Privacy policy of the mybudio.eu store

Last updated: 30 October 2026

This document explains which personal data we collect in the mybudio.eu store, why we process it, who we entrust it to and what rights you have. We wrote it as plainly as we could — without referring to legal provisions where an ordinary sentence will do. This is a translation of the Polish policy; if the two versions differ, the Polish version applies.

1. Who is responsible for your data

The data controller is Avocado Studio Jakub Marciniak, ul. Fabryczna 9B, 64-800 Chodzież, Poland, tax identification number (NIP) 7642396664, REGON 301359840, entered in the Polish Central Register and Information on Economic Activity (CEIDG).

For any matter concerning personal data, write to [email protected] or call +48 501 209 331. We have not appointed a data protection officer — correspondence goes directly to the controller.

This policy applies only to the mybudio.eu store. The controller also runs other stores and sells on external platforms — separate privacy policies apply there.

2. Which data we collect

• Order data — first and last name or company name, tax number, delivery address and invoice address, e-mail address, phone number, contents of the order.
• Account data — if you create an account: e-mail address, password in encrypted form, order history.
• Data from an unfinished order — the e-mail address and phone number entered in the order form, together with the contents of the cart, also when the order was not placed.
• Phone number from the discount pop-up — if you ask for a discount code sent by SMS.
• Technical data — IP address, information about the browser and device, identifiers stored in cookies, date and time of the visit.
• Content of correspondence — if you write or call us about an order.

3. Why we process data and how long we keep it

4. Reminder about an unfinished order

If you enter an e-mail address or phone number in the order form, we store it together with the contents of the cart even when the order is not finally placed. We do this to remind you about the unfinished purchase and help you complete it — for example by answering questions about the product, its quantity or the delivery cost.

We contact you about this once. The message concerns only that specific cart and contains no promotional content or offers of other products.

You can object to such contact at any time — simply reply to the message you received or write to [email protected]. After an objection we store an irreversible cryptographic hash of the address solely so that we do not store it again on later visits. The hash cannot be turned back into the address and serves no other purpose.

5. Discount code sent by SMS

A pop-up offering a discount code may appear in the store. If you enter your phone number there, we will send one message with the code to that number. The number is then used only to send the code and to confirm that it belongs to you.

Separately, you can consent to further SMS messages by choosing one of two options:

• guides, new products and promotions — at most 2 messages a month,
• only the biggest deals — at most 2 messages a quarter.

Consent is entirely voluntary — you receive the discount code whether or not you tick it. The declared frequency is binding on us: we will not send more messages than the chosen option allows.

You can withdraw consent at any time, without giving a reason and without any consequences, at mybudio.eu/pl/wypisz or by writing to [email protected]. Withdrawing consent does not affect the lawfulness of messages sent earlier. After unsubscribing you will still receive notifications about orders you placed — they are part of fulfilling the purchase, not marketing.

6. Who we entrust data to

We entrust your data to companies that help us run the store. Each of them acts under a data processing agreement and only on our instructions, unless stated below that it is an independent controller. We do not sell data or share it with other companies for their own marketing purposes.

• Courier and transport companies — DHL, FedEx, DPD, UPS, GLS, InPost, Raben, DB Schenker, Geodis, Poczta Polska, Hellmann and other carriers operating on the European market, to the extent needed to deliver the shipment. Some orders are delivered with our own transport.
• Online payment operator — Stripe Payments Europe Ltd, which handles card payments, BLIK and initiated deferred payments.
• Providers of deferred and instalment payments — Klarna Bank AB and PayPo sp. z o.o. By choosing such a payment you enter into a separate agreement with its provider — for the credit assessment and handling of that payment the provider is an independent controller of your data.
• Cash on delivery — if you choose cash on delivery, the amount due is collected by the courier company delivering the parcel, and it is this company that receives the information about the amount.
• Order management system provider — BaseLinker sp. z o.o.
• SMS gateway provider — App World sp. z o.o. (SMSPlanet), for the phone number and message content.
• Newsletter delivery system provider — MailerLite.
• Review system provider — TrustMate S.A.
• Hosting provider — cyber_Folks S.A.
• Consent management platform — Digital Data Solutions BV (CookieFirst).
• Providers of analytics and advertising tools — Google Ireland Limited, Meta Platforms Ireland Limited and TikTok Technology Limited, to the extent covered by your cookie consent (sections 9 and 10) and for the customer lists described in section 11.
• Accounting office and legal advisers — to the extent needed for accounting and handling any disputes.
• Public authorities — only where required by law.

7. Transfers of data outside the European Economic Area

Some of our providers belong to corporate groups based outside the European Economic Area — this applies in particular to Google, Meta, TikTok and Stripe tools. Data may therefore be transferred outside the European Economic Area.

Transfers take place on the basis of a European Commission adequacy decision (Data Privacy Framework) where the provider is covered by it, or standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards applied by writing to [email protected].

8. Your rights

In connection with the processing of your data you have the following rights:

• access — you can find out which data we hold about you and receive a copy,
• rectification — you can correct inaccurate data or complete incomplete data,
• erasure — you can request deletion of data if we have no basis to keep it,
• restriction of processing — you can ask us to temporarily suspend processing,
• data portability — you can receive your data in a machine-readable format or ask us to send it to another controller,
• objection — you can object to processing based on our legitimate interest; for direct marketing, including the customer lists described in section 11, the objection is binding without any need to justify it,
• withdrawal of consent — at any time and without giving a reason, with effect for the future,
• complaint — you can lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority of the EU country where you live; if you are in the United Kingdom, you can also contact the Information Commissioner's Office (ICO).

To exercise any of these rights, write to [email protected]. We reply without undue delay and at the latest within one month.

9. Cookies

Cookies are small text files stored on your device. Some of them are necessary for the store to work at all — to remember the contents of the cart, keep you logged in and ensure security. We always use these, on the basis of our legitimate interest.

Other cookies — analytical, functional and marketing — are used only with your consent. Marketing cookies include those of the advertising tools of Google (Google Ads), Meta (Facebook, Instagram) and TikTok. We collect consent through the CookieFirst platform provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH Amsterdam. You can change or withdraw it at any time using the cookie settings window available on our site.

The identifier stored in a cookie may be personal data, because it allows your device to be distinguished from others. You can also change cookie settings in your browser — but remember that blocking the necessary cookies will make it impossible to place an order.

As part of handling the discount code, we additionally store a cookie containing the code itself. Thanks to it, the code appears at checkout without you having to copy it from the message. We keep this cookie for 14 days.

10. Profiling and measuring the effectiveness of advertising

If you consent to marketing cookies, the ads shown to you may be tailored to your activity on our site. In that case we also pass information about the order you placed (order number, value, products ordered) to Google, Meta and TikTok directly from our server, together with an irreversible SHA-256 hash of your e-mail address and phone number. This serves solely to count correctly which ads led to a purchase. The address and number cannot be read back from the hash, and the platform only compares it with the hashes of its own users.

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. The automated credit assessment for deferred payments is carried out by their providers as independent controllers, under the rules described in their privacy policies.

11. Ads aimed at our customers (customer lists)

If you have placed an order with us or subscribed to the newsletter, your e-mail address, phone number, first name, last name, postal code, town and country may be placed on a customer list that we pass to the advertising tools of Google (Customer Match), Meta (custom audiences) and TikTok (customer file). We do not pass the contents of orders or amounts in this way.

Before the transfer we convert each of these data items into an irreversible SHA-256 hash. The platform compares the hashes with the hashes of its own users and deletes those that match nobody. It therefore learns nothing about people who have no account with it, and for the matching itself it acts as a processor on our behalf, under the data processing terms concluded with it. The display of ads on its service is governed by its own privacy policy.

We use customer lists for three things:

• showing our ad to people who have already bought from us — for example about new products or promotions,
• excluding existing customers from ads aimed at new audiences, so that we do not pay for ads shown to people who already know us,
• finding audiences with a similar profile — the platform selects among its users people similar to our customers; those people receive no data about you, and we receive no data about them.

The basis for this processing is our legitimate interest, namely direct marketing of our own products. We refresh the lists at least once a quarter, and the platforms automatically remove entries not refreshed for 540 days.

You can object at any time and without giving a reason by writing to [email protected]. We will remove your data from the lists at the next refresh, at the latest within one month, and will not add it again. An objection does not affect the fulfilment of orders or any other service. Independently of this, you can manage how ads are shown to you in the settings of your Google, Facebook, Instagram and TikTok accounts.

12. Voluntary provision of data

Providing data is voluntary, but in some cases necessary. Without delivery and contact details we cannot fulfil the order. Without invoice details we cannot issue an invoice in line with the law. Providing your phone number in the discount pop-up and subscribing to the newsletter are entirely voluntary and do not affect your ability to buy.

13. Security

We apply technical and organisational measures appropriate to the risk: encrypted data transmission, restricted and named access to systems, storing passwords only as cryptographic hashes, and regular backups. Phone numbers covered by an objection are stored only as irreversible hashes, and data passed to advertising tools leaves our system only as SHA-256 hashes.

14. Changes to this policy

We update this policy when the law or the way the store operates changes. The current version is always available at this address, and the date of the last change is given at the beginning of the document.