Privacy Policy

Last updated: 9 August 2026

Data controller

The controller of personal data is CRYSTAL LAKE GROUP Sp. z o.o., registered office at ul. Batalionu AK "Karpaty" 1A/47, 00-712 Warszawa, Poland, VAT ID PL5214036251. Data-related contact: [email protected].

What data we process and why

• Order data (name, delivery address, e-mail, phone, selected products, payment data handled by the payment operator) — to conclude and perform the sales contract (art. 6(1)(b) GDPR) and for tax settlements (art. 6(1)(c)).
• Correspondence (e-mail, message content) — handling enquiries, returns and complaints (art. 6(1)(b) and (f) GDPR).

Data recipients

• Shopify — operator of the cart, payments and order panel (order data is processed within Shopify infrastructure).
• 8merch — logistics partner handling shipping (receives the data necessary for delivery: name, address, e-mail/phone for the carrier).
• Carriers, payment operators, accounting office — to the extent necessary to fulfil the order and legal obligations.

Retention period

We keep order data for the period required by tax law (as a rule, 5 years from the end of the tax year). Correspondence — until potential claims become time-barred.

Your rights

You have the right to access, rectify and erase your data, restrict processing, data portability and objection, as well as to lodge a complaint with the Polish supervisory authority (UODO). An e-mail to the address above is enough.

Cookies and local technologies

• The store pages use no marketing cookies or analytics tools — which is why we show no consent banner.
• We store locally in your browser (localStorage) only the cart identifier and your language preference — technologies necessary for the store to work.
• Checkout takes place in the Shopify panel, which uses its own necessary cookies for payments and security — in line with the Shopify privacy policy.
• Fonts are served from our own server (no Google Fonts CDN) — your IP address is not shared with external font providers.