Privacy policy

Last updated: 8 October 2026

1. General Information

This Privacy Policy explains how WINDSHIRT s.c. Kamil Wojtal, Szymon Chliszcz ("Windshirt", "we", "us" or "our") collects, uses, stores and protects personal data when you visit or use our website, place an order, contact us or otherwise use our online store.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Polish data protection laws.

2. Data Controller

The controller of your personal data is:

WINDSHIRT s.c. Kamil Wojtal, Szymon Chliszcz
Orłowska 10/2
60-456 Poznań
Poland

NIP: 7812116624
REGON: 545490479

Email: windshirt.contact@gmail.com
Phone: +48 600 433 477

If you have any questions about how we process your personal data or wish to exercise your rights, please contact us using the details above.

3. What Personal Data We Collect

Depending on how you use our website and services, we may collect the following categories of personal data:

Information provided when placing an order

first and last name;
billing and delivery address;
email address;
telephone number;
information about the products ordered;
order number and transaction details;
information necessary for issuing an invoice, including business details where applicable.

Payment information

Payments may be processed by third-party payment providers.

We generally do not store complete payment card details. Payment information is processed by the relevant payment provider in accordance with its own privacy policy and security requirements.

Information provided when contacting us

If you contact us by email, telephone or another available communication channel, we may process the information you provide, including your name, contact details and the content of your communication.

Technical and usage information

When you visit our website, certain information may be collected automatically, including:

IP address;
browser and device information;
operating system;
information about your interaction with the website;
pages visited and products viewed;
information about cookies and similar technologies.

4. How We Collect Personal Data

We may collect personal data:

directly from you when you place an order or contact us;
automatically when you use our website;
through cookies and similar technologies;
through service providers that help us operate the online store;
where permitted by law, from other sources or business partners.

5. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis under the GDPR.

Processing and fulfilling orders

We process your personal data when necessary to:

accept and process your order;
arrange payment;
prepare and deliver your products;
communicate with you about your order;
process returns, complaints and refunds.

The legal basis is Article 6(1)(b) GDPR, processing necessary for the performance of a contract.

Legal and accounting obligations

We may process personal data where necessary to comply with legal obligations, including tax, accounting and consumer protection requirements.

The legal basis is Article 6(1)(c) GDPR.

Customer support and communication

We process personal data to respond to enquiries, provide customer support and communicate with you regarding our products and services.

Depending on the circumstances, the legal basis may be Article 6(1)(b) or Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests.

Fraud prevention and security

We may process information to protect our store, customers and business against fraud, abuse, unauthorised activity and security threats.

The legal basis is generally Article 6(1)(f) GDPR, based on our legitimate interest in maintaining the security of our services and business.

Marketing

Where required by law, we will send marketing communications only where we have obtained the necessary consent or otherwise have a lawful basis to do so.

You can withdraw your consent to marketing communications at any time by contacting us or using the unsubscribe option included in our marketing emails.

The withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Website analytics and personalised advertising

Where applicable, we may use cookies and similar technologies for analytics, marketing and advertising purposes.

Where consent is required, non-essential cookies and related technologies will only be used after obtaining the appropriate consent.

6. Shopify

Our online store is hosted and operated using Shopify.

Shopify may process personal data on our behalf in order to provide services such as website hosting, checkout, order processing, security and other e-commerce functionality.

Where Shopify processes personal data on our behalf, Shopify acts as a processor in accordance with the applicable data processing terms.

Shopify may also process certain information as an independent controller for purposes determined by Shopify, depending on the services and features used.

For more information, please refer to Shopify's Privacy Policy and Data Processing Addendum.

7. Service Providers and Recipients of Personal Data

We may share personal data with trusted service providers where necessary to operate our business and fulfil your order.

Depending on the services we use, recipients may include:

Shopify and Shopify service providers;
payment service providers;
courier and delivery companies;
parcel locker and shipping service providers;
accounting and invoicing service providers;
IT, hosting and technical service providers;
customer support providers;
analytics and marketing service providers;
professional advisers, where necessary.

We only provide third parties with the information necessary for them to perform their relevant services, subject to applicable data protection requirements.

8. Delivery Services

When you place an order, we may provide your name, delivery address, telephone number, email address and other necessary information to the selected delivery provider in order to fulfil the delivery.

This may include courier and parcel locker services.

Such information is processed for the purpose of delivering your order and handling delivery-related communication.

9. International Transfers

Some of our service providers, including technology providers, may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we take appropriate measures required by applicable data protection law, which may include the use of European Commission Standard Contractual Clauses or transfers to countries recognised by the European Commission as providing an adequate level of data protection.

10. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected.

Depending on the type of information, we may retain personal data for:

the duration of our contractual relationship with you;
the period required by applicable tax and accounting laws;
the period necessary to handle complaints, returns or potential claims;
the period necessary to establish, exercise or defend legal claims;
the period for which you have consented to marketing, until you withdraw your consent or the data is otherwise no longer required.

After the applicable retention period, personal data will be deleted or anonymised unless further retention is required by law.

11. Your Rights

Subject to the conditions provided by the GDPR, you have the right to:

access your personal data;
correct inaccurate or incomplete personal data;
delete your personal data where the legal requirements for deletion are met;
restrict the processing of your personal data in certain circumstances;
object to processing based on our legitimate interests;
withdraw consent at any time where processing is based on consent;
receive your personal data in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller;
object to direct marketing, including profiling related to direct marketing.

To exercise your rights, contact us at:

windshirt.contact@gmail.com

We may need to verify your identity before fulfilling certain requests.

We will respond to your request within the time limits required by applicable law.

12. Right to Lodge a Complaint

If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with the competent data protection supervisory authority.

In Poland, the supervisory authority is:

Prezes Urzędu Ochrony Danych Osobowych (UODO)

You may find information about the supervisory authority and your rights on its official website.

13. Cookies

Our website uses cookies and similar technologies.

Cookies may be used for purposes such as:

ensuring that the website functions correctly;
maintaining your shopping cart and checkout session;
remembering preferences;
analysing website traffic and usage;
improving our website and services;
marketing and advertising, where applicable and where the required consent has been obtained.

Some cookies are necessary for the operation of the website and cannot be disabled through our cookie consent mechanism.

Where required by law, we will ask for your consent before using non-essential cookies.

14. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices, security or content of third-party websites. We recommend reviewing the privacy policies of those websites before providing them with personal information.

15. Children's Data

Our services are not specifically directed at children.

We do not knowingly collect personal data from children where such collection would be unlawful. If you believe that a child has provided us with personal data unlawfully, please contact us so that we can take appropriate action.

16. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, services, technology or applicable legal requirements.

Any updated version will be published on this website with a new "Last updated" date.

18. Contact

If you have any questions about this Privacy Policy, our privacy practices or the processing of your personal data, please contact us: