1. Data Controller

The Aquarian Alchemist Sp. z o.o.
ul. Sosnowa 6, 96-321 Osowiec
Poland
KRS (National Court Register No.): 0001172255
NIP (Tax Identification No.): PL5291861553
REGON (National Business Registry No.): 541702507
E-mail: hi@theaquarianalchemist.com
Tel.: +48 22 390 5886

We inform you that The Aquarian Alchemist Sp. z o.o. is entered into the National Court Register kept by the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register, under KRS number 0001172255.

2. Data Protection Officer / Data Protection Contact Point

In matters related to the protection of your personal data, you can contact our GDPR Department by e-mail: rodo@theaquarianalchemist.com.

3. Purposes and legal bases for data processing

We process your personal data for the following purposes and on the following legal bases:

  • Performance of a sales contract or a contract for the provision of electronic services (Article 6(1)(b) GDPR): processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract, e.g., processing orders, handling payments, delivering goods, maintaining a Customer account in the Store.
  • Fulfilment of legal obligations incumbent on the Controller (Article 6(1)(c) GDPR): e.g., resulting from tax and accounting regulations (issuing and storing invoices, accounting documentation).
  • Your consent (Article 6(1)(a) GDPR): for marketing purposes, such as sending newsletters, information about promotions, loyalty programs, as well as for remarketing and profiling for marketing purposes, provided you have given separate consent.
  • Legitimate interest of the Controller (Article 6(1)(f) GDPR): e.g., to ensure the security of the services provided, prevent abuse and fraud, establish, pursue or defend against claims, conduct sales statistics and analysis, direct marketing of own products or services (other than that based on consent), handling inquiries.

4. Categories of data collected

We process the following categories of your personal data:

  • Mandatory identification and contact details: first name, last name, e-mail address, billing address, shipping address.
  • Optional identification and contact details: phone number (if provided).
  • Transaction data: information about orders, payments.
  • Technical data: IP address, device type, operating system, browser, information collected via cookies and similar technologies (details in the “Cookies” section).

5. Data recipients

Your personal data may be transferred to the following categories of recipients:

  • Logistics and courier service providers: e.g., InPost, Apaczka, Furgonetka, to deliver ordered goods.
  • Electronic payment system operators: e.g., imoje (ING Bank Śląski S.A.), Autopay, PayPal, Przelewy24, Stripe, to handle payments for orders.
  • IT and hosting service providers: supporting the operation of the Online Store and IT systems.
  • Analytical and marketing tool providers: e.g., Google Analytics (for website traffic analysis), MailChimp (for sending newsletters, if you have consented).
  • Accounting offices and audit firms: to the extent necessary for bookkeeping and fulfilling legal obligations.
  • State authorities: based on applicable laws (e.g., tax offices, police).

6. Transfer of data outside the European Economic Area (EEA)

If your personal data is transferred to recipients based outside the European Economic Area (e.g., some IT service providers or analytical/marketing tool providers), we ensure an adequate level of protection for this data. Such transfers are most often based on standard contractual clauses approved by the European Commission, which guarantee appropriate safeguards. You have the right to obtain a copy of these safeguards by contacting us.

7. Data retention periods

Your personal data will be stored for the following periods:

  • Data related to the performance of contracts (including Customer account data): for the duration of the contract and after its termination for the period necessary to establish, pursue or defend against claims (usually up to 3 years from the end of the contract or in accordance with the statutory limitation periods for claims) and for the period required by law (e.g., tax regulations on the storage of accounting documentation – usually 5 years from the end of the calendar year in which the tax payment deadline expired).
  • Data processed on the basis of consent (e.g., marketing data): until you withdraw your consent, or until the purpose of processing is achieved, or until we determine that the data is outdated.
  • Data processed on the basis of legitimate interest: until an effective objection is raised or until the purpose of processing is achieved.
  • System logs and analytical data: for the period necessary to ensure security and analysis (usually from a few months to 2 years).

8. Rights of data subjects

In connection with the processing of your personal data, you have the following rights:

  • Right of access to data: you can obtain information about the processing of your data and a copy of this data.
  • Right to rectification of data: you can request the correction of incorrect or completion of incomplete data.
  • Right to erasure of data (“right to be forgotten”): in cases specified in the GDPR (e.g., when the data is no longer necessary for the purposes for which it was collected, or when you have withdrawn your consent to its processing and there is no other legal basis).
  • Right to restriction of processing: in cases specified in the GDPR (e.g., when you contest the accuracy of the data – for a period enabling the Controller to verify the accuracy of the data).
  • Right to data portability: you can receive, in a structured, commonly used and machine-readable format, the personal data concerning you that you have provided to us, and you have the right to transmit this data to another controller (applies to data processed on the basis of consent or a contract by automated means).
  • Right to object:
    • If your data is processed on the basis of the legitimate interest of the Controller (Article 6(1)(f) GDPR), you may object to the processing of your data on grounds relating to your particular situation.
    • If your data is processed for direct marketing purposes, you have the right to object at any time to the processing of your data for such marketing, including profiling, to the extent that processing is related to such direct marketing.
  • Right to withdraw consent: if processing is based on your consent (Article 6(1)(a) GDPR), you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Consent can be withdrawn in the same way it was given, e.g., by e-mail.
  • Right to lodge a complaint with a supervisory authority: if you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The lead supervisory authority for The Aquarian Alchemist Sp. z o.o. is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

You can submit requests regarding the exercise of these rights by e-mail to our GDPR Department: rodo@theaquarianalchemist.com or in writing to the Controller’s registered office address.

9. Cookies and Similar Technologies

Our Online Store uses cookies and other similar technologies.

  1. What are cookies? Cookies are small text files stored on your end device (e.g., computer, tablet, smartphone) that can be read by our IT system (first-party cookies) or third-party IT systems (third-party cookies).
  2. Integration with social media: some Store functions may integrate with social media services, which may save their own cookies.
  3. Persistent cookies: these are stored on the User’s end device for the time specified in the cookie parameters or until they are deleted by the User.
  4. For other cookies (analytical, marketing, preference-related), the legal basis is your consent (Article 6(1)(a) GDPR), expressed through the cookie consent management mechanism (e.g., cookie banner) available on the Store’s website. This consent is voluntary and can be withdrawn at any time.
  5. You can also delete cookies stored on your device through the appropriate browser functions, dedicated programs, or tools available in your operating system.

10. Profiling

Your personal data may be processed by automated means, including profiling, for marketing purposes (e.g., to tailor advertising offers to your interests), provided you have given separate consent. Decisions based on profiling will not, however, produce legal effects concerning you or similarly significantly affect you. Profiling uses data such as purchase history and activity on the Store’s website. You have the right to object to profiling for direct marketing purposes or withdraw your consent at any time.

11. Obligation or voluntariness of data provision

Providing mandatory data (indicated, e.g., in the order form) is necessary to conclude and perform a sales contract or provide electronic services. Failure to provide this data will make it impossible to process the order or provide the service. Providing optional data is voluntary and aims to improve service or enable the use of additional functionalities (e.g., marketing, if you consent).

12. Data security

The Controller uses appropriate technical and organizational measures to ensure the protection of processed personal data, adequate to the threats and categories of data protected. These measures include, among others, securing IT systems (e.g., SSL encryption), access control to data, regular backups, and procedures for handling data breaches.

13. Changes to the privacy policy

This Privacy Policy may be updated periodically. We will inform you of any changes by publishing the new version of the Privacy Policy on the Online Store’s website. We recommend regularly reviewing the Policy. In the case of significant changes, we may also inform you about them in another way, e.g., by e-mail.

Last updated: 01/06/2025