Privacy Policy

    Last updated: 5 September 2026

    This policy explains what personal data we collect when you visit fruitingbodies.jewelry, place an order, subscribe to our newsletter or see our advertisements — why we collect it, who we share it with, and what you can ask us to do with it.

    1. Who is responsible for your data

    The controller of your personal data is:

    KRAFT Marcin Sieczka
    Chłodna 20 / U3
    00-891 Warszawa, Poland
    NIP (VAT ID): 6631878910

    For anything concerning your data, write to [email protected]. We answer data requests ourselves — there is no separate department.

    2. What we collect, why, and on what legal basis

    Purpose Data Legal basis How long we keep it
    Processing and delivering your order Name, email, delivery and billing address, phone number, order contents Performance of a contract — Art. 6(1)(b) GDPR For the duration of the order, then as accounting records
    Accounting and tax records Invoice and payment data Legal obligation — Art. 6(1)(c) GDPR 5 years from the end of the tax year in which the invoice was issued
    Answering your messages Name, email, contents of the message Legitimate interest — Art. 6(1)(f) GDPR Until the matter is closed, and for as long as related claims are possible
    Newsletter Email address, name, opening and click activity Consent — Art. 6(1)(a) GDPR Until you withdraw consent or unsubscribe
    Website analytics Pages viewed, session data, approximate location, device and browser, IP address Consent — Art. 6(1)(a) GDPR As configured with the provider, generally up to 14 months
    Advertising and measuring our campaigns Interactions with the site and with our ads, hashed identifiers, purchase events Consent — Art. 6(1)(a) GDPR As configured with the provider, generally up to 180 days
    Site security and fraud prevention IP address, request data Legitimate interest — Art. 6(1)(f) GDPR Up to 12 months
    Customer account, if you create one Login details, order history, saved addresses Performance of a contract — Art. 6(1)(b) GDPR Until you delete the account

    Providing your data is voluntary, but without the data marked as required at checkout we cannot accept or ship an order.

    3. Who we share your data with

    We do not sell your personal data. We share it only with the service providers we need in order to run the shop:

    • Payments: Stripe Payments Europe, Ltd. (cards, Klarna, iDEAL, Bancontact, EPS, SEPA, Link) and PayPal (Europe) S.à r.l. et Cie, S.C.A. Payment providers receive the data needed to process the transaction and act as independent controllers for it.
    • Shipping: Furgonetka sp. z o.o. sp.k. and GlobKurier, together with the carriers you choose at checkout, which receive your delivery address and phone number.
    • Payments through the shipping basket: Autopay, PayU, Przelewy24 and Tpay, when you select one of those methods.
    • Email marketing: Intuit Inc. (Mailchimp).
    • Analytics and advertising: Google Ireland Limited (Google Analytics, Search Console, Google Merchant Center) and Meta Platforms Ireland Limited (Meta Pixel and Conversions API).
    • Security and delivery of the site: Cloudflare, Inc. (content delivery and anti-bot protection), Defiant, Inc. (Wordfence).
    • Consent management: CookieYes Limited.
    • Hosting: OVH Sp. z o.o.

    Data may also be disclosed to our accountant and, where the law requires it, to public authorities.

    4. Transfers outside the European Economic Area

    Some of the providers listed above are established in, or transfer data to, the United States — in particular Meta, Google, Intuit (Mailchimp), Cloudflare, Stripe and Defiant. Those transfers take place on the basis of the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the basis of the Standard Contractual Clauses approved by the European Commission, together with additional safeguards applied by the provider. You may ask us for details of the mechanism used for a specific provider.

    5. Cookies and similar technologies

    We use cookies that are strictly necessary for the site to work — keeping your session, remembering your cart and your currency. These do not require your consent.

    We also use analytics and advertising cookies, which we set only after you agree to them in the consent banner shown on your first visit. You can change or withdraw that consent at any time through the cookie settings link on the site, and you can delete cookies in your browser at any time. Withdrawing consent does not affect the lawfulness of what was done before you withdrew it.

    6. Advertising and profiling

    If you consent to advertising cookies, we use the Meta Pixel and Meta’s Conversions API to measure the results of our campaigns on Facebook and Instagram and to show ads to people whose interests resemble those of our customers. This involves profiling in the sense of Art. 4(4) GDPR: your behaviour on our site is used to assign you to advertising audiences.

    We do not take any decision producing legal effects concerning you, or similarly significantly affecting you, by automated means alone.

    You can object to this at any time by withdrawing your consent to advertising cookies, and separately in your Meta account settings at facebook.com/ads/preferences and in Google’s settings at myadcenter.google.com.

    7. Your rights

    Under the GDPR you have the right to:

    • access your data and receive a copy of it (Art. 15);
    • rectify data that is inaccurate or incomplete (Art. 16);
    • erase your data, where one of the grounds in Art. 17 applies;
    • restrict our processing of it (Art. 18);
    • data portability — receive the data you gave us in a machine-readable format, or have it sent to another controller (Art. 20);
    • object to processing based on our legitimate interest, including profiling (Art. 21);
    • withdraw consent at any time, where processing is based on consent (Art. 7(3)).

    To exercise any of these, write to [email protected]. We reply within one month; if a request is complex we may extend that by up to two further months and will tell you why.

    8. Right to lodge a complaint

    If you believe we handle your data unlawfully, you may lodge a complaint with the Polish supervisory authority:

    Prezes Urzędu Ochrony Danych Osobowych
    ul. Stawki 2, 00-193 Warszawa, Poland
    uodo.gov.pl

    9. Children

    Our shop is not directed at children. We do not knowingly collect data from anyone under 16, which is the age of consent for information society services in Poland.

    10. Changes to this policy

    We update this policy when what we do with data changes. The current version is always published on this page with the date at the top. Where a change is significant, we will tell newsletter subscribers by email.

    11. Contact

    KRAFT Marcin Sieczka
    Chłodna 20 / U3, 00-891 Warszawa, Poland
    [email protected]