This policy explains what personal data we process when you use the bespokewelding.eu shop, why we process it, how long we keep it and what rights you have. It applies from 16 October 2026.
1. Data controller
The controller of your personal data is:
For any question about personal data, write to [email protected]. We have not appointed a data protection officer.
2. Purposes and legal bases
Customer account
Name, email address, password (stored only as a secure hash), addresses, phone number, company details and order history. Legal basis: performance of the Account agreement (Article 6(1)(b) GDPR).
Orders, offers and performance of the contract
Contact and address details, order specification (dimensions, descriptions, photos or sketches you send us), correspondence, payment and delivery information. Legal basis: steps taken before entering into a contract and performance of the contract (Article 6(1)(b) GDPR).
Enquiries and the contact form
Contact details and the content of your message. Legal basis: steps taken before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in answering messages (Article 6(1)(f) GDPR).
Accounting and tax obligations
Data needed for sales documents and records. Legal basis: legal obligation (Article 6(1)(c) GDPR).
EU VAT number check
If you enter a company EU VAT number, we check it in the EU VIES system. Legal basis: legal obligation and our legitimate interest in handling the transaction correctly for tax purposes (Article 6(1)(c) and (f) GDPR).
Complaints, withdrawal and claims
Data needed to handle the matter. Legal basis: legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in establishing, pursuing or defending claims (Article 6(1)(f) GDPR).
Newsletter
Email address. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time without affecting the lawfulness of earlier processing.
Product reviews
Your first name or display name, review text, rating and any photos. Legal basis: our legitimate interest in publishing customer reviews (Article 6(1)(f) GDPR).
Security and shop statistics
IP address, browser information, pages visited, referring page and server logs. We use them to keep the shop secure, prevent abuse and keep basic visit statistics inside the shop software itself. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
3. Recipients
We share data only as far as needed for the purpose concerned, with these categories of recipients:
- hosting, server and email providers that run the Shop,
- people and companies giving us technical support in maintaining the Shop,
- carriers and freight forwarders, if you choose delivery,
- banks handling bank transfer payments,
- our accounting office,
- the European Commission and tax authorities when an EU VAT number is checked (VIES),
- public authorities where the law requires it.
We do not currently use any external analytics or advertising tools. If that changes, such tools will only run with your consent and this policy will be updated.
4. Transfers outside the EEA
We process data within the European Economic Area. For deliveries outside it, the data needed for delivery is passed to the carrier and recipients in the destination country. Where the European Commission has found that the country ensures an adequate level of data protection, for example the United Kingdom or Switzerland, the transfer relies on that decision (Article 45 GDPR); otherwise it is necessary to perform the contract with you (Article 49(1)(b) GDPR).
5. How long we keep data
- Account: until it is deleted.
- Order and contract data: until claims under the contract become time-barred.
- Sales documents and records: for the period required by tax law, as a rule 5 years from the end of the tax year.
- Enquiries that did not lead to a contract: up to 12 months after our last contact.
- Newsletter: until you withdraw consent.
- Reviews: until they are removed at your request or by us.
- Security logs and statistics: up to 12 months.
6. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time. To exercise these rights, write to [email protected].
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in your country of residence.
7. Is providing data required?
Providing data is voluntary. However, without the data marked as required we cannot create an Account, prepare an offer, or conclude and perform a contract.
8. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you.
9. Cookies
- The Shop uses essential cookies that make the cart, login, language and currency selection work and remember your cookie choice. These cookies do not require consent.
- Other cookies (analytics or marketing) may only be used after you consent in the cookie banner. We do not currently use such tools.
- You can change your choice in the cookie settings available in the Shop and delete stored cookies in your browser settings.
10. Changes to this policy
We update this policy when the law or the way the Shop works changes. The current version is always available on this page.