Privacy Policy

This Privacy Policy explains how Lascava Sp. z o.o. ("Lascava", "we", "us") collects, uses, stores, and shares personal data when you use lascava.com or place an order. We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Polish data protection law.

This policy should be read together with our Cookie Policy and our Terms of Service.

1. Data controller

The controller responsible for processing your personal data is:

Lascava Sp. z o.o.
Registered office: Sadowa 2/11, Lublin, Poland
KRS: 0000790386 NIP: 7123388488
Contact: info@lascava.com

We have not appointed a Data Protection Officer, as our processing activities do not meet the criteria for mandatory designation under Article 37 GDPR. Please direct all data protection enquiries to the address above.

2. What data we collect

Data you provide to us:

Name, delivery address, email address, and phone number when you place an order
Account credentials if you register an account
Correspondence when you contact customer service
Your email address if you subscribe to our newsletter
Product reviews and ratings you choose to submit

Data collected automatically:

IP address, browser type, device type, and operating system
Pages viewed, time spent on the site, and referring source (only if you accept analytics cookies)
Cookie identifiers, as described in our Cookie Policy

Payment data: when you pay by card or through PayPal, your payment details are entered directly on the payment provider's systems. Lascava never receives or stores full card numbers, CVV codes, or PayPal credentials. We receive only the transaction result, the amount, and a partial identifier needed to match the payment to your order.

3. Why we process your data, and on what legal basis

Purpose	Data used	Legal basis
Processing and delivering your order	Name, address, email, phone, order contents	Performance of a contract — Art. 6(1)(b)
Processing payments	Transaction data, order identifier	Performance of a contract — Art. 6(1)(b)
Managing your account	Account credentials, order history	Performance of a contract — Art. 6(1)(b)
Handling returns, exchanges, and complaints	Order data, correspondence, bank details for refunds	Contract and legal obligation — Art. 6(1)(b), 6(1)(c)
Issuing invoices and keeping accounting records	Billing name, address, transaction data	Legal obligation — Art. 6(1)(c)
Answering customer service enquiries	Contact details, correspondence	Contract or legitimate interest — Art. 6(1)(b), 6(1)(f)
Sending our newsletter	Email address	Consent — Art. 6(1)(a)
Website analytics	Usage data, cookie identifiers	Consent — Art. 6(1)(a)
Site security and fraud prevention	IP address, server logs	Legitimate interest — Art. 6(1)(f)

Where we rely on legitimate interest, that interest is keeping the website secure and responding to enquiries. You may object to this processing at any time (see Section 7).

4. Who receives your data

We share personal data only with the parties listed below, and only to the extent needed for the stated purpose:

Delivery companies — Global Express and FedEx receive your name, delivery address, and phone number in order to deliver your parcel
Payment providers — WayForPay and PayPal process your payment
Hosting provider — stores the website and its database
Google Analytics — receives pseudonymised usage data, only if you accept analytics cookies
Accounting and tax authorities — receive invoice data where Polish law requires it

We do not sell your personal data. We do not share it with advertising networks or marketing partners.

5. International data transfers

Some processing of your personal data takes place outside the European Economic Area (EEA):

Hosting infrastructure — physical servers are located in Germany, within the EEA, but the hosting provider is registered in Ukraine, and some technical operations and support may involve access from Ukraine. Where such access occurs, we require our provider to apply appropriate safeguards under Articles 44–49 GDPR, including the Standard Contractual Clauses adopted by the European Commission
Google Analytics — Google LLC may transfer pseudonymised usage data to servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection; Standard Contractual Clauses apply as an additional safeguard
WayForPay — card payment processing involves data exchange with infrastructure in Ukraine, subject to the Standard Contractual Clauses

You may request further information about these safeguards by writing to info@lascava.com.

6. How long we keep your data

Order and invoice data — 5 years from the end of the calendar year in which the transaction took place, as required by Polish tax law
Account data — for as long as your account is active. Accounts inactive for more than 3 years are deleted or anonymised, unless a legal obligation requires longer retention
Customer service correspondence — up to 3 years from the last interaction
Newsletter subscription — until you unsubscribe
Analytics data — governed by our Google Analytics retention setting, currently 14 months for user-level data
Cookie data — as set out in our Cookie Policy

7. Your rights

Under the GDPR you have the right to:

Access your personal data and receive a copy of it (Art. 15)
Rectify inaccurate or incomplete data (Art. 16)
Erase your data where no legal obligation requires us to keep it (Art. 17)
Restrict processing in certain circumstances (Art. 18)
Receive your data in a structured, machine-readable format and have it transmitted to another controller (Art. 20)
Object to processing based on legitimate interest (Art. 21)
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3))

To exercise any of these rights, write to info@lascava.com. We respond within one month of receiving your request. This period may be extended by two further months for complex requests, in which case we will tell you within the first month.

8. Complaints to a supervisory authority

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority.

Our lead authority is the Polish data protection authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl

If you live in another EU or EEA country, you may also complain to the supervisory authority of your country of residence or workplace.

9. Data security

All traffic between your browser and our website is encrypted using HTTPS/TLS
Account passwords are stored as cryptographic hashes, never in readable form
Payment data is handled by PCI DSS certified providers and does not reach our servers
Access to customer data in our administration panel is limited to authorised personnel

No system is completely secure. In the event of a personal data breach likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform you directly where the risk is high, in accordance with Articles 33 and 34 GDPR.

10. Cookies

We use strictly necessary cookies to operate the website and, with your consent, analytics cookies to understand how the site is used. Full details of each cookie, its purpose, and its duration are set out in our Cookie Policy, where you can also change or withdraw your consent.

11. Children's privacy

Our website and products are intended for adults. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we delete it promptly. If you believe a minor has provided us with personal data, contact info@lascava.com.

12. Newsletter and marketing

You can subscribe to our newsletter using the form in the website footer or in your account settings. Subscribing is entirely voluntary and separate from placing an order — you can buy from Lascava without subscribing, and subscribing does not create a customer account.

We process only your email address for this purpose, on the basis of your consent (Art. 6(1)(a) GDPR). We use it to send news about our range, restocks, and offers. We do not send marketing messages to customers who have not subscribed, and we never pass subscriber addresses to third parties.

You can unsubscribe at any time using the unsubscribe link in any message we send, through your account settings, or by writing to info@lascava.com. Once you unsubscribe, we delete your address from the mailing list.

13. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects concerning you, and we do not build profiles of individual customers for marketing purposes.

14. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, our service providers, or the law. The "Last updated" date at the top of this page shows when it was last revised. Where a change materially affects how we process your data, we will notify you by email or through a prominent notice on the website.

Questions

For any question about this policy or about how we handle your data, write to info@lascava.com or visit our Contact page. Related pages: Cookie Policy, Terms of Service.