Privacy Policy

Date of last update: September 28, 2026.

This Privacy Policy sets out the rules for the processing of personal data of persons using the website. https://elak-art.eu, In particular, those who make purchases, contact via the contact form, and use the online store.

The policy has been prepared in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council („RODO”) and other applicable regulations regarding the protection of personal data.

1. Administrator of personal data

Depending on the type of product purchased, the controller of personal data is the entity that sells the product in question.

Original works of art

In the case of the purchase of an original work of art, the administrator of personal data is:

Elisabeth Kuc
[ADDRESS – FOR ADDING]
[NIP / business data – IF APPLICABLE]

Republishing

In the case of purchasing a reprint, the administrator of personal data within the scope related to the sales process is:

Tomasz Seweryn Investment
Stawy Street 61
43-438 Brenna
Poland
Email: office@elak-art.eu

Contact regarding personal data

In matters related to the processing of personal data, you can contact us at:

office@elak-art.eu

The online store uses a common technical infrastructure, including the WooCommerce system, to handle orders for both original works of art and reprints.

Tomasz Seweryn Investment may also provide technical services related to the functioning of the website and the store for the appropriate data controller.

2. What personal data do we process

Depending on the way the website is used and the type of order, we may process the following:

name and surname;
address of residence or address of delivery;
e-mail address;
phone number;
data necessary for issuing an invoice;
company data, if the customer is making a purchase as an entrepreneur;
order details;
information regarding the selected payment method;
information regarding the delivery;
information provided in the contact form;
information contained in the correspondence conducted;
technical data related to the use of the website, within the scope resulting from the operation of the technologies used.

We do not require the customer to create a user account in order to make a purchase.

3. Data source

We collect personal data primarily directly from the person concerned, in particular during:

ordering;
use of the contact form;
contact via email;
making payments;
providing the data necessary to issue an invoice.

In some cases, payment data or payment status may be transmitted by the payment operator.

4. WooCommerce and order management

The online store uses WooCommerce for order processing.

WooCommerce can process and store data related to the order, in particular customer data, contact details, address information, information about the products purchased, and data necessary for fulfilling the order.

These data are used, in particular, for the following purposes:

acceptance and execution of the order;
preparation of the product for shipment;
contact with the client;
payment processing;
the delivery organization;
issuing an invoice;
handling complaints, returns and other matters related to the order;
the fulfillment of legal obligations.

WooCommerce allows you to make a purchase without having to create a customer account.

5. Purposes of data processing

Personal data may be processed, in particular, for the following purposes:

the execution of the sales contract;
taking action before concluding the contract;
order processing;
payment processing;
the delivery organization;
issuing and storing invoices and accounting documentation;
contacting the customer regarding the order;
responding to inquiries submitted through the contact form;
processing complaints and other reports;
investigations or defense against claims;
ensuring the security and proper functioning of the website;
the performance of obligations arising from the laws.

6. Legal basis for processing

Personal data is processed in accordance with the relevant provisions of the GDPR, in particular:

Art. 6(1)(b) of the GDPR – when processing is necessary for the performance of a contract or for taking action at the request of a person before the contract is concluded.

This applies in particular to order processing, contact with the customer regarding the order, and the organization of delivery.

Art. 6(1)(c) of the GDPR – when processing is necessary for the performance of a legal obligation.

This applies in particular to tax and accounting obligations related to sales documentation.

Art. 6(1)(f) of the GDPR – when processing is necessary for the implementation of the administrator’s legally justified interests.

This applies in particular to ensuring the security of the party, protection against abuse, and the investigation or defense against claims.

Art. 6(1)(a) of the GDPR – if the processing takes place on the basis of the voluntary consent of the person whose data is concerned.

7. Payments

The store allows you to use various payment methods, depending on the current configuration of the store, in particular with payments supported by PayPal, card payments and other available payment methods.

The store uses a plugin WooCommerce PayPal Payments.

In connection with the processing of payments, the data necessary for the transaction may be transferred to the payment operator.

PayPal may independently process personal data in connection with the provision of its services, including for the purpose of payment processing, fraud prevention, risk management, and compliance with legal obligations. Detailed information regarding PayPal’s data processing practices can be found in its Privacy Statement.

The store should not be treated as a data processor for payment card data if these data are processed directly by the payment operator.

8. Delivery of orders

In order to fulfill the order, the data necessary to deliver the purchased product may be provided to the operator selected to fulfill the shipment.

Depending on the method of delivery, the following services may be used:

InPost;
DHL;
DPD;
UPS;
Poczta Polska.

Data provided for the purpose of delivery may include, in particular:

name and surname;
delivery address;
phone number;
e-mail address;
information regarding the shipment.

The data are provided to the extent necessary for the preparation and delivery of the shipment.

If a courier company is operated through an external plug-in or integration platform, data may also be transferred to the provider of that integration to the extent necessary to provide the service.

9. Invoices and accounting documentation

A system is used for issuing and managing invoices. Asari.com.

The data necessary for issuing an invoice can be entered into or transmitted to this system in connection with the execution of a sale.

The scope of this data may include, in particular:

name and surname;
address;
the entrepreneur's data;
NIP;
data regarding the purchased product;
the value of the transaction;
information necessary for the correct issuance of the sales document.

Data related to accounting documentation is stored for the period required by applicable legal regulations.

10. Contact form

The website allows for contact through the contact form.

The data submitted via the form is used to process the request and provide a response.

Depending on the configuration of the website, forms can be handled by the forms plugin and the email system.

The data provided voluntarily by the user is not used for any purpose unrelated to the handling of the request, unless there is another legal basis for their processing.

11. Electronic mail

The WordPress and WooCommerce system messages are sent using a plugin. WP Mail SMTP.

The news may include, among other things:

confirmation of orders;
information regarding the execution of orders;
information regarding payments;
messages related to contact with the customer.

The scope and recipients of data related to the sending of email depend on the configuration of the mail provider and the WP Mail SMTP settings.

12. Service providers and data recipients

Personal data may be transferred to entities supporting the running of the store, in particular:

hosting providers – LH.pl;
payment operators;
courier companies and postal operators;
to courier integration providers;
providers of the billing system – Asari.com;
providers of electronic mail services;
providers of information technology services;
to the providers and operators of the plugins and integrations used;
entities providing accounting services, if they are used;
public authorities or other entities, if the obligation to provide data arises from the provisions of law.

The data is made available to the extent necessary to carry out a specific task or obligation.

13. Data storage

We store personal data for the period necessary to fulfill the purpose for which it was collected.

In particular:

order data – for the period necessary for its execution, handling of any complaints and protection against claims;
data related to accounting and tax documentation – for the period required by the laws;
data related to correspondence – for the period necessary to handle the matter and to potentially protect against claims;
data necessary for the investigation or defense against claims – for the period corresponding to the statute of limitations for these claims, subject to applicable regulations.

After the appropriate period has elapsed, the data is deleted or subjected to anonymization, unless further storage is required by law.

14. Rights of the person whose data are concerned

The data subject has the right, within the limits provided by the GDPR, to:

access to their personal data;
obtaining a copy of the data;
rectification of incorrect or incomplete data;
deletion of data;
restrictions on processing;
data transfers;
to object to the processing of data;
withdrawal of consent in the case of data processing based on consent.

Not all rights can be exercised in every situation. For example, the right to delete data may be limited if further data storage is required by law.

15. How to exercise your rights

To exercise your rights, you can contact us at:

office@elak-art.eu

In the application, it is worth specifying which right the request relates to and what data it concerns.

In justified cases, the administrator may request information that allows the identity of the person submitting the request to be confirmed.

16. Right to file a complaint

If the data subject considers that their personal data are being processed in violation of the regulations regarding the protection of personal data, they have the right to file a complaint with the competent supervisory authority.

In Poland, the supervisory authority is:

President of the Office for the Protection of Personal Data (UODO)

17. Cookies files

The website uses cookies and similar technologies to the extent necessary for the proper functioning of the website and online store.

Cookies can be used in particular to:

keeping the user session;
proper functioning of the basket;
handling the ordering process;
remembering the user's settings;
ensuring the safety of the party.

WooCommerce uses, among other things, cookies related to the shopping cart and the shopping session.

As of the date of publication of this Privacy Policy, the site does not use Google Analytics, Google Ads, or Meta Pixel.

If analytical, advertising or other technologies requiring user consent are implemented in the future, the manner of their use and the mechanism for obtaining the required consents will be appropriately supplemented.

18. Managing cookies files

The user can manage cookie settings using the settings of their web browser.

Disabling or restricting certain cookies may affect the proper functioning of some store features, in particular the shopping cart or the order submission process.

19. Data security

Administrators apply appropriate technical and organizational measures to protect personal data from:

unauthorized access;
loss;
destruction;
change;
disclosure to unauthorized persons;
other forms of unlawful processing.

Access to data is restricted to those individuals and entities who need it to perform the tasks entrusted to them.

20. Automated decision-making and profiling

Administrators do not use customer data to make decisions against them based solely on automated processing that would have legal consequences for them or in a similar way have a significant impact on them.

However, it should be remembered that independent service providers, in particular payment operators, may employ their own security mechanisms, fraud detection or risk assessment in accordance with their own data processing policies. PayPal describes in its current policy, among other things, automatic risk and fraud prevention mechanisms.

21. Transferring data outside the European Economic Area

Due to the use of external technology providers for services such as payments, hosting, email, or other services, data may – depending on the specific configuration of the services – be transferred outside the European Economic Area.

If such a transfer takes place, it is done according to the rules and using the appropriate mechanisms provided for by the applicable regulations on the protection of personal data.

22. No newsletter and direct marketing

As of the date of publication of this Privacy Policy, the store does not operate a newsletter.

Customer data is not used to send a newsletter based solely on the fact of making a purchase.

If a newsletter or other forms of direct marketing is launched in the future, the rules for their operation will be described accordingly, and in cases requiring the user’s consent, this will be obtained before such processing begins.

23. Links to external websites

The site may contain links to external websites.

After switching to the external site, the privacy and cookies policies applicable to the operator of that site apply.

The Administrator is not responsible for the way in which data is processed by the independent external operators of the websites.

24. Changes to the Privacy Policy

The privacy policy may be updated, in particular in the following cases:

changes in the functioning of the store;
changes in the services or providers used;
the implementation of new payment methods;
the implementation of new analytical or marketing tools;
changes in the way data is processed;
changes in the applicable legal regulations.

The current version of the Privacy Policy is published on the website.

Date of last update: September 28, 2026.