Gustavson /// store documents
Privacy policy
The most important in a nutshell: We process only the data necessary to maintain the account, pricing, orders, and contact information. We do not sell personal data, and you can withdraw your consent to the newsletter with one click.
01 / Data Administrator
The controller of personal data is GUSTAVSON Sp. z o.o., with its registered office in Pruszcz Gdański, ul. Grunwaldzka 103a, 83-000 Pruszcz Gdański, NIP 604-023-90-70, KRS 0001033819. For matters concerning personal data, write to orders@gustavson.pl or send a letter to the address of the registered office.
02 / What data do we process and why?
- Account in the store: email address, password (in encrypted form), name and surname, addresses. Basis: contract for the provision of the account service (Article 6(1)(b) of the GDPR).
- Verification of a B2B partner: NIP, company name, business profile, region, contact details. Basis: actions before concluding a cooperation agreement (letter b) and our legitimate interest in verifying the contractor (letter f).
- Inquiries about pricing, orders and invoices: orderer’s data, product configuration, delivery address, invoice data. Basis: execution of the contract (letter b) and tax and accounting obligations (letter c).
- Complaints and warranty: the reporting party's data, order number, description and photos. Basis: legal obligations and performance of the contract.
- Contact form and email: the data provided in the message. Basis: a legally justified interest, i.e. the handling of correspondence (point f).
- Newsletter: email address. Basis: consent (letter a), which you can withdraw at any time via a link in the message body.
- Comments on the blog: the content of the comment, the signature, the email address, the IP address and the browser signature (they help detect spam). Basis: a legally justified interest.
03 / To whom we disclose data
We entrust data exclusively to entities that help us run the store and only to the extent necessary: the provider of the website hosting and email services, the provider of the email delivery system (Brevo, servers in the European Union), courier companies and carriers handling deliveries, the accounting office, the providers of the store’s software, and, when necessary, legal advisors. The contact form is protected by the Google reCAPTCHA service, and the embedded videos may come from YouTube; the use of these services is subject to Google’s privacy policies. We do not sell personal data.
04 / How long we store data
- Account: for the duration of its existence, and after its removal for the period of limitation of any claims.
- Orders, quotes and invoices: 5 years from the end of the tax year, in accordance with accounting regulations.
- Complaints: during the time of consideration and the period of limitation of claims.
- Newsletter: to withdraw consent.
- Correspondence and comments: for the time necessary to handle the case and defend against claims.
05 / Your rights
You have the right to access your data, have it corrected, have it deleted, have the processing restricted, and have the data transferred; you also have the right to object to processing based on a legitimate interest. You can withdraw your consent (e.g. for the newsletter) at any time, without affecting the legality of any earlier processing. We process requests through orders@gustavson.pl. You are also entitled to file a complaint with the President of the Office for Personal Data Protection (uodo.gov.pl).
06 / Cookies files
The site uses cookies: essential (logging in, shopping cart, consent settings; without them the store does not work) and, with your consent, analytical and functional ones. You manage this consent at any time on the Cookie Settings page. Login cookies expire after two weeks at the latest, preference cookies after a year. Embedded content from other sites (e.g. videos) may store their own cookies according to the terms of those sites.
07 / Transferring data outside the EEA
As a rule, we process data within the European Economic Area. If using Google services (reCAPTCHA, YouTube) involves the transfer of data outside the EEA, this is done based on approved mechanisms such as standard contractual clauses or an adequacy decision.
08 / Policy changes
We update the policy when the regulations or the way the store operates change. The current version is always available on this page.
Date of last update: September 25, 2026