This notice explains in plain language what data we use, why we use it and your rights.
Controller and contact
The controller is GlobeNET Łukasz Osiadły, ul. Brzozowa 8e, 55-040 Domasław, Poland; info@stoneonline.eu.
Data, purposes and legal bases
We use names, contact and delivery details, order content and status, payment status, correspondence and technical data needed to operate the shop securely. Under Article 6(1) GDPR, the bases are: (b) contract performance for orders, delivery, accounts, returns and complaints; (c) legal obligations for tax and accounting; (f) legitimate interests in security, fraud prevention, correspondence and legal claims; and (a) consent for newsletters and optional analytics. Marketing consent is not required to buy. Google Analytics is loaded only after analytics consent.
Who receives the data
Only providers needed for the relevant service receive data: MyDevil.net hosting, PrestaShop, email, accounting and technical support providers, the payment provider identified at checkout, a bank for a transfer and the carrier selected for the order. After analytics consent, Google Ireland Limited may receive technical data through Google Analytics 4. Legally authorised bodies may also receive data. We do not receive full payment-card details. Where a service transfers data outside the EEA, we use GDPR-required safeguards; analytics technologies and their retention periods are described in the Cookie Policy.
Our contact form is protected by Google reCAPTCHA (Google Ireland Limited). The script loads only on the contact page; when the page is displayed and the form is submitted, Google receives technical data such as your IP address, browser information and how the page is used, in order to tell people from automated access. The legal basis is our legitimate interest in protection against spam and abuse (Art. 6(1)(f) GDPR). Google may also process this data outside the EEA, using the safeguards provided for in the GDPR.
How long we keep it
We keep orders and accounting records for contract performance, statutory tax and accounting periods and potential claims; account data until deletion unless another ground applies; correspondence, complaints and withdrawals for handling and evidence (online withdrawal records are kept for 6 years by default); newsletter data until consent is withdrawn; standard security logs generally for up to 30 days, longer only for an incident, abuse or claim; and cookie-choice records for 180 days. Individual cookie lifetimes are in the Cookie Policy.
Your rights
Subject to GDPR conditions, you may request access, correction, deletion, restriction and portability, object to legitimate-interest processing, and withdraw consent at any time without affecting earlier lawful processing. Contact info@stoneonline.eu. You may complain to a competent data protection authority, including Poland's UODO. Information needed for an order is provided voluntarily, but we cannot fulfil the order without it. We do not make decisions based solely on automated processing that have legal or similarly significant effects unless we first provide separate information and the rights required by law.