data Privacy Framework, Article 45 GDPR) and standard data protection clauses (Article 46(2)(c) GDPR); for people outside the EEA, under Google's privacy policy;
• PayPal and Revolut are established in the EEA, and their onward transfers of data are governed by their own privacy policies;
• Resend (USA), the transactional e-mail provider – on the basis of standard data protection clauses adopted by the Commission (Article 46(2)(c) GDPR), included in the data processing agreement;
• Zoho for the contact@artafon.com mailbox (Zoho Corporation B.V., Netherlands) – the Zoho group may transfer data to other countries where it operates, on the basis of standard data protection clauses adopted by the Commission (Article 46(2)(c) GDPR), under a data processing agreement.

We will send you a copy of the safeguards (e.g. the contractual clauses) if you request it at contact@artafon.com.

Section 14. Your rights

You have the right to:

• access your data and receive a copy of it (Article 15 GDPR);
• rectification of your data (Article 16 GDPR) – you can correct some of it yourself in your account;
• erasure of your data (Article 17 GDPR) – you can delete your account yourself (Section 5); we will not delete data that we have to keep by law (e.g. orders) before the end of the period in Section 11;
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR) – this applies to data that we have received from you and process on the basis of a contract or consent;
• object (Article 21 GDPR) to processing based on our legitimate interest (Article 6(1)(f) GDPR) – on grounds relating to your particular situation, and always in the case of direct marketing;
• withdraw consent at any time (Article 7(3) GDPR), without affecting the lawfulness of what we did before you withdrew it. You withdraw consent to cookies using the “Cookie settings” link in the page footer; consent to a YouTube video covers one load – after you refresh or close the page, the video does not load until you click again, and you can delete cookies already stored by Google in your browser settings (Section 9); you withdraw consent to the newsletter using the link in the newsletter or by e-mail, and consent to the review request using the link in that message or by e-mail (Section 8);
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or with the data protection authority in the country where you live or work (Article 77 GDPR). If you live in the United Kingdom, you can also complain to the Information Commissioner's Office (ico.org.uk).

Send your request to contact@artafon.com. We will reply without undue delay, and at the latest within one month. In complex cases, this period may be extended by two further months – in that case, we will tell you so within the first month (Article 12(3) GDPR). We may ask you to confirm that it is you, e.g. with a message from the e-mail address given in the order. Exercising your rights is free of charge.

Section 15. Profiling and automated decisions

We do not profile customers and we do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Only the simple rules described in the Terms and Conditions work automatically, e.g. calculating the price, the cost of delivery or the discount from a code.

Section 16. Cookies and browser storage

Cookies are small files that a website saves in your browser. Browser storage (localStorage and sessionStorage) works in a similar way. Everything we say below about cookies also applies to this storage. We use three categories – the same ones you see in the cookie banner:

• Essential – always active. Without them, the shop does not work as you expect: cart, sign-in, protection against bots, remembering your cookie decision, the selected currency, the garage, recent searches, returning to the order after payment. They do not require consent, because they are necessary to provide the service you are using (Article 399(3)(2) of the Electronic Communications Law).
• Analytics – only with consent: Google Analytics (Section 9).
• Marketing – only with consent: exclusively Google Customer Reviews (Section 9). We always keep Google's advertising signals switched off. We do not use ads, remarketing or social media pixels.

You give consent to analytics and marketing in the cookie banner (Article 399(1) and Article 400 of the Electronic Communications Law – consent under the GDPR rules). “Reject” is just as easy to reach as “Accept”. Until you decide, only essential cookies are active. If we change the scope of the cookies we use, we will ask for your consent again.

How to change your decision: click “Cookie settings” in the footer of any page. When you withdraw consent to analytics, we switch off measurement and delete the _ga cookies. You can also delete the stored information in your browser settings at any time – this will also remove, among other things, the cart of a person who is not signed in and your cookie decision, so we will ask you for it again.

Below is a list of the cookies and browser storage entries that the shop uses: name, provider, purpose, storage period and category. The Google script may save its own cookies – see Google's policy for details. The list does not include cookies and other data that YouTube (Google) may store after you click “Play video”: that is a separate consent, given by clicking (Section 9). Google decides their names and storage periods and describes them on its cookies page.

Section 17. Links to other websites

In the footer, there are links to our profiles on Facebook, Instagram and YouTube, and on installation instructions pages and product pages with a video, there is a link to the video on YouTube. These are ordinary links – merely displaying them does not load any plug-ins or scripts from these services. Once you go to their pages, their privacy rules apply. The same applies to the pages of payment providers that you go to in order to pay. The only exception is the installation video, which we load from YouTube on an instructions page, but only after you click “Play video” – we describe this in Section 9.

Section 18. Changes to the policy

We change this policy when the way data is processed in the shop or the law changes. Each version shows in its header the date from which it applies. For each order, we record which version of the policy was made available at that time. We keep previous versions and will send them to you on request. We will inform account holders and newsletter subscribers of significant changes by e-mail.