What we know and what we do with it

The controller of personal data is Tomasz Stanisławski, carrying on unregistered business activity under Polish law, correspondence address: contact@swordsvault.com.

Contact on data protection matters: contact@swordsvault.com.

The controller has not appointed a data protection officer — at this scale of activity there is no obligation to. Everything is handled at the address above.

From you alone: from the order form, from the account registration form, or from a message you send us.

We buy no databases, pull no data from other services and combine it with no external profiles.

Fulfilling an order — name, delivery address, e-mail, phone, contents of the order. Basis: Article 6(1)(b) GDPR, performance of a contract. We keep the data:

• a)for as long as the order is being fulfilled and any complaints handled;
• b)then until the limitation periods for claims under the contract expire.

Accounting and the record of sales — data needed to show income. Basis: Article 6(1)(c) GDPR, a legal obligation. Retention: 5 years from the end of the year in which the tax obligation arose.

A shop account — e-mail address, first name, hashed password, order history. Basis: Article 6(1)(b) GDPR. We keep the data until the account is deleted; orders stay in the records because of tax obligations.

An account created through Google — the same as above, except that in place of a password we keep your Google account identifier. Such an account has no password and cannot be entered any other way than through Google.

Details for future orders — the name, phone number and delivery address saved on the account so that checkout can fill them in next time. We save them only when you ask us to: by ticking the box at checkout, or by filling them in under account settings. That is also where you change or clear them in one click. Basis: Article 6(1)(b) GDPR. Retention: until you clear them or delete the account.

Correspondence — the content of the message and the sender's address. Basis: Article 6(1)(f) GDPR, the legitimate interest of answering you. Retention: up to a year after the matter is closed.

News about new arrivals — your e-mail address and the date you signed up. Basis: Article 6(1)(a) GDPR, your consent. You confirm the sign-up by clicking a link in an e-mail; without that click we send nothing. One click in any message withdraws the consent, and we then keep the address only so that it cannot find its way back onto the list.

Visit statistics — country, the address of the page opened, the time, and whether the visit looks automated. Basis: Article 6(1)(f) GDPR, the legitimate interest of knowing what people look at in the shop. We do not store IP addresses at all:

• a)we compute an irreversible hash from the IP address, the browser, the date and a secret string, and keep only its first twelve characters;
• b)the hash changes at midnight, so the same person cannot be recognised the next day, nor tied to an order or an account;
• c)the basket, the order page and the account are not counted at all;
• d)entries older than a year are deleted.

Defending against claims and pursuing our own — within the data already collected. Basis: Article 6(1)(f) GDPR.

Giving your data is voluntary, but without it a contract of sale can be neither concluded nor performed.

Only those the shop cannot run without:

• a)Cloudflare, Inc. — hosting, database and image storage;
• b)Google Ireland Ltd. — only when you sign in with a Google account. Google checks who you are and passes us three things: a permanent account identifier, your e-mail address and your first name. We never see your Google password. If you sign in with a password instead, Google learns nothing about you;
• c)Stripe Payments Europe, Ltd. — card and BLIK payments; payment details go straight to the operator and the Seller never sees the card number;
• d)Resend (transactional e-mail provider) — sending confirmations and order status notifications;
• e)the carrier chosen with the order — the name, address and phone number needed to deliver the parcel;
• f)the bank holding the account — as far as the data visible on a transfer.

We have data processing agreements with the technical service providers. We do not sell data and do not share it for marketing purposes — with anyone.

Cloudflare and Resend are based in the United States, so data may be processed outside the European Economic Area. This happens on the basis of standard contractual clauses approved by the European Commission and of the adequacy decision for entities certified under the Data Privacy Framework.

Deliveries to other Member States mean passing your address to a carrier operating in your country. Data stays inside the EEA in that case.

At any time you may:

• a)obtain access to your data and a copy of it;
• b)rectify inaccurate data or complete incomplete data;
• c)ask for erasure, so far as no legal obligation — a tax one, for instance — stands in the way;
• d)ask for processing to be restricted;
• e)port the data to another controller — as far as data processed on the basis of a contract;
• f)object to processing based on a legitimate interest.

A message to contact@swordsvault.com is enough. We answer within a month.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw. If you live in another Member State, you may lodge it with your own supervisory authority instead.

There is no Google Analytics here, no advertising pixel and nothing that follows you between sites. Our own visit count is done by the server and writes nothing into your browser (described above). In the browser there are exactly three things, all strictly necessary:

• a)the „sesja” cookie — written only after you log in, it keeps the session going; unreadable to scripts, valid for 30 days, gone when you log out;
• b)browser local storage (localStorage) under the key „tomasz-swords:cart:v1” — it holds the contents of the basket so it survives a page refresh; the data is neither sent to the server nor shared with anyone;
• c)local storage under the key „tomasz-swords:ciasteczka:v1” — a single value written when you dismiss the cookie notice, so it does not reappear on every visit.

Because all three are strictly necessary to provide the service, they require no consent: both the ePrivacy Directive and Polish telecommunications law exempt storage needed to deliver the service you asked for. The duty to inform remains, and that is what the notice on your first visit is for. It carries no “Reject” button because there is nothing here to reject — without the basket and the session the shop stops working. Should analytics or advertising ever arrive, they will arrive together with a request for consent, and that consent will be withdrawable.

The language you choose is remembered by the address itself rather than a cookie — the Polish version sits under an address with „/pl”, the English one without a prefix.

The visit statistics described above use no cookie and no identifier stored in your browser. The server counts them and leaves nothing behind on your device.

We serve typefaces from our own server, so opening the page connects you to no Google server and no other third party.

The connection to the shop is encrypted (HTTPS). Passwords are stored as cryptographic hashes only — we do not know them and they cannot be recovered from the database.

Only the shop's administrator has access to the admin panel and to order data.

We do not profile you and take no automated decisions about you. You get no different prices and no different content than anyone else.

We may change this policy when the way the shop works changes, or the law does. A new version takes effect on the day it is published on this page.

This policy is published in Polish and in translations into other languages. In the event of a discrepancy between versions, the Polish version prevails.

This policy is in force from 17 September 2026.