Privacy Policy
Last updated: August 19, 2026
Table of contents
- General Provisions
- Definitions
- Data controller and contact information
- Scope of data, purposes and legal basis of processing
- Data source
- Data recipients
- Data transfer outside the EEA
- Data retention period
- Rights of data subjects
- Data security
- Children
- Cookies and similar technologies
- Automated decision-making
- Changes to the Privacy Policy
1. General provisions
- This Privacy Policy defines the principles of processing and protecting personal data provided by Users in connection with the use of the online store. shootershape.pl (hereinafter: "Store" or "Service").
- The store serves customers from many markets, including Poland, Czech Republic, Denmark, Hungary, Romania, Sweden, Ukraine, United Kingdom, Austria, Belgium, Bulgaria, Estonia, Finland, France, Germany, Greece, Italy, Latvia, Lithuania, Netherlands, Portugal, Slovakia, Slovenia, Spain.
- The document complies with the Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Act of May 10, 2018 on the protection of personal data. For customers outside the EEA, we apply Polish data protection law taking into account local regulations (e.g., UK GDPR, CCPA).
- By using the Store, the User accepts the terms described in this document.
2. Definitions
| Concept | Meaning |
|---|---|
| Administrator | CodeFormers Sp. z o.o., ul. Kowalska 5/203, 20-115 Lublin, Poland, VAT ID 6612373391 |
| User | any natural person visiting the Store or using its functionalities |
| GDPR | Regulation 2016/679 (General Data Protection Regulation) |
| Personal data | information about an identified or identifiable natural person |
| Processing | any operation on personal data – e.g. collecting, storing, sharing, deleting |
3. Data controller and contact
- The personal data administrator is CodeFormers Sp. z o.o. (hereinafter: "Administrator").
- You can contact the Administrator:
- by e-mail: [email protected]
- in writing: ul. Kowalska 5/203, 20-115 Lublin, Poland
- The Administrator has not appointed a Data Protection Officer; for all matters related to data processing, please contact as above.
4. Scope of data, purposes and legal bases of processing
| Purpose of processing | Scope of data | Legal basis |
|---|---|---|
| Order acceptance and fulfillment | first name, last name, delivery address, e-mail, phone, company data/NIP (optional), currency and market country | Art. 6(1)(b) GDPR |
| Online payment | first name, last name, e-mail, order number, amount, payment method | Art. 6(1)(b) GDPR |
| Issuing invoices / receipts | first name, last name / company name, address, NIP/VAT | Art. 6(1)(c) GDPR |
| Handling inquiries | first name, last name, e-mail, phone, inquiry content | Art. 6(1)(f) GDPR |
| Newsletter | e-mail address | Art. 6(1)(a) GDPR |
| Remarketing / personalization | e-mail (hash), statistics, purchase history, Google Ads/GA4 events | Art. 6(1)(a) GDPR |
| Statistics analysis, security | IP, HTTP headers, cookies, browser/device info, logs | Art. 6(1)(f) GDPR |
5. Data source
We collect data directly from the User (forms in the Store) or – in the case of technical data – automatically via cookies and analytical scripts.
6. Data recipients
The Controller shares data only with entities needed to provide the services:
| Category | Entity | Purpose |
|---|---|---|
| Payments | Stripe Payments Europe Ltd., Mollie B.V. and the relevant card schemes or banks | secure processing of the selected payment |
| Logistics | InPost Sp. z o.o., DHL Express and the carrier selected for the order | order delivery |
| Hosting and infrastructure | Vercel Inc., Railway Corporation, Neon Inc., Upstash Inc. and Cloudflare Inc. (R2/CDN) | Store, databases, queues, file storage, security and backups |
| Analytics and marketing | Google Ireland Ltd. (Google Analytics 4 and Google Ads), Microsoft Ireland Operations Ltd. (Clarity) | statistics, usage analysis and campaign measurement within the scope of consent |
| Communication and form security | Tidio Poland Sp. z o.o., Resend Inc. and Cloudflare Inc. (Turnstile) | chat, messages and abuse prevention |
7. Transfers outside the European Economic Area
Some technology providers, including Google, Microsoft, Stripe, Vercel, Cloudflare or Tidio, may process data outside the EEA. A transfer takes place only under a GDPR-approved mechanism, such as an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses with required safeguards.
8. Data Retention Period
| Data category | Period |
|---|---|
| Transaction data | 6 years from the end of the tax year |
| Customer account data | until account deletion or 5 years from last activity |
| Newsletter | until consent is withdrawn |
| Marketing data | max 3 years from last contact |
| Server logs / cookies | 12–24 months (depending on the type) |
9. Rights of Data Subjects
- The User has the right to access, rectify, delete, restrict, transfer data, object, and withdraw consent.
- Requests should be sent to [email protected]. We will respond no later than within 1 month.
- A complaint may also be filed with the President of the UODO or the relevant supervisory authority in the User's country of residence.
10. Data Security
- TLS/SSL encryption
- 2FA for the admin panel
- regular backups
- separated application and database infrastructure
- access only for authorized persons
11. Children
The Store's offer is directed exclusively to adults. We do not knowingly collect data from persons under 16 years of age.
12. Cookies and similar technologies
Details, technology inventory and retention periods are set out in the Cookie Policy. Necessary mechanisms provide sessions, cart, sign-in, security and payment. Optional Google Analytics 4, Google Ads and Microsoft Clarity mechanisms support statistics, usage analysis and campaign measurement.
Optional cookies can be accepted or rejected in the banner. The choice is stored for 12 months, and consent can be changed or withdrawn at any time through “Cookie settings” in the footer.
13. Automated decision-making
The Administrator does not make decisions regarding Users in an automated manner, including not using profiling that causes legal effects.
14. Changes to the Privacy Policy
- The Administrator may make changes to the Policy for legal or technological reasons.
- We will inform about significant changes via a notice in the Store or by email (for account holders).
- The new version of the Policy is effective from the date of publication on the Service.
Do you have questions about this Policy? Write to [email protected].