1. Who is responsible for your data?
The controller of your personal data is Morowo - Bartosz Borowiec, ul. Łódzka 153, 95-054 Ksawerów, Poland, tax ID (NIP) 7311041401. For data protection matters, contact: zamowienia@harcerz.pl. The controller has not appointed a Data Protection Officer. Please contact us directly about personal data.
This policy covers harcerz.com.pl, the designer at harcerz.com.pl/kreator and the handling of enquiries and orders. Information on delivery and payments applies to the services you use.
2. What data do we process, and why?
| Purpose and data | GDPR legal basis | Retention period |
|---|---|---|
| Contact and quotations: contact details, correspondence and design. | Article 6(1)(b) — steps taken at the person's request before a contract; for other correspondence, Article 6(1)(f) — our legitimate interest in responding. | Enquiries that do not result in an order: while the enquiry is being handled, then for 12 months after correspondence ends. |
| Contract, neckerchief production, delivery and settlement: name, address, contact details, order details, artwork and invoice details. | Article 6(1)(b); for business representatives, Article 6(1)(f), for contact and management of the business relationship. After performance: Article 6(1)(f) — establishing, exercising or defending claims; for mandatory records, Article 6(1)(c). | We retain order documentation, the approved visual preview, confirmations and relevant correspondence during fulfilment of the contract and then until the applicable limitation period for claims expires. The general six-year period is a reference point, not an automatic retention period for all data: we apply the special periods relevant to the claim and the rules determining when they begin and end. Tax documentation is retained under separate rules. |
| Accounting and tax records. | Article 6(1)(c) — legal obligations. | Tax documentation is generally retained for 5 years from the end of the calendar year in which the tax payment deadline fell, subject to statutory extensions. Other accounting records are retained for the period required by the applicable rules. |
| Complaints, withdrawals, establishing and defending claims. | Article 6(1)(c) — statutory obligations; Article 6(1)(f) — our legitimate interest in protecting rights. | While handling the matter and during the applicable limitation period for claims; in a dispute, also until it ends. |
| Server security: IP address, time, requested resource, browser information and errors. | Article 6(1)(f) — our legitimate interest in security and fault diagnosis. | Routine technical logs are retained for 90 days from recording. |
| Working files and rejected design versions. | Article 6(1)(b) — preparing and fulfilling orders; for necessary evidence relating to claims, Article 6(1)(f). | Unnecessary working files and rejected design versions are deleted no later than 90 days after order fulfilment ends. The approved visual preview remains part of the order documentation. Designs for enquiries without an order are subject to the 12-month period from the end of correspondence. |
Providing data is voluntary, but some details are necessary to respond, conclude a contract, deliver goods or issue documents. Without them, the relevant action may be impossible. We do not ask for data unrelated to the order; please do not include unnecessary third-party personal data in artwork.
Orders are stored on LH.pl servers and handled by us, including through email confirmations. Payment history may be used when individually assessing a deferred payment request. We then process necessary representative details and the signed declaration to assess risk and agree contract terms (Article 6(1)(b) or (f) GDPR, depending on the person's role).
In the event of a complaint, dispute or incident, we retain longer only the data needed to handle the matter and protect rights, for a period justified by the proceedings and applicable law. This does not automatically extend retention of other data.
After the relevant period, we delete or irreversibly anonymise the data unless a separate, current legal basis requires further retention. These periods also cover the email correspondence forming part of the records.
3. Who receives your data?
Where necessary, data may be received by hosting and email providers, technical, accounting or legal service providers, authorised authorities, the Przelewy24 operator once that payment option is enabled, and the selected DHL or InPost carrier. Processors acting on our behalf do so under appropriate agreements; some recipients, such as payment providers, may act as separate controllers.
Providers and roles: website hosting, email and order storage — LH.pl. Orders are handled by the Morowo - Bartosz Borowiec team; confirmations are received by email. We do not currently use additional analytics or advertising tools. We do not transfer personal data outside the European Economic Area (EEA).
4. Your rights
You may request access to and a copy of your data, rectification, erasure or restriction of processing. Data portability applies in the cases specified by the GDPR. You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Withdrawal does not affect processing on another basis, such as retention of accounting records.
Email zamowienia@harcerz.pl. We respond under the GDPR rules and deadlines; if we have reasonable doubts, we may ask for information necessary to verify your identity. You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl.
6. External links and security
Opening the separate designer, a payment provider or an external website connects you to that service. Their technologies require separate checking; this website's settings do not automatically control scripts on other domains. Customers should not send us BLIK codes or bank login details.
Sending an enquiry does not subscribe you to a newsletter. The website has no newsletter or marketing consent forms.
7. Policy updates
We update this policy when purposes, tools, recipients or processing methods change. Updating the document does not replace any consent required by law.