Version 1.0, in force from 6 November 2026.
This is an English translation of the Polish Polityka prywatności, provided for convenience. In the event of any discrepancy, the Polish version prevails. The Polish version is available at https://locusartis.pl/polityka-prywatnosci/.
This Policy describes what personal data we process in connection with the use of the website https://locusartis.pl/ (including its English version at https://locusartis.pl/en/), with contacting the Locus Artis shop and with the online sale of gift cards: for what purpose, on what legal basis, to whom we disclose it, how long we keep it and what rights you have. The last section covers cookies.
1. Controller
- Controller: Locus Artis Rękodzieło Bultrowicz spółka jawna, with its registered office at ul. Długie Ogrody 6A, 80-765 Gdańsk, KRS 0001261637, NIP 5833577157, REGON 545516204 — operator of the Locus Artis shop
- Shop: ul. Długie Ogrody 6A, 80-765 Gdańsk, Poland
- E-mail for personal data matters: [email protected]
- Phone: +48 739 016 359
We have not appointed a data protection officer. For all matters concerning personal data, please contact us at the e-mail address above.
2. Website visitors
Browsing the website does not require you to provide any data. Each time a page is displayed, the server and the Cloudflare service through which the website is delivered automatically record in server logs: the IP address, the date and time of the request, the address of the page displayed, the browser and operating system type, and the referring page.
- Purpose: keeping the website running and secure, protecting it against attacks and abuse, diagnosing errors.
- Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the website running and secure.
- Retention: a short period necessary for security and error diagnosis, as set in the settings of the hosting provider and Cloudflare (section 6).
We do not use the logs to identify visitors or to build profiles of them.
2.1. Map
The Google map on the website loads only after you click it. Until then your browser does not connect to Google’s servers. After the click your browser loads the map directly from Google, which receives in particular your IP address and browser information and may store its own cookies on your device. Google processes this data as a separate controller, in accordance with its privacy policy (https://policies.google.com/privacy), including in the United States (section 7).
2.2. Workshop booking calendar
The booking calendar on the Workshops page loads only after you click it. The calendar is run by Skos Studio on skos.studio. Until you click, your browser does not connect to that site. After the click your browser loads the calendar directly from skos.studio, which receives in particular your IP address and browser information and may store its own cookies on your device. Data you give when booking a workshop is processed under Skos Studio’s privacy policy, available on skos.studio.
2.3. Instagram
The website contains an ordinary link to the shop’s Instagram profile. We do not embed Instagram plug-ins or scripts on the website, so simply viewing a page sends no data to Meta. When you click the link you go to a service operated by Meta Platforms Ireland Ltd., where Meta’s privacy policy applies.
3. Contact by e-mail and phone
If you contact us by e-mail or phone, we process the data you give us — usually your name, e-mail address or phone number, and the content of your message.
- Purpose: replying and corresponding with you.
- Legal basis: Article 6(1)(f) GDPR — our legitimate interest in replying to messages sent to us; and where the contact concerns entering into or performing a contract — Article 6(1)(b) GDPR.
- Retention: up to 3 years after the matter is closed, and where the correspondence concerns a contract — until the limitation period for claims under that contract expires.
4. Online gift card buyers
Gift cards are bought on a payment page operated by Stripe on the stripe.com domain, reached by a link from our website. No account or login is required. The sale is governed by the Gift Card Terms.
4.1. What data we process
- e-mail address — to which we send the card and with which we correspond about the purchase;
- name — as entered on the payment page;
- the recipient’s name — if provided; we print it on the card;
- company name, NIP and address — if you buy as a business and provide them to receive an invoice; we print the NIP on the fiscal receipt;
- transaction data — amount, currency, date and time, language of the payment page, payment identifiers assigned by Stripe (of the checkout session, the payment and the payment link);
- gift card data — code, value, code validity period, information on redemption, exchange or cancellation of the card.
We do not receive payment card details, BLIK codes or online banking credentials. They are processed only by Stripe (and by your bank or card issuer). We do not collect a phone number or billing address, unless you provide an address as a business in order to receive an invoice.
4.2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Selling the card, issuing it and sending it by e-mail, resending it, exchanging the card, redeeming it in the shop | Article 6(1)(b) GDPR — performance of a contract |
| Handling withdrawal from the contract, refunds and complaints | Article 6(1)(b) GDPR — performance of a contract, and Article 6(1)(c) GDPR — obligations under consumer protection law |
| Recording the sale on the cash register, issuing invoices, bookkeeping and tax settlements | Article 6(1)(c) GDPR — obligations under tax and accounting law |
| Establishing, pursuing and defending claims; preventing abuse, including investigating disputed payments (chargebacks) | Article 6(1)(f) GDPR — our legitimate interest in protection against claims and abuse |
Providing an e-mail address is a condition of concluding the contract — without it we cannot deliver the card. Providing other data is voluntary, except that without a NIP we cannot issue an invoice to a business (Article 106b(5) of the Polish VAT Act).
4.3. The recipient’s data
The recipient’s name is another person’s data provided to us by the buyer. We process it only to print it on the card and erase it together with the buyer’s contact data (section 8). Please do not include sensitive information in it, in particular about health, beliefs or private life. If you are the recipient, you have the rights described in section 9.
5. Stripe
Payments are processed by Stripe Payments Europe Ltd., with its registered office in Dublin (Ireland). Stripe processes payment data on our behalf to collect the payment and, for fraud prevention, anti-money-laundering and regulatory compliance, as a separate controller, on the terms and for the periods set out in Stripe’s privacy policy: https://stripe.com/pl/privacy. Stripe may transfer data to Stripe, Inc. in the United States (section 7).
If you request erasure, we will also erase or anonymise the data in Stripe to the extent Stripe processes it on our behalf. To the extent Stripe is a separate controller, you may also exercise your rights directly with Stripe.
6. Recipients of data
We disclose data only to the extent necessary for the purposes described above:
- Stripe Payments Europe Ltd. (Ireland) — payment processing, as described in section 5;
- Hetzner Online GmbH (Germany) — hosting of the locusartis.pl website and of the system in which the shop keeps its records of sales and gift cards and from which the cards are sent; servers in the European Economic Area;
- Cloudflare, Inc. (USA) — content delivery network and protection of the website against attacks; Cloudflare relays traffic to the website and sees the data described in section 2;
- Google Ireland Limited (Ireland) — delivery of e-mail sent by the shop’s system, including the e-mail with the gift card (the Gmail service);
- the accounting office serving the shop — to the extent of the data needed for bookkeeping and tax settlements;
- public authorities, including tax authorities — where the law requires us to disclose data.
Entities processing data on our behalf do so under data processing agreements. We do not sell personal data and do not share it for marketing purposes.
7. Transfers outside the European Economic Area
The records of sales and gift cards are kept on servers in the European Economic Area. Data may be transferred to the United States in the following cases: by Stripe (to Stripe, Inc.), by Cloudflare and by Google (as the e-mail provider and — after you click the map — for Google Maps). The transfer is based on the European Commission’s adequacy decision under the EU-US Data Privacy Framework (Article 45 GDPR) for the entities certified under it, and in addition on standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). We provide a copy of the safeguards on request.
8. Retention
| Data | Retention |
|---|---|
| The buyer’s e-mail address and name, the recipient’s name stored with the card | Until 12 months after the day on which the card was redeemed, its code expired or the card was cancelled — after that we erase them from the card |
| The record of the card sale, fiscal receipt data (including the NIP), invoice details, invoices, Stripe payment identifiers, refund records | 5 years from the end of the calendar year to which they relate — as required by accounting and tax law |
| The card’s code, value and history (without contact data) | As for the record of the card sale — 5 years from the end of the calendar year to which they relate |
| Correspondence on withdrawal from the contract and complaints | Until the limitation period for claims under the contract expires, and to the extent it documents a refund — as for the record of the sale |
| Other correspondence | Up to 3 years after the matter is closed |
| Server logs | A short period necessary for security, as set in the settings of the hosting provider and Cloudflare |
Data that Stripe keeps as a separate controller is retained by Stripe for the periods set out in its privacy policy.
9. Your rights
You have the right to:
- access your data and obtain a copy of it (Article 15 GDPR);
- rectification of inaccurate or incomplete data (Article 16 GDPR);
- erasure of data (Article 17 GDPR) — except data we must keep under tax and accounting law (section 8); in that case we erase the data the law does not require and limit the rest to the necessary minimum;
- restriction of processing (Article 18 GDPR);
- data portability for data processed to perform a contract (Article 20 GDPR);
- object to processing based on our legitimate interest (Article 21 GDPR).
Please send requests to [email protected]. We reply without undue delay and in any event within one month of receiving the request. We may ask for information that confirms the request comes from the data subject — for example, that it is sent from the e-mail address used for the purchase.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl/).
10. Automated decision-making and profiling
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Stripe, as a separate controller, may use automated mechanisms to detect payment fraud — see Stripe’s privacy policy.
11. Data security
The website and the payment page use an encrypted connection (HTTPS). Only authorised shop staff have access to the gift card records, to the extent their work requires. Payment data stays in Stripe’s systems and never reaches the shop.
12. Changes to this Privacy Policy
We may change this Policy if the law, the way the website works, the way gift cards are sold or the list of data recipients changes. The current version is always available at https://locusartis.pl/en/privacy-policy/, and its opening line states the date from which it applies. Earlier versions are available on request.
This Policy is available in Polish and in English. In the event of any discrepancy, the Polish version prevails.
13. Cookies
Cookies are small files stored in your browser. On locusartis.pl we use only cookies that are strictly necessary for the website to work and stay secure. We do not use analytics, statistics or marketing cookies, and we do not embed tracking tools or advertising pixels. Strictly necessary cookies do not require consent (Article 399 of the Polish Electronic Communications Law), which is why the website does not show a consent banner.
- Cloudflare cookies — protect the website against attacks and automated traffic (bots).
- WordPress cookies — set only for people who log in to the website’s editing panel; they are not set for ordinary visitors.
- pll_language — remembers the language version you chose (Polish or English) for one year; used only to display the website in that language.
The Google map loads only after you click it (section 2.1). Only then may Google store its own cookies on your device, on the terms set out in its privacy policy.
The workshop booking calendar loads only after you click it (section 2.2). Only then may skos.studio store its own cookies on your device.
The gift card payment page runs on Stripe’s domain (stripe.com), not on locusartis.pl. The links to it do not place any Stripe cookies on our website. Cookies used on the payment page are governed by Stripe’s rules (https://stripe.com/pl/privacy).
You can change your cookie settings in your browser, including deleting stored cookies or blocking them. Blocking strictly necessary cookies may make the website harder to use.