Privacy Policy

Data Controller

The data controller of your personal data is [pełna nazwa firmy], [adres siedziby], Tax ID (NIP) [NIP]. For all matters concerning personal data and privacy, please contact kontakt@kosteckileathercraft.com.

We have not appointed a Data Protection Officer, as this is not legally required for operations at this artisanal scale — all correspondence is handled directly by the atelier.

What Data We Collect

• Inquiry form details: full name, email address, optional phone number, and inquiry content (item description, dimensions, leather preferences, thread color, and monogram requests).
• Order fulfillment details: shipping address and billing/tax data if an order is confirmed.
• Correspondence with our atelier: emails, messages, blueprints, and agreed design parameters.
• We do not collect unnecessary data: we never request dates of birth, national ID numbers, or sensitive data categories.

Purposes and Legal Grounds for Processing (GDPR)

Responding to inquiries and issuing bespoke quotes

Art. 6(1)(b) GDPR — steps taken prior to entering into a contract

Order fulfillment, leather crafting, and tracked delivery

Art. 6(1)(b) GDPR — contract performance

Aftercare, lifetime repairs, and ongoing communication

Art. 6(1)(f) GDPR — legitimate interest of the atelier

Accounting and tax compliance

Art. 6(1)(c) GDPR — legal obligation

Website visit statistics

Art. 6(1)(a) GDPR — consent (currently inactive)

Data Retention Periods

• Inquiries that did not result in a confirmed commission are retained for up to 12 months from the last contact, allowing easy reference should you resume the project.
• Contractual and accounting documentation is retained for 5 years from the end of the tax calendar year, per statutory tax legislation.
• Restoration and repair correspondence is maintained for the life of the item to preserve its provenance.

Data Recipients & Third-Party Processors

We never sell or distribute your data for marketing. We work exclusively with trusted service providers processing data strictly on our instructions:

• hostido.pl — web and email server infrastructure.
• Resend (Resend, Inc., USA) — transactional email delivery for form notifications.
• Directus (instancja własna pracowni) — internal atelier content and inquiry database.
• Courier services — solely to the extent necessary to deliver your physical parcel.
• Accounting office — strictly as required by tax and financial reporting laws.

Transfers Outside the EEA

Certain technical providers (including Resend (Resend, Inc., USA)) are based outside the European Economic Area. In such cases, data transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent lawful GDPR transfer frameworks.

Your Rights

To exercise any of these rights, simply email us at kontakt@kosteckileathercraft.com. We respond promptly and within one month at most.

• Right to access your personal data and obtain a copy.
• Right to rectify inaccurate data or complete unfinished information.
• Right to erasure ("right to be forgotten") when grounds for processing cease.
• Right to restriction of processing under statutory GDPR conditions.
• Right to data portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time without affecting past lawful processing.
• Right to lodge a complaint with the supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, Poland).

Cookies & Browser Storage

Our website does not use tracking cookies. We only store your explicit cookie consent choice in your browser's local storage (localStorage) so the prompt does not reappear on every page visit.

Policy Updates

This policy is reviewed whenever regulations or technical infrastructure evolve. Last updated: 2026-09-21.