Privacy policy

Last updated: 30 July 2026

1. Data Controller

The controller of your personal data is Krzysztof Burchat, running a sole proprietorship under the business name “Krzysztof Burchat frolo”, with its registered office at ul. Obozowa 20D/100, 01-161 Warsaw, Poland, NIP (tax ID): 5273228495, REGON: 545306719 (hereinafter: the “Controller” or “Frolo”).

Contact for personal data protection matters: email kontakt@frolo.pl, phone +48 732 620 806.

Data Protection Officer (DPO): The Controller has not appointed a Data Protection Officer. For all matters concerning the processing of personal data, please use the contact details above.

2. Legal Bases and Purposes of Processing

We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”) and Polish law. Each purpose of processing is assigned an appropriate legal basis:

Order fulfilment and handling of the sales contract: Art. 6(1)(b) GDPR (performance of a contract);
Issuing and storing invoices, accounting and tax obligations: Art. 6(1)(c) GDPR (legal obligation, including the Accounting Act and the VAT Act);
Email / SMS marketing (newsletter, information about new collections): Art. 6(1)(a) GDPR (consent), which you may withdraw at any time;
Handling complaints and returns: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR;
Security of the Services, abuse prevention, analytics and statistics: Art. 6(1)(f) GDPR (legitimate interest of the Controller);
Establishing, exercising or defending against legal claims: Art. 6(1)(f) GDPR (legitimate interest of the Controller).

3. Scope of Data Processed

Depending on the purpose and legal basis of processing, we process, among others:

identification data (first name, last name),
contact data (email address, phone number, delivery and billing address),
order data (order number, products, amounts, delivery and payment method),
billing data (for invoices: company details, tax ID),
technical data (IP address, browser type, device identifiers, cookie data – details in the “Cookies” section),
correspondence content (from contact forms, emails, complaint submissions).

4. Data Retention Periods

Data relating to orders, invoices and accounting records: for the period required by tax and accounting regulations (generally 5 years from the end of the calendar year in which the tax obligation arose).
Data processed for marketing purposes: until consent is withdrawn.
Customer account data: until the account is deleted.
Data needed to establish or defend against legal claims: for the limitation period of the claims (generally up to 6 years).
Correspondence data: for the time necessary to provide a response and for the period required to defend against potential claims.

5. Data Recipients

Your data may be shared with entities we work with to provide the Services, in particular:

payment operators (Shopify Payments),
couriers and postal operators (InPost),
the store platform provider (Shopify Inc. and affiliated entities),
the accounting / bookkeeping office,
providers of IT, hosting, email and analytics services,
entities authorised under applicable law (e.g. public administration authorities).

6. Transfers of Data Outside the European Economic Area (EEA)

Some of our providers (including Shopify) may process data outside the EEA. In such cases, the transfer is carried out with the required safeguards, in particular on the basis of standard contractual clauses approved by the European Commission or other mechanisms compliant with Art. 46 GDPR.

7. Your Rights

In connection with the processing of your personal data, you have the following rights:

the right of access to your data and to obtain a copy of it (Art. 15 GDPR),
the right to rectification (Art. 16 GDPR),
the right to erasure – “the right to be forgotten” (Art. 17 GDPR),
the right to restriction of processing (Art. 18 GDPR),
the right to data portability (Art. 20 GDPR),
the right to object to processing based on legitimate interest (Art. 21 GDPR),
the right to withdraw consent at any time – withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR),
the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

To exercise your rights, contact us at kontakt@frolo.pl.

8. Right to Lodge a Complaint with a Supervisory Authority

If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (PUODO)
ul. Stawki 2
00-193 Warsaw
www.uodo.gov.pl

9. Cookies and Similar Technologies

We use cookies and similar technologies, among others, for the following purposes:

ensuring the proper functioning of the store (necessary cookies – no consent required),
traffic analysis and measuring content effectiveness (analytics cookies – with consent),
personalisation and marketing, including remarketing (marketing cookies – with consent).

You can withdraw your consent to analytics and marketing cookies at any time by clicking the consent management icon in the page footer or by changing your browser settings.

10. Profiling and Automated Marketing

Your data may be subject to profiling for marketing purposes (including tailoring marketing communications to your interests). Profiling is based on the consent you have given and does not produce legal effects concerning you or similarly significantly affect you. You may object to such processing or withdraw your consent at any time.

11. Data Security

We apply technical and organisational measures to ensure the security of your data, in particular connection encryption (HTTPS/TLS), restricting access to data to authorised persons only, and regular system updates. In the event of a personal data breach likely to result in a high risk to the rights or freedoms of natural persons, we will notify you without undue delay.

12. Voluntary Provision of Data

Providing data is voluntary, but in some cases necessary to provide the Services (including order fulfilment and issuing an invoice). Failure to provide the necessary data means the relevant Service cannot be provided.

13. Changes to the Privacy Policy

We may update this Privacy Policy. Any material change will be announced on this page together with the date of the last update. We encourage you to check the content of the Privacy Policy regularly.