Privacy Policy

1. What data we collect and why

Orders

When you buy something we process your name, email address, phone number, shipping address, tax ID (only if you enter one at checkout), the products you ordered and the amount paid. We use this to process, ship and support your order, to email you an order confirmation, and to keep the accounting records required by law.

Legal basis: performance of a contract (art. 6(1)(b) GDPR) and our legal obligations under tax and accounting law (art. 6(1)(c) GDPR).

Payments

Payments are handled by Stripe on its own secure checkout page. We never see or store your full card or bank details — we only receive the payment status and the contact and shipping details you enter at checkout.

Your account

If you create an account we store your email address, your password (only as a secure one-way hash, never in plain text) and your order history, so you can log in and see your orders.

Legal basis: performance of a contract (art. 6(1)(b) GDPR).

Contact form

When you send us a message we store your name, email address, phone number (if you give one), your message and the IP address it was sent from. We use it to reply to you and to protect the form against spam and abuse.

Legal basis: our legitimate interest in answering enquiries and preventing abuse (art. 6(1)(f) GDPR).

Technical data

Like any website, our server processes your IP address and basic request information (for example browser type) to deliver the site, keep it secure and limit abusive traffic.

Legal basis: our legitimate interest in running a secure website (art. 6(1)(f) GDPR).

We do not use analytics, advertising or tracking tools, and we do not sell your data.

2. Who we share your data with

We only share data with service providers that help us run the shop, and only what they need:

• Stripe — payment processing. See Stripe's privacy policy.
• CJ Dropshipping — our fulfilment partner, which packs and ships your order. It receives only what's needed for delivery: your name, phone number, shipping address (street, city, region, postcode and country), our order number, the products and quantities you ordered, their prices, and the chosen shipping method. We do not share your email address, tax ID or account details with CJ Dropshipping.
• Brevo (Sendinblue SAS, France) — sends our transactional emails, such as order confirmations. It receives your email address and the content of the email: your order number, the products you ordered and the amount paid. We don't use Brevo for marketing. See Brevo's privacy policy.
• Shipping carriers — the courier chosen for your parcel receives the details needed to deliver it.
• OVHcloud — our hosting provider, which stores the website and its database on our behalf. See OVHcloud's data protection information.

Some icons on the site are loaded from simpleicons.org, which means your browser sends your IP address to that service when it loads them.

We may also disclose data where we are legally required to, for example to tax authorities.

3. Transfers outside the EEA

Some of our service providers, including CJ Dropshipping, may process personal data outside the European Economic Area (EEA), including in China, in connection with fulfilling and delivering your order.

Where personal data is transferred outside the EEA, we take the measures required by applicable data protection law to ensure that the transfer is carried out lawfully and that your personal data receives an appropriate level of protection.

For more information about the safeguards applicable to a particular transfer, you may contact us using the contact details provided in this Privacy Policy.

4. How long we keep your data

• Orders, invoices and other tax records — for as long as required by applicable tax and accounting laws.
• Your account — until you ask us to delete it, unless we are required to retain certain data by law.
• Contact form messages — up to 12 months after we've finished handling your enquiry.
• Technical logs — kept for a short period for security purposes, then deleted.

5. Cookies and local storage

We only use what is strictly necessary for the site to work, so we don't ask for cookie consent:

• BEARER (cookie) — keeps you logged in after you sign in. It can't be read by scripts and expires after 24 hours or when you log out.
• authEmail (local storage in your browser) — remembers your email so the account menu can show it. Removed when you log out.

Stripe sets its own cookies on its checkout page to process payments and prevent fraud. These are covered by Stripe's privacy policy.

6. Your rights

You have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have your data deleted (unless we must keep it, for example for accounting),
• restrict processing of your data in certain cases,
• object to processing where applicable under the GDPR, including processing based on our legitimate interests,
• receive your personal data in a structured, commonly used and machine-readable format where the right to data portability applies,
• lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

To use any of these rights, email us at support@awkwarduncle.com. We'll respond within one month.

7. Security

The whole site uses an encrypted HTTPS connection, passwords are stored only as secure hashes, and payments are processed entirely by Stripe. Access to customer data is limited to what's needed to fulfil orders.

8. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version.

9. Data controller and contact

The controller of your personal data is:

[COMPANY / OWNER NAME]
[STREET, POSTCODE CITY, POLAND]
Tax ID (NIP): [NIP]
Email: support@awkwarduncle.com

For any question about your data, or to exercise your rights, email us at the address above.