Last updated: 26 July 2026
CARAET SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
1. GENERAL PROVISIONS
This Privacy Policy sets out the principles governing the processing and protection of personal data of individuals using the website and online store operated by CARAET SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, including individuals browsing the website, viewing the product offering, using the functionalities of the online store, placing orders, making purchases, creating customer accounts, subscribing to the newsletter, and contacting the Controller.
The online store is operated using the Shopify platform.
The purpose of this Privacy Policy is to inform individuals using the online store about what personal data may be processed; the purposes for which personal data is processed; the legal bases for processing personal data; the recipients to whom personal data may be disclosed; the periods for which personal data is retained; the rights available to data subjects; and how to contact the Controller regarding the processing of personal data.
The Controller exercises due diligence to ensure that personal data is processed in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), as well as applicable Polish laws concerning personal data protection, the provision of electronic services and electronic communications.
2. DATA CONTROLLER
The controller of your personal data is:
CARAET SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Józefa Piusa Dziekońskiego 1
00-728 Warsaw, Poland
Tax Identification Number (NIP): 5214163972
REGON: 544659887
National Court Register (KRS): 0001239709
E-mail: office@caraet.com
Telephone: +48 501 584 009
hereinafter referred to as the "Controller" or "CARAET".
CARAET conducts business activities involving the design and production of jewellery and the sale of products, in particular through its online store.
For matters relating to the processing of personal data, including exercising the rights of data subjects, you may contact the Controller using the e-mail address, telephone number or postal address indicated above.
The Controller has not appointed a Data Protection Officer (DPO), unless the obligation to appoint one arises under applicable law.
3. CATEGORIES OF PERSONAL DATA PROCESSED
3.1. Identification and Contact Data This may include: first and last name; e-mail address; telephone number; residential or correspondence address; delivery address; company details, where the purchase is made by or on behalf of a business entity.
3.2. Order Data The Controller may process information relating to your order, including: order number; date of order; information concerning purchased products; quantity and value of products; delivery details; order fulfilment status; information concerning returns; information concerning exchanges; information concerning complaints; and communications with the customer relating to the order.
3.3. Payment Data In connection with the processing of payments, the Controller may process information concerning the selected payment method; transaction amount; payment status; transaction identification number; and information concerning successful or unsuccessful payment processing. Where payment is made through an external payment service provider, data necessary to process the payment may be disclosed to that provider. The Controller does not generally store full payment card details where payment is processed directly by an external payment provider or payment system.
3.4. Customer Account Data Where the online store allows you to create a customer account, the Controller may process data associated with the account, including first and last name; e-mail address; contact details; order history; delivery addresses saved by the user; and account settings.
3.5. Data Provided in Communications Where you contact CARAET, the Controller may process personal data contained in e-mails, contact forms or other communications. The scope of such data depends on the information voluntarily provided by you.
3.6. Technical Data In connection with your use of the website, certain technical information may be processed, including IP address; information concerning your device; browser type and version; operating system; information concerning your Internet connection; information necessary to ensure security; and information necessary for the proper functioning of the online store.
3.7. Newsletter Data Where you subscribe to the newsletter, the Controller may process your e-mail address; first name, where provided; information concerning your subscription; information concerning your consent; and information concerning withdrawal of consent or unsubscribing from the newsletter.
3.8. Marketing Preferences and Activity Data Where you have provided the appropriate consent, the Controller may process information concerning your interests, preferences and activity relating to marketing communications, to the extent necessary to personalise offers and marketing content.
4. SOURCES OF PERSONAL DATA
The Controller may obtain personal data directly from the data subject, in particular when placing an order, creating an account, subscribing to the newsletter or contacting CARAET; automatically in connection with the use of the website and online store, to the extent resulting from the operation of the Shopify platform, technical infrastructure and technologies used; from payment service providers, to the extent necessary to confirm payment status; from delivery service providers, to the extent necessary to properly fulfil an order; and from other entities cooperating with the Controller, where permitted by law and necessary to achieve a specific purpose.
5. PURPOSES OF PROCESSING PERSONAL DATA
5.1. Operation and Administration of the Online Store
Personal data may be processed to ensure the proper operation of the online store, enable access to its functionalities and present CARAET's product offering.
5.2. Order Fulfilment
Personal data may be processed for accepting and processing orders; confirming orders; preparing products for dispatch; arranging delivery; contacting customers regarding their orders; processing returns and exchanges; handling complaints; and fulfilling obligations arising under applicable law.
5.3. Payment Processing
Personal data may be processed to enable payments, confirm payment status, settle transactions and address any payment-related issues.
5.4. Customer Service
Personal data may be processed to respond to enquiries and provide information concerning products, orders, payments, deliveries, returns and complaints.
5.5. Handling Complaints, Returns and Exchanges
Personal data may be processed for the purpose of handling complaints, returns and exchanges and exercising other customer rights under applicable law.
5.6. Customer Account Management
Where the online store provides an account functionality, personal data may be processed to create and maintain the account, provide access to order history and enable the use of available account functionalities.
5.7. Newsletter
Where you have provided the appropriate consent, personal data may be processed to send newsletters containing information concerning new products, new collections, launches, promotions, events, CARAET activities and other marketing communications relating to CARAET.
5.8. Direct Marketing
The Controller may conduct direct marketing of its own products and services. Depending on the type of communication and applicable laws, sending commercial or marketing communications through certain electronic channels may require your prior consent.
5.9. Personalisation of Offers and Marketing Communications
Where you have provided the appropriate consent, the Controller may use information concerning your interests and activity, to the extent covered by such consent, to personalise marketing content, offers and communications.
5.10. Marketing Profiling
Where you have provided the appropriate consent, the Controller may process personal data for marketing profiling purposes. Profiling may involve analysing information concerning your interests in products, preferences and activities in order to better tailor marketing communications and content to your potential interests. Marketing profiling is not used to make decisions concerning you which produce legal effects or similarly significantly affect you.
5.11. Security and Fraud Prevention
Personal data may be processed to ensure the security of the online store; detect and prevent fraud; prevent abuse and misuse; protect IT systems; detect unauthorised access; and ensure the proper functioning of the online store.
5.12. Compliance with Legal Obligations
Personal data may be processed to comply with legal obligations, including obligations relating to taxation, accounting, sales documentation, consumer protection, and complaints and returns.
5.13. Establishment, Exercise or Defence of Legal Claims
Personal data may be processed for the purposes of establishing, pursuing or defending legal claims relating to CARAET's business activities.
6. LEGAL BASES FOR PROCESSING
Personal data is processed on the basis of one or more legal grounds set out in Article 6(1) of the GDPR.
6.1. Performance of a Contract – Article 6(1)(b) GDPR
This legal basis applies in particular to processing and fulfilling orders; payment processing; delivery; customer account management; and activities necessary for the performance of a contract.
6.2. Compliance with a Legal Obligation – Article 6(1)(c) GDPR
This legal basis applies in particular to maintaining accounting records; fulfilling tax obligations; complying with consumer protection requirements; and fulfilling other legal obligations.
6.3. Consent – Article 6(1)(a) GDPR
This legal basis may apply in particular to sending newsletters; certain forms of marketing communication; personalisation of offers; marketing profiling; and other processing activities requiring consent. Providing consent is voluntary. You may withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal.
6.4. Legitimate Interests – Article 6(1)(f) GDPR
This legal basis may apply in particular to ensuring the security of the online store; preventing fraud and abuse; establishing, exercising or defending legal claims; ensuring the proper functioning of the online store; customer service communications; and direct marketing of the Controller's own products or services, where permitted by applicable law.
7. VOLUNTARY NATURE OF PROVIDING PERSONAL DATA
Providing personal data is generally voluntary. However, in certain circumstances, providing specific personal data may be necessary to achieve a particular purpose. Providing data required to process an order is necessary to enter into and perform the sales contract; failure to provide required data may prevent you from placing or completing an order; providing data necessary for issuing sales documentation may be required by law; subscribing to the newsletter is voluntary; and consent to personalisation and marketing profiling is voluntary.
8. RECIPIENTS OF PERSONAL DATA
Personal data may be disclosed to entities cooperating with the Controller only to the extent necessary to fulfil the relevant purposes.
Depending on the circumstances, recipients of personal data may include: Shopify and entities cooperating with Shopify in connection with the operation of the online store; hosting and IT infrastructure providers; IT service providers; payment service providers; banks and financial institutions, to the extent necessary to process payments; courier and postal service providers; logistics service providers; newsletter service providers, where used; accounting service providers; legal advisers and professional consultants; customer service providers; entities supporting the Controller in security and fraud prevention; and public authorities and other entities authorised to receive personal data under applicable law.
Where a third party processes personal data on behalf of the Controller, the Controller takes the measures required under the GDPR, including entering into data processing agreements where legally required.
9. SHOPIFY PLATFORM
The CARAET online store is operated using the Shopify platform. Shopify provides the technical infrastructure and solutions enabling the operation of the online store, including the checkout process and other store functionalities.
In connection with the use of Shopify, personal data may be processed by Shopify and entities cooperating with Shopify to the extent necessary to provide the relevant services.
Depending on the specific processing activity and scope of processing, Shopify may act as a processor on behalf of the Controller or as an independent data controller.
The processing of personal data by Shopify is also governed by Shopify's own privacy and data protection documentation.
10. INTERNATIONAL TRANSFERS OF PERSONAL DATA
In connection with the use of technology service providers, including Shopify and other service providers used by the Controller, personal data may be transferred to or made accessible from countries outside the European Economic Area ("EEA").
Where personal data is transferred outside the EEA, the Controller ensures that such transfers are carried out in accordance with applicable GDPR requirements and subject to appropriate safeguards.
Depending on the circumstances, the legal basis for such transfers may include an adequacy decision of the European Commission; Standard Contractual Clauses approved by the European Commission; or other transfer mechanisms provided for under the GDPR.
Detailed information concerning international data transfers carried out by individual service providers may be available in their respective privacy and data protection policies.
11. DATA RETENTION PERIODS
Personal data is retained for no longer than necessary to fulfil the purposes for which it was collected, taking into account the Controller's legal obligations and the need to establish, exercise or defend legal claims.
11.1. Order-Related Data
Data relating to orders is retained for the period necessary to perform the contract, handle the order, returns, complaints and other customer rights, and thereafter for the period required by law or necessary to establish, exercise or defend legal claims.
11.2. Accounting and Tax Data
Data contained in accounting and tax records is retained for the period required by applicable law.
11.3. Customer Account Data
Data associated with a customer account may be retained for the duration of the account and thereafter for the period necessary to comply with legal obligations or establish, exercise or defend legal claims.
11.4. Newsletter Data
Data processed for newsletter purposes is retained until you withdraw your consent or unsubscribe from the newsletter, unless continued retention of certain data is justified by another legal basis.
11.5. Marketing and Profiling Data
Data processed on the basis of consent for marketing, personalisation or profiling purposes is processed until consent is withdrawn or the purpose of processing ceases to apply.
11.6. Claims-Related Data
Data may be retained for the period necessary to establish, pursue or defend legal claims, taking into account applicable statutory limitation periods.
12. NEWSLETTER
You may voluntarily subscribe to the CARAET newsletter.
Subscribing to the newsletter may require you to provide your e-mail address and give appropriate consent to receive marketing communications.
The newsletter may contain information concerning new products; new collections; launches; promotions; events; CARAET activities; and other content relating to CARAET's offering.
You may unsubscribe from the newsletter at any time by clicking the relevant unsubscribe link contained in the newsletter or contacting the Controller at office@caraet.com.
Withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal.
13. MARKETING, PERSONALISATION AND PROFILING
CARAET may conduct marketing activities relating to its own products and services.
Where applicable law requires consent for specific marketing activities, the Controller shall carry out such activities only after obtaining the appropriate consent.
Where you have consented to personalised communications or marketing profiling, the Controller may use information concerning your interests and activities, to the extent covered by your consent, to tailor marketing communications and offers.
Marketing profiling is not used to make decisions concerning you which produce legal effects or similarly significantly affect you.
You may withdraw your consent to profiling or personalisation at any time where the processing is based on consent.
14. AUTOMATED DECISION-MAKING
The Controller does not make decisions concerning individuals which produce legal effects or similarly significantly affect them solely on the basis of automated processing of personal data.
Where profiling is used for marketing purposes, it is intended in particular to personalise marketing communications, content and offers.
15. COOKIES
The CARAET online store may use cookies and similar technologies.
Cookies may be used in particular to ensure the proper functioning of the online store; maintain user sessions; operate the shopping cart; facilitate the checkout and order process; ensure security; remember user preferences; and provide the proper functioning of the store's functionalities.
Depending on the configuration of the online store and the services used, cookies may also be used for marketing or personalisation purposes.
CARAET does not currently use separate analytics tools for the purpose of analysing statistical data concerning the use of the online store.
However, the Shopify platform and individual store functionalities may use their own technologies, including cookies, which are necessary for the proper functioning of the platform and the online store.
If additional analytics, marketing or advertising technologies are implemented in the future and require user consent, the Controller will provide an appropriate consent mechanism and ensure compliance with applicable legal requirements.
You may manage your cookie preferences through your web browser settings and, where available on the online store, through the consent management mechanism provided on the website.
Restricting or disabling certain cookies may affect the proper functioning of some online store functionalities.
16. DATA SECURITY
The Controller implements appropriate technical and organisational measures designed to protect personal data against unauthorised access; loss; destruction; accidental deletion; unauthorised alteration; unauthorised disclosure; and other unlawful forms of processing.
Access to personal data is limited to persons and entities authorised to process such data.
The Controller takes measures to maintain an appropriate level of data security, taking into account the nature, scope and risks associated with the processing of personal data.
17. RIGHTS OF DATA SUBJECTS
17.1. Right of Access
The right to obtain confirmation as to whether personal data concerning you is being processed and, where applicable, to obtain access to such data and information concerning its processing.
17.2. Right to Rectification
The right to request the correction or completion of inaccurate or incomplete personal data.
17.3. Right to Erasure
The right to request the deletion of personal data in the circumstances specified in the GDPR. This right is not absolute. In certain circumstances, the Controller may be required to retain personal data, in particular to comply with a legal obligation or to establish, exercise or defend legal claims.
17.4. Right to Restriction of Processing
The right to request restriction of the processing of personal data in the circumstances specified in the GDPR.
17.5. Right to Data Portability
Where processing is based on consent or a contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit such data to another controller, where the conditions specified in the GDPR are met.
17.6. Right to Object
In the circumstances specified in the GDPR, you have the right to object to the processing of your personal data. Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.
17.7. Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal.
18. EXERCISING YOUR RIGHTS
To exercise your rights, please contact the Controller:
CARAET SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Józefa Piusa Dziekońskiego 1
00-728 Warsaw, Poland
E-mail: office@caraet.com
Telephone: +48 501 584 009
Where reasonably necessary to verify the identity of the person submitting a request, the Controller may request additional information required to confirm such identity.
The Controller shall respond to requests concerning the rights of data subjects without undue delay and, in any event, within the time limit prescribed by the GDPR.
19. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority.
In Poland, the competent supervisory authority is:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO)
You may also contact the Controller directly to raise any concerns regarding the processing of your personal data.
20. CHILDREN'S DATA
The CARAET online store is not directed at children.
The Controller does not knowingly collect personal data from children without an appropriate legal basis required under applicable law.
If a parent or legal guardian becomes aware that a child has provided personal data to the Controller without an appropriate legal basis, please contact us at office@caraet.com. Upon receiving credible information, the Controller shall take appropriate steps in accordance with applicable law.
21. THIRD-PARTY WEBSITES AND SERVICES
The CARAET online store may contain links to websites or services operated by third parties.
The Controller is not responsible for the privacy practices or data processing activities of third-party websites where such entities act as independent data controllers.
Upon visiting a third-party website, you should review the privacy policy and data processing practices applicable to that website.
This also applies to third-party services, applications and integrations that may be used in the online store, to the extent that such entities act as independent data controllers.
22. CHANGES TO THIS PRIVACY POLICY
The Controller may periodically update this Privacy Policy, in particular in the event of changes in applicable law; changes in the manner in which personal data is processed; changes to the functionality of the online store; introduction of new services; or changes to the technology providers or tools used.
The current version of this Privacy Policy will be published on the online store's website.
In the event of material changes, the Controller may notify users in an appropriate manner, taking into account the nature and scope of the changes and in accordance with applicable law.
23. CONTACT
If you have any questions concerning this Privacy Policy, the processing of personal data or the exercise of your rights, please contact the Controller:
CARAET SPÓŁKA Z OGRANICZONICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Józefa Piusa Dziekońskiego 1
00-728 Warsaw, Poland
Tax Identification Number (NIP): 5214163972
REGON: 544659887
National Court Register (KRS): 0001239709
E-mail: office@caraet.com
Telephone: +48 501 584 009