Polityka prywatności
Last updated: 02.07.2026
1. Who we are
This store and website smagapaperwood.com are operated by:
Smaga Monika Smaga, Nad Brda 4, 86-021 Bożenkowo, Poland. NIP: PL8431564504 · REGON: 383323002 Email: hello@smagapaperwood.com
We are the controller of your personal data within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). We have not appointed a Data Protection Officer, as we are not required to; for any privacy matter, contact us at the email above.
2. What this policy covers
This policy explains what personal data we collect when you visit our website, buy a digital product, sign up for our emails, or contact us — how we collect it, how we use, share, store, and protect it, and the rights you have over it.
3. What data we collect, and how
Data you give us directly — order details, account details, messages you send us, and information you enter into forms on the site.
Data collected automatically — technical and usage data (IP address, browser and device type, pages viewed) through cookies and similar technology while you browse.
Data received from our payment provider — confirmation that your payment was successful, and the minimum transaction details needed to fulfil your order, after you complete checkout. We do not receive or store your full card number.
Data you provide when creating an account — your email and any details you choose to save for future orders.
In detail:
- Order data: your name, email address, billing address, and the details of what you bought. Because our products are digital downloads, we do not collect or need a shipping address.
- Payment data: processed by our payment provider (see section 7). We do not store your full card details on our servers.
- Account data: if you create an account, your email and any details you save.
- Email signup data: the email address (and any name) you give when subscribing to our newsletter or requesting a free template.
- Correspondence: anything you send us when you contact us for support.
Data collected automatically
- Technical and usage data: IP address, browser and device type, pages viewed, and similar log data, collected through cookies and analytics.
- See our separate [Cookie Policy] for the full list of cookies and how to manage them.
4. Is providing your data mandatory?
Providing the personal data necessary to place an order — your name, email, and billing details — is required to conclude and perform the sales contract. If you do not provide this information, we cannot process your order, deliver your files, or issue a valid invoice.
Providing data for our newsletter or the free-template signup is voluntary and based on your consent; you can decline without affecting any purchase.
5. Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
| Processing your order and delivering your digital files | Performance of a contract — Art. 6(1)(b) |
| Handling payment and issuing invoices | Performance of a contract, and a legal obligation — Art. 6(1)(b), (c) |
| Keeping accounting and tax records | Legal obligation — Art. 6(1)(c) |
| Sending our newsletter and free-template emails | Your consent — Art. 6(1)(a) |
| Sending order confirmations, download links, and invoices | Performance of a contract — Art. 6(1)(b) |
| Answering enquiries and providing customer support | Legitimate interest — Art. 6(1)(f) |
| Preventing fraud and verifying licence compliance | Legitimate interest — Art. 6(1)(f) |
| Establishing, exercising, or defending legal claims | Legitimate interest — Art. 6(1)(f) |
| Securing the site and preventing misuse | Legitimate interest — Art. 6(1)(f) |
| Non-essential cookies and analytics | Your consent — Art. 6(1)(a) |
Where we rely on “legitimate interest,” we mean specifically: preventing fraudulent orders, responding to your support requests, defending against or bringing legal claims (for example in a payment dispute), and keeping the store secure and working correctly. You can ask us for more detail on any specific case, or object to processing based on this basis, by contacting us (section 11).
You can withdraw any consent at any time (for example, using the unsubscribe link in our emails), without affecting processing already carried out.
6. Cookies
We use three categories of cookies:
- Essential cookies — required for the website and cart to function (for example, keeping items in your basket). These don’t require consent.
- Analytics cookies — help us understand how the site is used, only set with your consent.
- Marketing cookies — used for advertising and retargeting, only set with your consent.
You can accept, reject, or change your choices at any time through our cookie banner. Full details, including which specific cookies we use and their duration, are in our [Cookie Policy].
7. Who we share your data with (our processors)
We do not sell your data. We share it only with service providers who process it on our behalf, under data-processing agreements, to run the store. Depending on which services are active, our processors may include:
- Payment processing: Stripe, PayPal, Przelewy24, PayU
- Website hosting: Hostup.se
- Website security / content delivery: Cloudflare
- Email and newsletter platform: MailerLite
- Website analytics: Google LLC (Google Analytics)
- Other providers necessary for operating the store, updated here as they change.
We may also disclose data where required by law or to competent authorities.
8. Transfers outside the EEA
Some of our processors may process data outside the European Economic Area — for example, Google LLC and Stripe are based in the United States. Where this happens, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, or, where applicable, the processor’s certification under the EU–U.S. Data Privacy Framework. You can ask us for details of the specific safeguard used for any given transfer.
9. How long we keep your data
- Order and accounting records: for as long as required by Polish tax law (generally 5 years from the end of the relevant tax year).
- Newsletter data: until you withdraw consent or unsubscribe.
- Account data: for as long as you keep your account, then deleted or anonymised.
- Correspondence: up to 3 years after our last exchange with you, to allow us to handle any follow-up, warranty question, or dispute — unless a legal obligation requires longer retention.
- Records of downloads and order activity: kept to provide customer support, prevent fraud, and verify licence compliance, for as long as reasonably needed for those purposes or as required by law.
- Data kept for legal claims: where necessary, we may retain specific records for as long as needed to establish, exercise, or defend a legal claim (for example, in a payment dispute or chargeback).
- Analytics data: up to 3 years.
10. Your rights
Under the GDPR, you have the right to:
- access your data and receive a copy;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”), where applicable;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time, where processing is based on consent.
To exercise any of these, email us at hello@smagapaperwood.com. To protect your data, we may need to verify your identity before acting on a request — for example, by asking you to confirm the email address or order details associated with your account.
You also have the right to lodge a complaint with the Polish supervisory authority:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO) ul. Stawki 2, 00-193 Warszawa uodo.gov.pl
11. Security
We use technical and organisational measures appropriate to the risk, including:
- encrypted (HTTPS) connections across the site and checkout;
- encrypted storage of data where supported by our hosting and processors;
- access to customer data limited to those who need it, protected by passwords and account controls;
- regular backups;
No method of transmission or storage over the internet is completely secure, but we take reasonable steps to protect your information.
12. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
13. Transactional emails vs. marketing emails
We send two distinct kinds of email, and treat them differently:
- Transactional emails — order confirmations, download links, and invoices. These are necessary to fulfil your purchase and do not require separate marketing consent; you’ll receive them whenever you buy from us.
- Marketing emails — our newsletter and free-template offers. These are sent only with your consent, and you can unsubscribe at any time without affecting any order.
14. Records of downloads and order activity
We may keep records of your downloads and order activity to provide customer support, prevent fraud, and verify compliance with our licence terms (see our Licence FAQ). This is separate from marketing data and is not used to contact you commercially.
15. International customers
We welcome customers outside the European Economic Area. If you’re located outside the EEA, your local law may give you different or additional privacy rights from those described here; this policy describes the rights we provide under the GDPR to all our customers as a baseline, regardless of location.
16. Children
Our store is not directed at children, and we do not intentionally market our products to children or knowingly collect data from anyone under the age of 16. If you believe a child has provided us data, contact us and we will delete it.
17. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the “last updated” date at the top.
18. Contact
For any question about this policy or your data, email us at shop@smagapaperwood.com