The controller of your personal data is GOOD HUSTLE sp. z o.o. with its registered office in Dywity, Franciszka Hynka 21/1, 11-001 Dywity, Poland, KRS 0001149421, NIP 7394010773. Contact in all data matters: [email protected].
We process your data in accordance with the GDPR and Polish data protection law. This policy explains what we collect, why, for how long and what rights you have.
When you order: full name, e-mail address, phone number, delivery address or chosen parcel locker, order details and payment status. Card data never reaches us - it goes directly to Stripe.
When you subscribe to the newsletter: e-mail address, consent timestamp and subscription source (form or checkout).
When you write to us: your e-mail address and the content of the correspondence.
Automatically: standard server logs (IP address, browser type, request time) kept for security and troubleshooting, and the cookies described in the cookie policy.
With your consent (the “Accept all” button in the cookie banner): analytics data - a pseudonymous browser identifier, device and browser information, pages visited, store events (e.g. adding to cart) and session recordings in which the content of form fields is automatically masked. The IP address is not stored - it is used solely to determine an approximate location (country, city) and discarded immediately.
Fulfilling your order, returns and complaints - art. 6(1)(b) GDPR (performance of a contract).
Accounting and tax obligations - art. 6(1)(c) GDPR (legal obligation).
Newsletter - art. 6(1)(a) GDPR (your consent, withdrawable at any time).
Analytics and improving the store - art. 6(1)(a) GDPR (your consent given in the cookie banner, withdrawable at any time).
Answering messages, establishing and defending legal claims, keeping the store secure - art. 6(1)(f) GDPR (our legitimate interest).
Providing data is voluntary, but without the order data we cannot sell and ship products to you.
Only providers needed to run the store, under data processing agreements: Stripe (payments; also an independent controller for its own legal duties), Furgonetka (shipping broker - dispatch handling) and InPost (parcel delivery), Resend (e-mail delivery, incl. the newsletter), MongoDB Atlas (database hosting), DigitalOcean (application hosting), PostHog (analytics - only if you give consent; data stored on servers in the EEA, Frankfurt).
We never sell your data.
Some providers (Stripe, Resend, MongoDB) may process data in the United States. Such transfers are protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Our analytics provider is PostHog, Inc., based in the USA, but analytics data is stored on servers in the EEA (Frankfurt); any remote access from the USA is protected by Standard Contractual Clauses. You can request details of the safeguards at [email protected].
Order data - for the duration of the contract, then as long as tax law and limitation periods for claims require (as a rule 5 years from the end of the tax year).
Newsletter - until you withdraw consent.
Correspondence - up to 3 years after the matter is closed.
Server logs - up to 90 days.
You have the right to: access your data, rectify it, erase it, restrict processing, receive it in a portable format, object to processing based on our legitimate interest, and withdraw consent at any time (without affecting earlier processing).
Write to [email protected] - we respond within 30 days, usually much sooner. You may also lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).
If you subscribe, we process your e-mail address to send the CÉLVE newsletter. Legal basis: your consent (art. 6(1)(a) GDPR), given by subscribing - via the form (confirmed by the link we e-mail you) or the checkbox at checkout. E-mails are delivered through Resend, Inc. (USA) acting as our processor. We keep the address until you withdraw consent.
Unsubscribe anytime - the link in every e-mail or [email protected]. Withdrawal does not affect processing that happened before it.
We use technical cookies necessary for the store to work (cart, checkout session), and Stripe sets its own cookies during checkout for payment security. Analytics cookies and similar technologies (PostHog) - only with your consent given in the cookie banner. We use no marketing cookies. Details: cookie policy.
We do not make automated decisions about you that produce legal or similarly significant effects (art. 22 GDPR). Analytics data collected with your consent (including session recordings) is used solely to improve the store - we do not use it to make decisions about you, nor do we link it to your order data.
We may update this policy when the store or the law changes; the current version is always at this address. Material changes affecting newsletter subscribers will be announced by e-mail.
In force from 13 July 2026.