Privacy policy

Controller and contact

The controller of PAT ARROW customer and user data is Project Management Przemysław Trzeciak, Wojska Polskiego 6/6, 72-010 Police, Poland, tax identification number (NIP) 8513066824, REGON 386094306. For data protection matters and exercising your rights, contact kontakt@patarrow.pl or write to this address.

Data we process

The data depends on the service used. Purchases involve contact, address and billing details, order contents, payment and delivery information and correspondence. Accounts, the club, wishlist and availability alerts involve account identifiers, saved products, requests, activity history and points necessary to operate these features. For the newsletter, we process your email address, information submitted in the form and subscription, consent or unsubscribe records.

The store's infrastructure also processes technical information such as IP addresses, cookie identifiers, browser and device information and events concerning use of the store. This information is not automatically anonymous. Payment information required to authorise a transaction is processed by the selected payment provider; the store receives information needed to handle the order, settlement and any refund.

Purposes and legal bases

• Concluding and performing contracts, delivering products, providing digital content and handling orders and requested electronic services: Article 6(1)(b) GDPR.
• Complying with tax, accounting and consumer rights obligations: Article 6(1)(c) GDPR.
• The newsletter and activities requiring voluntary consent, including non-essential analytics or marketing technologies: Article 6(1)(a) GDPR and, for communications and device access, the applicable provisions of the Polish Electronic Communications Law.
• Handling correspondence outside a contract, ensuring security, preventing abuse and establishing, pursuing or defending claims: Article 6(1)(f) GDPR. The legitimate interests are effective service, protecting the store and its users and safeguarding the Controller's rights.

Providing information required for a purchase or selected service is voluntary, but that activity may be impossible without it. Newsletter subscription is not a condition of purchase. Consent can be withdrawn at any time, for example through the unsubscribe link in a message; withdrawal does not affect the lawfulness of earlier processing.

Recipients and infrastructure

The store operates on Shopify. Shopify services include the store infrastructure and features used, such as Messaging, Flow, Forms and Digital Products. Information about Shopify is available in its privacy policy and data processing terms.

Data may be received by parties needing it to deliver a selected service: payment providers including Shopify Payments and PayPal, carriers including InPost and DHL, accounting, legal and technical service providers and authorised public bodies. PAR HOUSE Agency provides technical support for the store and brand administration system. Access should be limited to what is needed to provide the service and have an appropriate legal basis. A payment provider or carrier may be a separate controller under its own privacy policy.

Transfers outside the EEA

Using Shopify's global infrastructure and suppliers may involve processing outside the European Economic Area. This does not mean that all store data is stored exclusively in Poland. Such transfers are subject to mechanisms provided by the GDPR, particularly adequacy decisions or standard contractual clauses, as appropriate to the transfer. Shopify explains these in its international transfer information. You can contact the Controller for information about safeguards applicable to your data.

Cookies and privacy settings

Cookies and similar technologies may maintain sessions, carts, security and selected settings, or support analytics or marketing. Technologies necessary to provide a requested service must be distinguished from optional ones. Optional technologies requiring consent should only be activated after consent is obtained. Preferences can be changed through the store's consent settings and in your browser. Blocking necessary cookies may limit cart or account functionality.

A link to a social network does not mean that all store account data is automatically transferred to it. When you visit an external site or use an embedded service, its provider's rules may apply. Information about current optional technologies should be read together with the store's consent settings.

Retention and security

Data is retained as long as needed for its purpose. Financial records are retained for the period required by tax and accounting law. Order and request data may be kept until the applicable claims limitation period expires. Account and alert data is retained while the service is provided, and newsletter data until consent is withdrawn or you unsubscribe; limited consent or objection records may be retained where necessary to demonstrate compliance or honour an unsubscribe request. Ending a service does not erase information that must still be kept on another basis.

We use technical and organisational measures appropriate to the risk. We do not claim that risk is entirely eliminated or that a security breach is impossible. Product recommendations and communication segmentation may use activity, preferences or purchase history; this selection alone is not a decision producing legal effects or similarly significantly affecting a person.

Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and portability, withdrawal of consent and objection to processing based on legitimate interests. You may object to direct marketing at any time. You may lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl. Exercising a right depends on statutory conditions; for example, a legal retention obligation may prevent immediate erasure of records.

Document updates

The version dated 26.09.2026 reflects the Shopify store and brand administration features. Material changes concerning your data require appropriate information. Continuing to use the site does not replace consent where it is required. Purchases are governed by the store terms.