PRIVACY POLICY
PRIVACY POLICY
Colors of Faith Online Store
Last updated: 1 August 2026
1. WHO WE ARE (DATA CONTROLLER)
The controller of your personal data is PCMB GROUP Spółka z ograniczoną odpowiedzialnością, with its registered office in Poznań, Poland, at os. Bolesława Chrobrego 37/57, 60-681 Poznań, entered into the Register of Entrepreneurs of the Polish National Court Register (KRS) under number 0001223165, Tax ID (NIP): 9721375717, REGON: 543967090 (the "Controller", "we", "us").
You can contact us about your personal data:
- by e-mail: biuro@kolorywiary.pl
- in writing: os. Bolesława Chrobrego 37/57, 60-681 Poznań, Poland
We process your personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), which applies directly in Ireland and throughout the European Union.
2. WHAT DATA WE COLLECT AND WHY
2.1. Placing and fulfilling orders
Data: name and surname, delivery address, e-mail address, phone number, order details, payment confirmation. Purpose: conclusion and performance of the contract of sale, delivery of your order, handling returns and complaints. Legal basis: Article 6(1)(b) GDPR (performance of a contract). Retention: for the duration of the contract and until the expiry of claims arising from it; accounting documents are kept for the period required by tax law (as a rule, 5 years from the end of the relevant tax year).
2.2. Customer account
Data: e-mail address, password (encrypted), order history, saved addresses. Purpose: maintaining your account and providing account-related services. Legal basis: Article 6(1)(b) GDPR (performance of a contract for electronic services). Retention: until you delete your account.
2.3. Newsletter
Data: e-mail address. Purpose: sending information about products, promotions and content related to the Store. Legal basis: Article 6(1)(a) GDPR (your consent). You may withdraw consent at any time by clicking the unsubscribe link in any newsletter or contacting us; withdrawal does not affect the lawfulness of processing before withdrawal. Retention: until you withdraw your consent.
2.4. Contact and enquiries
Data: e-mail address, name, content of your message. Purpose: responding to your enquiry. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in handling correspondence). Retention: for the period necessary to handle the enquiry and any follow-up.
2.5. Complaints, returns and withdrawal from the contract
Data: name, address, e-mail, order details, bank account number (for refunds). Purpose: handling complaints, returns and refunds. Legal basis: Article 6(1)(b) and 6(1)(c) GDPR (performance of a contract and compliance with legal obligations under consumer law). Retention: until the expiry of claims and for the period required by law.
2.6. Direct marketing and profiling
We may use profiling for direct marketing purposes, for example to send you a discount code, remind you about an abandoned cart, or show you offers matched to your interests. We do not use automated decision-making that produces legal effects concerning you. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in direct marketing) or your consent where required (e.g. for marketing cookies). You have the right to object to processing for direct marketing purposes at any time.
2.7. Statistics and improvement of the Store
Data: anonymised or pseudonymised usage data, device and browser information, approximate location. Purpose: analytics, improving the Store's structure and content. Legal basis: Article 6(1)(f) GDPR (our legitimate interest) and, for non-essential cookies, your consent (see Cookies section).
3. WHO WE SHARE YOUR DATA WITH
We share your personal data only to the extent necessary, with the following categories of recipients:
- E-commerce platform provider (Shopify) - hosting of the Store and order processing;
- Payment providers - processing of your payments (the provider depends on the payment method chosen at checkout);
- Courier and fulfilment companies - delivery of your orders, including our fulfilment partner operating our warehouse in the Republic of Ireland;
- Accounting and IT service providers - to the extent necessary to perform services for us;
- Marketing and analytics providers (e.g. Meta, Google) - only where you have consented to the relevant cookies;
- Authorised employees and contractors - who process data solely for the purposes described in this Policy.
We do not sell your personal data.
4. TRANSFERS OUTSIDE THE EEA
Some of our service providers (e.g. Shopify, Google, Meta) may process data in countries outside the European Economic Area, including the United States. In such cases, transfers are based on safeguards required by the GDPR, in particular the European Commission's adequacy decisions (including the EU-US Data Privacy Framework for certified entities) or Standard Contractual Clauses. You may obtain more information about these safeguards by contacting us.
5. YOUR RIGHTS
Under the GDPR you have the right to:
- access your personal data and obtain a copy of it;
- rectify (correct) your data;
- erase your data ("right to be forgotten"), where there is no legal basis for continued processing;
- restrict processing;
- data portability - receive your data in a structured, commonly used, machine-readable format;
- object to processing based on our legitimate interest, including profiling, and at any time to processing for direct marketing purposes;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at biuro@kolorywiary.pl. We will respond without undue delay and in any event within one month (this period may be extended by a further two months for complex requests, of which we will inform you).
Right to lodge a complaint: if you believe your data is processed unlawfully, you may lodge a complaint with a supervisory authority. In Ireland, this is the Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie. You may also complain to the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl), as the Controller's establishment is in Poland.
6. COOKIES
6.1. What are cookies?
Cookies are small text files stored on your device when you visit the Store. Some are necessary for the Store to function; others are used only with your consent.
6.2. Categories of cookies we use:
- Strictly necessary cookies - required for the operation of the Store (e.g. cart, checkout, security). These do not require consent.
- Analytics cookies - help us understand how visitors use the Store (used only with your consent).
- Marketing cookies - used to display personalised advertising and measure the effectiveness of our campaigns, including tools provided by Meta and Google (used only with your consent).
6.3. Managing cookies
On your first visit you will see a cookie banner where you can accept all cookies, reject non-essential cookies, or choose your preferences. You can change or withdraw your choices at any time via the cookie settings link on the website or in your browser settings. Blocking strictly necessary cookies may prevent parts of the Store from functioning correctly.
7. DATA SECURITY
We apply appropriate technical and organisational measures to protect your personal data, including encrypted connections (SSL/TLS), access controls, and regular updates of the software used to process data. Access to personal data is limited to persons who need it to perform their duties.
8. VOLUNTARY PROVISION OF DATA
Providing your personal data is voluntary, but necessary to place an order, create an account, subscribe to the newsletter or contact us. Without the relevant data, we will not be able to provide the given service.
9. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time, for example when we change service providers or introduce new features. The current version is always available on this page with the "Last updated" date. Material changes will be communicated on the website or by e-mail.