Privacy Policy

Controller

The controller of your personal data is ST-serwis - spółka cywilna, 26-600, Radom, ul. Staromiejska 7, NIP PL7963021471. For any matter concerning your data, write to r-tuning@ukr.net.

We have not appointed a Data Protection Officer; enquiries go to the address above.

What we process and why

Handling your order

Name, delivery address, email, phone, order contents. Legal basis: performance of a contract — art. 6(1)(b) GDPR.

Payment

Transaction data processed by our payment provider. We never receive or store your full card number. Legal basis: performance of a contract — art. 6(1)(b) GDPR.

Accounting and tax

Invoice and settlement data. Legal basis: compliance with a legal obligation — art. 6(1)(c) GDPR.

Complaints and returns

Correspondence, photographs, bank account for the refund. Legal basis: legal obligation and our legitimate interest in defending claims — art. 6(1)(c) and (f) GDPR.

Customer account

Email, password hash, address book, order history. Legal basis: performance of a contract — art. 6(1)(b) GDPR.

Site security and abuse prevention

IP address and request metadata at our CDN and server layer. Legal basis: legitimate interest — art. 6(1)(f) GDPR.

Providing the data listed for an order is a contractual requirement: without it we cannot conclude or perform the contract.

Who we share data with

Hetzner Online GmbH

Hosting and object storage, servers located in the EU. Processor.

Cloudflare, Inc.

CDN, TLS termination and protection against abuse. Processor.

Stripe

Payment processing. Stripe acts as an independent controller for payment data under its own privacy policy.

Resend

Delivery of transactional email. Processor.

Carriers

The delivery company you select receives the data needed to deliver the parcel. Independent controller.

Product search runs on our own infrastructure and involves no third party. We do not sell personal data and we do not share it for advertising purposes.

Where a recipient processes data outside the European Economic Area, the transfer is based on the European Commission's Standard Contractual Clauses.

How long we keep it

• Order and accounting records: 5 years from the end of the calendar year in which the tax became due, as required by Polish tax law.
• Customer account data: until you delete the account.
• Complaints correspondence: until the claim is time-barred.
• Server and CDN security logs: short-term, in line with the provider's retention.

Because tax law requires us to keep records of concluded transactions, a request to erase data cannot remove the order records themselves within that period. In such cases we anonymise everything not required to be kept.

Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing based on our legitimate interest.

To exercise any of these, write to r-tuning@ukr.net. We respond within one month.

You also have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

Automated decision-making

We do not carry out automated decision-making producing legal effects concerning you, and we do not profile you.