In force from 16 August 2026
The Polish version of this policy is the binding one. This page states the same facts for readers of the English storefront; the full text is at arilis.pl/polityka-prywatnosci.
Who controls your data
Arilis sp. z o.o., ul. Filtrowa 62/213, 02-057 Warszawa, Poland. KRS 0001260518, NIP 7011327441. E-mail info@arilis.pl, telephone +48 730 657 946. No Data Protection Officer has been appointed; write to the address above in any matter concerning your data.
What we process, and why
- Fulfilling your order — name, delivery address, e-mail, telephone, and for businesses also company name, registered address and VAT number. Article 6(1)(b) GDPR. Kept for the term of the contract and then until claims under it are time-barred.
- Tax and accounting — the data needed to issue an invoice. Article 6(1)(c) GDPR. Kept 5 years from the end of the year in which the tax fell due.
- Complaints, returns and withdrawals — Article 6(1)(c) GDPR. Kept until the matter is closed and claims are time-barred.
- Your account — Article 6(1)(b) GDPR. Kept until you delete it or ask us to.
- Newsletter — e-mail address, on your consent, Article 6(1)(a) GDPR. Kept until you withdraw consent.
- Product reviews — the name you give and the text you write. Article 6(1)(a) and (f) GDPR.
- Establishing or defending claims — Article 6(1)(f) GDPR, until claims are time-barred.
- Security — server logs, Article 6(1)(f) GDPR, kept 12 months.
Who else sees it
Carriers (InPost and other carriers handling the delivery method you choose), the payment operator PayPro S.A. (Przelewy24), our hosting provider Hostinger International Ltd in Cyprus, our accountants, the company maintaining the shop software, and public authorities where the law requires it. All of them are inside the European Union, and each processes data under a written agreement under Article 28 GDPR.
We do not sell your data and do not pass it to third parties for their own marketing.
Transfers outside the EEA
None. Every recipient listed above is established in the European Union. The shop uses no analytics or advertising tools from providers outside the European Economic Area; should that change, this policy will be updated before those tools are used.
Your rights
You may ask for access to your data and a copy of it, correction, erasure, restriction of processing, or portability; you may object to processing based on our legitimate interest, and to direct marketing at any time; and you may withdraw a consent whenever you wish, without affecting what was lawful before. Write to info@arilis.pl; we answer within a month.
You may also complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
Automated decisions
There are none. We do not profile you for advertising, and we do not personalise prices. Product recommendations come from the category a product sits in, not from your browsing history.
Cookies
The shop uses three cookies, all of them necessary: OCSESSID holds your session — the basket, being signed in, form security — and expires when you close the browser; language and currency remember the versions you chose and last 30 days. There are no analytics or advertising cookies and no third-party cookies, which is why the shop shows no cookie banner: consent is not required for necessary cookies. Blocking them makes the basket unusable.
Security
The connection is encrypted with TLS. Passwords are stored only as cryptographic hashes — we cannot read yours. Access to personal data is limited to authorised people bound to confidentiality.
