PRIVACY POLICY

Last updated: June 19, 2026

Home Alchemy Art is an online store operated by P.P.H.U. Magdalena Romanowska.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• visit or use our website;

• browse products;

• create or use a customer account;

• place an order;

• make a payment;

• submit a cancellation, withdrawal, return, refund, replacement, or complaint request;

• subscribe to marketing communications;

• contact us;

• otherwise interact with our store and services.

Our online store is powered by Shopify, which provides the storefront, checkout, customer account, payment-related, security, and other e-commerce services.

If there is any conflict between our Terms of Service and this Privacy Policy concerning the collection, use, or disclosure of personal information, this Privacy Policy will apply.

1. Data Controller

For the purposes of applicable data protection law, the controller responsible for personal information processed in connection with Home Alchemy Art is:

P.P.H.U. Magdalena Romanowska
VAT ID (NIP): PL7262418945
REGON: 526230550
Niesięcin 52D
95-050 Konstantynów Łódzki
Poland

Email: magdalena.romanowska.poczta@gmail.com
Phone: +48 505 208 891

2. Personal Information We Collect

“Personal information” means information that identifies you or can reasonably be linked to you.

Depending on how you interact with our Services, we may collect the following categories of personal information.

Contact Information

This may include:

• name;

• billing address;

• shipping address;

• email address;

• telephone number.

Order and Transaction Information

This may include:

• products viewed or ordered;

• order number;

• purchase date;

• order value;

• transaction history;

• payment status;

• order status;

• fulfilment status;

• shipping and delivery status;

• discount or promotional information;

• communications concerning the order.

Payment Information

Payment-related information may include:

• selected payment method;

• billing details;

• payment authorization status;

• transaction identifiers;

• refund information;

• information concerning a payment dispute.

Payment card information is processed securely by Shopify or the payment service providers available through checkout.

We do not directly store complete payment card numbers or card security codes.

Customer Account Information

If you create or use a customer account, we may collect:

• email address;

• account identification information;

• login or verification information;

• saved addresses;

• account preferences;

• order history;

• account activity.

Cancellation, Withdrawal, Return, and Refund Information

If you use the electronic cancellation, withdrawal, or return function, or otherwise contact us concerning an order, we may collect:

• name;

• email address;

• order number or order reference;

• products concerned;

• reason for the request, where provided;

• date of the request;

• return tracking information;

• refund status;

• communications relating to the request.

Complaint and Product-Issue Information

If you report a damaged, defective, incorrect, incomplete, or non-conforming product, we may collect:

• order number;

• description of the issue;

• photographs of the product;

• photographs of the packaging;

• shipping label photographs;

• supporting documents;

• correspondence concerning the complaint;

• information necessary to provide an appropriate remedy.

Communications

We may collect information included in communications you send to us, including:

• customer service messages;

• emails;

• questions;

• complaints;

• reviews or feedback;

• other inquiries.

Marketing Information

Where applicable, we may collect:

• marketing subscription status;

• consent records;

• email campaign interactions;

• information about whether an email was opened or a link was selected;

• advertising preferences;

• information used to measure marketing performance.

Device and Technical Information

We or our service providers may automatically collect technical information such as:

• IP address;

• browser type;

• device type;

• operating system;

• language settings;

• approximate location derived from technical information;

• time zone;

• device or advertising identifiers;

• cookie identifiers;

• network information.

Website Usage Information

We may collect information concerning your interaction with the store, including:

• pages visited;

• products viewed;

• searches performed;

• products added to or removed from the cart;

• checkout activity;

• referring websites;

• links or advertisements used to reach the store;

• session information;

• interactions with website features.

3. How We Collect Personal Information

We may collect personal information:

• directly from you when you place an order, create an account, subscribe to emails, complete a form, submit a return or cancellation request, or contact us;

• automatically through cookies, pixels, local storage, and similar technologies;

• from Shopify and the services provided through the Shopify platform;

• from payment service providers;

• from shipping and delivery providers;

• from fraud prevention and security providers;

• from analytics and advertising providers;

• from social media or marketing platforms where permitted;

• from other service providers that assist us in operating the store.

4. How We Use Personal Information

We may use personal information for the following purposes.

Providing and Operating the Store

This includes:

• displaying products;

• maintaining website functionality;

• operating customer accounts;

• maintaining shopping carts;

• providing checkout;

• processing orders;

• arranging payment;

• fulfilling and dispatching purchases;

• sending order and delivery updates.

Processing Payments and Refunds

We may process information to:

• authorize and complete payments;

• prevent payment fraud;

• issue refunds;

• handle payment failures;

• respond to payment disputes or chargebacks;

• maintain transaction records.

Shipping and Delivery

We may use and disclose information to:

• prepare orders for dispatch;

• create shipping labels;

• arrange delivery;

• provide tracking information;

• investigate delayed or lost parcels;

• handle delivery problems;

• arrange reshipment where appropriate.

Cancellations, Withdrawals, Returns, and Refunds

We may process information to:

• identify the customer and order;

• allow access to the electronic return or cancellation function;

• receive and acknowledge a withdrawal request;

• assess the status of an order;

• provide return instructions;

• monitor returned parcels;

• inspect returned products;

• process refunds;

• maintain records of the request.

Handling Complaints and Non-Conforming Products

We may use personal information to:

• investigate damage, defects, missing products, or incorrect orders;

• review photographs or other evidence;

• communicate with the customer;

• arrange repair, replacement, collection, reshipment, price reduction, or refund;

• establish what product was ordered and delivered;

• comply with statutory consumer protection obligations.

Customer Support

We may process information to:

• answer questions;

• provide product or order assistance;

• respond to complaints;

• resolve account or technical issues;

• communicate about delivery, returns, or refunds.

Improving the Store and Services

We may use information to:

• understand how visitors use the website;

• monitor performance;

• identify technical errors;

• improve product pages;

• improve navigation and checkout;

• evaluate the effectiveness of store content;

• develop or improve products and services.

Where required by law, non-essential analytics will be used only after the required consent has been provided.

Marketing and Advertising

Where permitted by law, we may process information to:

• send marketing emails;

• provide information about products, collections, and offers;

• measure marketing performance;

• understand which advertising channels lead visitors to the store;

• create or measure advertising audiences;

• display or support relevant advertising on third-party platforms.

Where consent is required, we will conduct these activities only after valid consent has been provided.

You may unsubscribe from marketing emails at any time by using the unsubscribe link in the message or by contacting us.

Security and Fraud Prevention

We may process information to:

• protect customer accounts;

• protect payments and transactions;

• detect suspicious or unauthorized activity;

• prevent fraud;

• prevent misuse of return or refund processes;

• protect the store and our service providers;

• enforce applicable terms.

Legal and Regulatory Compliance

We may process and retain information to:

• comply with tax and accounting requirements;

• comply with consumer protection obligations;

• respond to lawful requests from authorities;

• resolve disputes;

• establish, exercise, or defend legal claims;

• comply with other applicable legal obligations.

5. Legal Bases for Processing

Where applicable law requires a legal basis, we rely on one or more of the following grounds.

Performance of a Contract

We process personal information where necessary to:

• receive and process an order;

• process payment;

• fulfil and deliver the purchase;

• provide customer account functions;

• handle order-related communication;

• process a cancellation, return, withdrawal, or refund;

• provide customer service connected with the purchase.

Legal Obligations

We process and retain information where necessary to comply with:

• tax laws;

• accounting requirements;

• consumer protection laws;

• product conformity obligations;

• regulatory requirements;

• lawful requests and legal proceedings.

Legitimate Interests

We may process information where necessary for legitimate business interests, provided those interests are not overridden by the rights and freedoms of the person concerned.

These interests may include:

• operating and improving the store;

• maintaining security;

• preventing fraud;

• providing effective customer service;

• investigating complaints;

• managing business records;

• protecting our legal rights;

• resolving disputes;

• measuring general business and store performance.

Consent

Where required by law, we rely on consent for activities such as:

• non-essential analytics cookies;

• advertising or targeting cookies;

• certain marketing communications;

• personalized advertising;

• other processing for which consent is legally required.

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Establishment or Defence of Legal Claims

Where necessary, we may process information for the establishment, exercise, or defence of legal claims, including disputes concerning payments, delivery, returns, refunds, product conformity, or misuse of the Services.

6. Cookies and Similar Technologies

We and our service providers may use:

• cookies;

• pixels;

• tags;

• local storage;

• software development kits;

• similar technologies.

These technologies may be used to:

• operate the storefront;

• maintain security;

• remember preferences;

• maintain customer accounts and sessions;

• maintain the shopping cart;

• enable checkout and payment;

• understand website usage;

• measure store performance;

• measure advertising effectiveness;

• support marketing and advertising.

Some technologies are strictly necessary for the operation, security, checkout, and functionality of the store.

Where required by applicable law, non-essential analytics, personalization, and advertising technologies will be used only after you have provided the required consent.

You may accept, reject, or change your preferences through the cookie banner or privacy preference controls available on our store.

You may also manage certain cookies through your browser settings.

Refusing or withdrawing consent to non-essential technologies will not prevent you from placing an order, although certain optional features may be limited.

7. How We Disclose Personal Information

We may disclose personal information to third parties where necessary for the purposes described in this Privacy Policy.

Shopify

Our store is hosted and powered by Shopify.

Shopify may process personal information to provide:

• the online storefront;

• checkout;

• customer accounts;

• payment-related services;

• Shop Pay;

• security;

• fraud prevention;

• analytics;

• technical infrastructure;

• other e-commerce services.

Depending on the Shopify features and privacy settings enabled for our store, Shopify may also process information concerning your interactions with:

• Home Alchemy Art;

• Shopify services;

• other merchants using Shopify.

This processing may be used to improve Shopify services, prevent fraud, personalize experiences, measure advertising, or support relevant advertising.

Where applicable law requires consent for non-essential analytics, personalization, or advertising, such processing will take place only after the required consent has been provided.

You may manage or withdraw applicable consent through the cookie or privacy preference controls available on our store.

For more information, please review the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

Payment Service Providers

We disclose information to payment service providers where necessary to:

• authorize payments;

• complete transactions;

• prevent payment fraud;

• issue refunds;

• resolve payment disputes.

Shipping and Delivery Providers

We may disclose information such as:

• name;

• shipping address;

• email address;

• telephone number;

• order and parcel information;

where necessary to arrange and complete delivery.

IT, Hosting, Email, and Cloud Providers

We may use providers that support:

• website operation;

• email communication;

• customer support;

• data storage;

• cybersecurity;

• technical maintenance;

• file and record management.

Analytics and Advertising Providers

Subject to applicable consent requirements, we may disclose information to analytics and advertising providers, including providers such as Google or Meta, to:

• analyze website use;

• measure conversions;

• evaluate advertising performance;

• manage campaigns;

• create or measure audiences;

• provide relevant advertising.

The exact providers used may change over time depending on the tools and sales channels enabled for the store.

Professional Advisers and Authorities

We may disclose information to:

• accountants;

• tax advisers;

• legal advisers;

• insurers;

• courts;

• law enforcement authorities;

• regulatory or supervisory authorities;

• other public bodies.

We do so only where reasonably necessary for professional advice, legal compliance, protection of rights, or responding to lawful requests.

Business Transfers

If the business is reorganized, transferred, sold, merged, or otherwise changes ownership, personal information may be transferred as part of that transaction, subject to applicable law.

8. Shopify and Enhanced Services

Depending on the Shopify settings and services enabled for Home Alchemy Art, Shopify may process certain customer and visitor information to provide enhanced services.

These services may use information about interactions with our store, Shopify, and other merchants to:

• improve Shopify services;

• prevent fraud;

• personalize shopping experiences;

• measure advertisements;

• support advertising or marketing features.

Where required by law, non-essential processing will be subject to the customer’s consent choices.

You can find more information in the Shopify Consumer Privacy Policy and exercise certain rights through the Shopify Privacy Portal.

9. Third-Party Websites and Social Media

Our store may contain links to:

• social media platforms;

• payment providers;

• delivery providers;

• other third-party websites or services.

When you follow a third-party link, the relevant third party may collect and process information according to its own privacy policy.

We are not responsible for the privacy practices, security, or content of independent third-party services.

We recommend reviewing the relevant privacy policy before providing information to a third party.

10. Children’s Privacy

Our Services are intended to be used by adults.

Children should not place orders, create customer accounts, submit return requests, subscribe to marketing communications, or otherwise provide personal information without the involvement of a parent or legal guardian.

We do not knowingly use children’s personal information for direct marketing or targeted advertising.

If you believe that a child has provided personal information without appropriate parental or guardian involvement, please contact us so that we can take appropriate steps.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

We may retain information where necessary to:

• process and fulfil orders;

• provide customer support;

• administer customer accounts;

• handle cancellations, withdrawals, returns, refunds, and complaints;

• investigate damaged, defective, or incorrect goods;

• maintain tax and accounting records;

• prevent fraud;

• resolve disputes;

• establish, exercise, or defend legal claims;

• comply with legal and regulatory obligations.

Order, payment, invoice, transaction, and accounting information may be retained for the periods required by applicable tax, accounting, and commercial laws.

Return, refund, complaint, and product-issue records may be retained for as long as necessary to:

• complete the relevant process;

• demonstrate compliance with consumer protection obligations;

• resolve disputes;

• defend legal claims.

Marketing information may be retained until:

• you withdraw consent;

• you unsubscribe;

• the information is no longer necessary;

• another applicable retention requirement applies.

We may delete or anonymize information when it is no longer required.

The precise retention period depends on:

• the type of information;

• the purpose of processing;

• applicable legal requirements;

• whether an order, return, complaint, or dispute remains open;

• security and fraud prevention needs.

12. Your Data Protection Rights

Depending on your location and applicable law, you may have the right to:

• obtain confirmation of whether we process personal information concerning you;

• request access to your personal information;

• receive a copy of your personal information;

• request correction of inaccurate or incomplete information;

• request deletion of personal information;

• request restriction of processing;

• object to processing based on legitimate interests;

• object at any time to direct marketing;

• request data portability where the applicable conditions are met;

• withdraw consent where processing is based on consent;

• lodge a complaint with a competent supervisory authority.

These rights may be subject to legal conditions, limitations, and exceptions.

To exercise your rights, contact us using the details provided at the end of this Privacy Policy.

We may request information reasonably necessary to verify your identity and protect personal information from unauthorized disclosure.

If you are located in Poland, you may lodge a complaint with:

President of the Personal Data Protection Office
Prezes Urzędu Ochrony Danych Osobowych

You may also lodge a complaint with the competent supervisory authority in the country where you:

• habitually reside;

• work;

• believe that an infringement occurred.

13. International Data Transfers

Our service providers may process personal information in countries outside your country of residence, including countries outside the European Economic Area or the United Kingdom.

The privacy laws of those countries may differ from those in your country.

Where required by law, international transfers are protected through recognized legal mechanisms, which may include:

• an adequacy decision;

• the European Commission’s Standard Contractual Clauses;

• approved United Kingdom transfer mechanisms;

• another lawful safeguard.

You may contact us to request more information about safeguards applicable to a particular transfer.

14. Security

We use reasonable technical and organizational measures intended to protect personal information against:

• unauthorized access;

• accidental loss;

• misuse;

• alteration;

• destruction;

• unauthorized disclosure.

We also rely on service providers, including Shopify and payment providers, that maintain security measures for information processed through their services.

However, no method of transmission over the internet or electronic storage is completely secure, and absolute security cannot be guaranteed.

15. Automated Decision-Making

We do not currently make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Shopify, payment providers, fraud prevention providers, or financial institutions may use automated systems to:

• authorize or decline payments;

• identify suspicious transactions;

• detect fraud;

• protect accounts;

• prevent misuse of payment or return systems.

Their processing is governed by their own privacy policies and applicable law.

16. Obligation to Provide Personal Information

You are not generally required by law to provide personal information to us.

However, certain information is necessary to:

• place and fulfil an order;

• process payment;

• arrange delivery;

• create or access a customer account;

• process a cancellation or withdrawal;

• process a return or refund;

• investigate a complaint;

• provide an appropriate statutory remedy;

• comply with legal obligations.

If you do not provide the information required for these purposes, we may be unable to:

• accept or fulfil your order;

• process payment;

• deliver the goods;

• provide account access;

• process your request;

• respond fully to a complaint.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our Services;

• changes to Shopify or other providers;

• changes to cookies or advertising tools;

• operational changes;

• legal or regulatory requirements;

• changes to the way personal information is processed.

When this Privacy Policy is updated, the revised version will be published on this page and the “Last updated” date will be changed.

18. Contact Information

For questions concerning this Privacy Policy or the processing of personal information, or to exercise your data protection rights, please contact:

P.P.H.U. Magdalena Romanowska
VAT ID (NIP): PL7262418945
REGON: 526230550
Niesięcin 52D
95-050 Konstantynów Łódzki
Poland

Email: magdalena.romanowska.poczta@gmail.com
Phone: +48 505 208 891

For the purposes of applicable data protection law, P.P.H.U. Magdalena Romanowska is the controller of personal information processed in connection with Home Alchemy Art.