Skip to main content

  • FREE DELIVERY THROUGHOUT POLAND 

  • WYKONANE W POLSCE

    HANDCRAFTED IN POLAND
English €
Open search engine
Search
Close search engine Clear Search
Wishlist
Products in the cart: 0. See details
Your cart is empty

Privacy Policy

PRIVACY POLICY OF THE VINYL VIBE ONLINE STORE

Effective from 7 September 2026

§ 1. General Information

  1. This Privacy Policy sets out the rules for processing the personal data of people using the Vinyl Vibe online store at www.vinylvibe.pl, particularly customers, Account users, people contacting the Seller, Newsletter subscribers and people posting reviews.

  2. This Policy has been prepared, in particular, on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 — the General Data Protection Regulation (“GDPR”).

  3. The rules for using cookies and similar technologies are described in the separate Cookie Policy.

§ 2. Personal Data Controller

  1. The controller of personal data is:

Pracownia Krystian Liberadzki
ul. Lipowa 48
96-126 Godzianów
Poland

NIP (Polish tax identification number): 8361819783
REGON (Polish business registration number): 381779940

Hereinafter referred to as the “Controller”.

  1. For matters concerning personal data protection, you can contact the Controller using the following details:

Email: pracownia@vinylvibe.pl
Phone: +48 570 628 423
Postal address: Pracownia Krystian Liberadzki, ul. Lipowa 48, 96-126 Godzianów, Poland.

§ 3. Data That May Be Processed

  1. Depending on how the Store is used, the Controller may process, in particular:

a) first and last name,
b) delivery and billing addresses,
c) email address,
d) telephone number,
e) company name,
f) tax identification number and other information required to issue an invoice,
g) information about Orders placed, Products purchased, payments and delivery,
h) the content of correspondence with the Store,
i) information about complaints, returns and withdrawals from the Contract,
j) information relating to the Customer Account,
k) the email address provided for the Newsletter,
l) information relating to published reviews,
m) technical information about the device and use of the Store, such as IP address, device type, browser type, operating system, connection date and time, and information contained in server logs,
n) data collected through cookies and similar technologies, to the extent determined by the User’s cookie choices.

  1. As a rule, the Controller obtains data directly from the data subject.

  2. Data may also be obtained:

a) from payment providers, regarding payment status,
b) from courier and transport companies, regarding delivery fulfilment,
c) from external login providers, such as Google or Facebook, if the User chooses to use that login method,
d) automatically while the Store is used, particularly through logs and cookies.

§ 4. Purposes and Legal Bases for Processing

1. Placing and Fulfilling Orders

Data is processed to:

a) receive the Order,
b) enter into and perform the Sales Contract,
c) prepare or manufacture the Product,
d) process payments,
e) arrange delivery,
f) communicate about Order fulfilment.

The legal basis is Article 6(1)(b) GDPR — processing necessary to enter into and perform the Contract.

2. Custom Orders

For Products made to individual dimensions or specifications, the data and information provided by the Customer may be processed to prepare a design and quotation, agree on the Product’s specifications and fulfil the Order.

The legal basis is Article 6(1)(b) GDPR.

3. Customer Account Management

Data is processed to create and maintain the Account, enable login and provide access to features available to logged-in Users.

The legal basis is Article 6(1)(b) GDPR.

4. Contact with the Controller

If the User contacts the Store by email, telephone, contact form or another method, data is processed to respond and handle correspondence.

If the contact concerns entering into or performing a Contract, the legal basis is Article 6(1)(b) GDPR.

In other cases, the legal basis may be Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in handling correspondence and enquiries.

5. Complaints, Returns and Withdrawal from the Contract

Data may be processed to:

a) handle complaints,
b) give effect to the right to withdraw from the Contract,
c) handle returns,
d) resolve issues relating to delivery or damage to a Product.

Depending on the circumstances, the legal basis is:

Article 6(1)(b) GDPR — performance of the Contract,
Article 6(1)(c) GDPR — compliance with a legal obligation,
or Article 6(1)(f) GDPR — the establishment, exercise or defence of legal claims.

6. Tax and Accounting Obligations

Data contained in invoices, accounting documents and sales records is processed to comply with obligations under tax and accounting laws.

The legal basis is Article 6(1)(c) GDPR.

7. Establishment, Exercise and Defence of Legal Claims

Data may be retained and used to the extent necessary to establish, exercise or defend legal claims relating to the Store’s activities.

The legal basis is Article 6(1)(f) GDPR, namely the Controller’s legitimate interest.

8. Newsletter

If the User subscribes to the Newsletter, their email address will be used to send information about new arrivals, Products, promotions and Vinyl Vibe’s activities.

The legal basis for processing is Article 6(1)(a) GDPR — the User’s consent.

Commercial information is also sent electronically on the basis of the consent required by applicable electronic communications legislation.

The User may unsubscribe from the Newsletter at any time, particularly by:

a) using the link included in the message,
b) contacting pracownia@vinylvibe.pl.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

9. Product Reviews

If the User chooses to publish a Product review, the Controller may process information relating to the review to publish and moderate it, ensure the reliability of the review system and prevent misuse.

The legal basis is Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in allowing customers to share their experiences with Products and ensuring the reliability of reviews.

10. Store Security and Prevention of Misuse

Technical data, logs and information about use of the Store may be processed to:

a) ensure Store security,
b) detect errors and failures,
c) prevent fraud and misuse,
d) protect User Accounts,
e) identify the causes of technical incidents.

The legal basis is Article 6(1)(f) GDPR.

11. Website Analytics

If the User gives appropriate consent in the cookie settings panel, the Controller may use analytical tools, particularly Google Analytics, to:

a) measure website traffic,
b) compile statistics,
c) analyse how the Store is used,
d) assess Product popularity,
e) improve the Store’s features and content.

If personal data is processed in connection with these activities, the legal basis is Article 6(1)(a) GDPR — consent.

The User may change or withdraw consent at any time through “Cookie Settings”.

12. Marketing and Personalisation

If the Store uses marketing tools based on cookies or similar identifiers, they are activated only after obtaining the User’s required consent.

They may be used, in particular, to:

a) measure advertising effectiveness,
b) create audience groups,
c) display advertisements tailored to interests,
d) carry out remarketing.

In such cases, the legal basis for processing personal data is Article 6(1)(a) GDPR — consent.

§ 5. Is Providing Data Mandatory?

  1. Providing the information required when placing an Order is voluntary, but necessary to enter into and perform the Contract.

  2. Failure to provide information necessary for Order fulfilment may prevent the Order from being placed or fulfilled.

  3. Providing information in the contact form is voluntary, but without contact details the Controller may be unable to respond to the message.

  4. Providing an email address to receive the Newsletter is entirely voluntary.

  5. Consent to analytical, functional or marketing cookies is voluntary and is not a condition of making a purchase.

§ 6. Data Recipients

  1. Personal data may be shared with entities supporting the Controller in operating the Store, only to the extent necessary for a specific purpose.

  2. Data recipients may include, in particular:

a) the store platform provider, Shoper — cyber_Folks S.A.,
b) hosting and IT service providers,
c) email and other communication tool providers,
d) courier companies, carriers and transport organisers,
e) payment providers, depending on the method selected by the Customer, particularly providers of services such as Przelewy24, PayU, Autopay or PayPal, if the method is currently available in the Store,
f) banks,
g) accounting, tax and legal service providers,
h) Newsletter service providers,
i) Google, when Google services are used,
j) Meta Platforms, when Facebook services or relevant integrations are used,
k) other providers of analytical or marketing tools, if the User has consented to their use.

  1. Some of these entities process data on behalf of the Controller under appropriate agreements. Others, particularly certain payment providers, social media service providers or Google service providers, may act as independent data controllers under their own privacy policies.

  2. Data may also be disclosed to authorised public authorities where required by law.

§ 7. Login through Google or Facebook

  1. The Store may allow Users to create an Account or log in using a Google or Facebook account.

  2. Using this feature is voluntary.

  3. When this feature is used, the relevant provider may share data necessary to create or manage the Account, particularly an account identifier, first and last name or email address, depending on the information made available by the User and the provider.

  4. Google and Meta also process data as independent controllers under their own privacy policies.

§ 8. Transfers Outside the European Economic Area

  1. The Controller uses technology providers operating internationally.

  2. When services from entities such as Google, Meta, PayPal or other global technology providers are used, data may, in certain circumstances, be processed outside the European Economic Area.

  3. Data transfers take place only where an appropriate legal basis exists and the required safeguards have been implemented, particularly:

a) a European Commission adequacy decision,
b) the recipient’s participation in an appropriate mechanism recognised by the European Commission, including the EU–U.S. Data Privacy Framework, where applicable,
c) standard contractual clauses approved by the European Commission,
d) other safeguards provided for in the GDPR.

  1. Information about a particular provider’s transfer arrangements is available in its privacy policy.

§ 9. Data Retention Period

  1. Order-related data will be processed for the period necessary to perform the Contract and subsequently for the period needed to comply with legal obligations and until the applicable limitation periods for claims have expired.

  2. Tax and accounting records are retained for the period required by applicable law.

  3. Data relating to complaints, returns and withdrawals from the Contract may be retained until the matter is resolved and subsequently until the period during which claims may be brought has expired.

  4. Customer Account data is processed until the Account is deleted. After deletion, some data may be retained to a limited extent where necessary to comply with legal obligations or defend against claims.

  5. Correspondence-related data is retained for the time needed to handle the matter and subsequently, where justified, for the period necessary to defend against claims.

  6. As a rule, data processed on the basis of consent is processed until consent is withdrawn, unless another legal basis exists for further retention.

  7. The email address associated with the Newsletter is processed until the User unsubscribes.

  8. The Controller may retain information confirming that consent was given or withdrawn for the period necessary to demonstrate legal compliance.

  9. Technical data and logs are retained for a period justified by security requirements and the proper functioning of the system.

  10. Detailed rules for retaining information obtained through cookies are provided in the Cookie Policy and the cookie settings panel.

§ 10. Data Subject Rights

Subject to the conditions set out in the GDPR, the data subject may have the right to:

  1. access their personal data,

  2. receive a copy of their data,

  3. rectify inaccurate data,

  4. complete incomplete data,

  5. have data erased,

  6. restrict processing,

  7. data portability,

  8. object to processing based on the Controller’s legitimate interest,

  9. withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

  1. To exercise your rights, you can contact the Controller at:

pracownia@vinylvibe.pl

  1. The Controller may request additional information to verify the identity of the person making the request where necessary to protect their data from disclosure to an unauthorised person.

§ 11. Right to Lodge a Complaint

If the User believes that their data is being processed unlawfully, they have the right to lodge a complaint with the competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

§ 12. Automated Decision-Making and Profiling

  1. The Controller does not make decisions concerning Customers based solely on automated processing that produce legal effects or similarly significantly affect them.

  2. If the User consents to the relevant cookies, analytical or marketing tools may analyse their activity in the Store to compile statistics or tailor content or advertisements.

  3. The User may withdraw consent at any time through the “Cookie Settings” panel.

§ 13. Data Security

  1. The Controller implements appropriate technical and organisational measures to protect personal data against:

a) loss,
b) destruction,
c) unauthorised access,
d) unauthorised alteration,
e) disclosure to unauthorised persons.

  1. Access to data is restricted to people and entities that require it for their tasks or the services they provide.

  2. The Controller regularly adapts security measures to the nature of the data processed and the technical solutions available.

§ 14. External Websites

  1. The Store may contain links to third-party websites or services, such as social media platforms, payment providers or other services.

  2. After visiting such a website, data is processed according to that entity’s rules.

  3. The Controller recommends reading the relevant service provider’s privacy policy.

§ 15. Changes to the Privacy Policy

  1. This Privacy Policy may be updated, particularly in the event of:

a) changes in the law,
b) changes in how the Store operates,
c) the introduction of new features,
d) changes in service providers,
e) changes in how data is processed.

  1. The current version of this Policy is always available on the Store’s website.

  2. In the event of significant changes, the Controller may also notify Users in an appropriate manner.

This Policy is effective from 7 September 2026.