Privacy policy

The controller of personal data is TechnOVO Sp. z o.o., NIP 8961596096, Domanice 69, 55-081 Domanice.

For matters concerning personal data write to biuro@stworzto.pl. We reply within one month at the latest, usually much sooner.

Providing the data needed to fulfil an order is voluntary, but without it the contract cannot be concluded or performed. Marketing consents are entirely voluntary and withholding them does not affect your ability to buy.

Data goes only to the entities without which we cannot fulfil an order:

• Carrier — first name, surname, address or parcel locker code, phone and e-mail for delivery notifications.
• Payment operator — the data needed to carry out and settle the transaction.
• Order management system provider — order data goes into the system in which we run production and shipping.
• Accounting office — data from invoices and receipts.
• Hosting and e-mail provider — as a processor, under a data processing agreement.
• Authorised public bodies — only where required by law.

We do not sell data and we do not share it with third parties for marketing purposes.

We use Google Analytics 4 and Google Ads. Both are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics collects data on how you use the site: which pages you visit, for how long, what type of device you use, your approximate location (city level) and what you do in the configurator and cart. Your IP address is truncated and event data is retained for 14 months.

We have Google Signals enabled. If you are signed in to a Google account and have consented to ad personalisation there, Google may link your visit to our shop with that account's data, including across several devices. This gives us aggregated demographic statistics and lets us show ads to people who have already visited the shop. We receive no data that would identify you personally.

Google Ads measures advertising performance. We learn that a click on an ad led to an order of a given value — not who placed it. If you give marketing consent, after a purchase we pass Google the order e-mail address in hashed form (SHA-256, so-called enhanced conversions) — solely to measure ad effectiveness more accurately.

The legal basis is your consent (Article 6(1)(a) GDPR), given in the banner on your first visit. Until you give it, Google scripts run in a restricted mode (Consent Mode) and store no identifiers in your browser.

You may withdraw consent at any time using the “Cookie settings” link in the footer. Google Signals settings are managed directly in your Google account: myactivity.google.com and adssettings.google.com.

Google also processes data in the United States. This takes place under the European Commission's adequacy decision (EU–US Data Privacy Framework), which Google LLC has joined.

With your analytics consent we also use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity records how you move around the site — clicks, scrolling, cursor movement — so we can improve the configurator. Form fields are masked, so the personal data you type is not sent to Microsoft. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in “Cookie settings”; data may be processed in the USA under the EU–US Data Privacy Framework.

Some of the tools we use (e.g. the payment operator or the analytics provider) may process data outside the EEA. This happens solely on the basis of the mechanisms provided for in Chapter V of the GDPR — a European Commission adequacy decision or standard contractual clauses. On request we will share information about the safeguard applied.

At any time you have the right to:

• access your data and obtain a copy of it,
• rectify incorrect data or complete incomplete data,
• erase data — to the extent that we do not have to keep it under tax legislation or to pursue claims,
• restrict processing,
• port data processed on the basis of a contract or consent,
• object to processing based on our legitimate interest,
• withdraw any consent given — without affecting the lawfulness of processing carried out before the withdrawal.

It is enough to send your request to biuro@stworzto.pl.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

We do not take decisions about you based solely on automated processing that would produce legal effects. The price in the configurator is calculated algorithmically from the design parameters — material usage, printing time and the selected extras — but it is identical for everyone who enters the same parameters. We do not differentiate prices based on user data.

We keep the cart and saved designs in your browser's local storage, not on our servers. They do not reach us until you place an order. Clearing your browser data deletes them irreversibly. Details in the cookie policy.

The connection to the shop is encrypted. Access to order data is limited to the people who need it to perform their duties, and only to the extent they need. We do not store payment card data — that is handled by the payment operator. Backups of order data and project files are kept only on our own hardware in Poland and are deleted on the same schedule as the originals.