+48 606 628 444

Privacy policy

1. Purpose of this privacy policy

THE SIGN ("we" or "us") prioritizes the protection of personal data and strives to ensure full openness and transparency regarding the processing of personal data. This privacy policy explains how we process personal data, what rights you have, and how you can contact us regarding data protection.

The policy applies when visiting our website, using the online store, placing orders, and contacting us, for example, via the contact form.

2. Data controller

The controller of personal data is THE SIGN, which processes data in accordance with this policy and applicable law, including Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

THE SIGN Daniel Dziubczyński
ul. Ludowa 47, 45-820 Opole
NIP: 7542725499 · REGON: 160102512 · entry in CEIDG
Tel.: +48 606 628 444
E-mail: thesignopole@gmail.com

We have not appointed a data protection officer — for all matters regarding the processing of personal data, please contact us using the details provided above.

3. Use of cookies

On our website, we use cookies based on Art. 173 of the Telecommunications Law Act. Upon your first visit, we display information about the use of cookies and ask for your consent decision. Cookies necessary for the operation of the store (e.g., maintaining the session and shopping cart) are always used; analytical and marketing cookies — only after consent is given. You can change your decision at any time via the "Cookie settings" link in the footer of the page.

Cookies can also be deleted or blocked in your web browser settings.

4. Processing of personal data

We process personal data solely for the fulfillment of legally justified purposes. The purpose and legal basis depend on the situation in which the data is processed.

4.1 Contacting our company

If you contact us by phone, email, or via the form on the website, we process the provided data (including name and surname, company, NIP, email address, telephone number, content of the inquiry) in order to handle the inquiry, prepare an offer, or provide a quote.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in handling the inquiry), and in the case of inquiries regarding a contract or order — Art. 6(1)(b) GDPR.

4.2 Customer account and placing orders

When creating an account and placing orders, we ask you to provide the following data:

  • company name and registration details (NIP),
  • name and surname of the contact person,
  • billing address and delivery address,
  • email address and telephone number,
  • data necessary for payment processing (for bank transfer payments: invoice details and bank account number from which the payment is made).

We process this data in order to conclude and perform the sales contract, manage the order and payment, and handle inquiries regarding the order. We process only ordinary personal data — never special categories of data (sensitive data).

The legal basis is Art. 6(1)(b) GDPR (performance of a contract), and in exceptional cases Art. 6(1)(f) GDPR (legitimate interest). The processing of data in accounting documentation is based on Art. 6(1)(c) GDPR (legal obligation).

4.3 Complaints and service requests

We process the data provided in complaint submissions (contact details, order number, description of the issue) in order to consider the complaint and fulfill statutory warranty obligations. The legal basis is Art. 6(1)(b) and (c) GDPR.

4.4 Establishing, pursuing, and defending against claims

We may process personal data for the purpose of establishing, pursuing, or defending against claims — the legal basis is Art. 6(1)(f) GDPR (our legitimate interest).

4.5 Voluntary provision of data, no profiling

Providing personal data is voluntary, but necessary to conclude and perform the contract, handle an inquiry, or process a complaint — without providing the data, it will not be possible to carry out these actions.

We do not make automated decisions regarding you, including decisions based on profiling.

5. Data retention period

We store personal data for the period necessary to achieve the purpose for which they were collected, or for the period required by law. In particular:

  • data contained in accounting documents (order confirmations, invoices) — for the period resulting from accounting regulations, as a rule 5 years from the end of the financial year,
  • data from inquiries not concluded with a contract — until the inquiry is handled, and then until the expiry of the limitation period for potential claims,
  • data processed for the purpose of pursuing or defending claims — until the expiry of the limitation period for claims,
  • data processed on the basis of consent — until its withdrawal.

6. Data recipients and processors

In principle, we do not transfer data to third parties. Exceptions are situations provided for by law (e.g., a request from a public authority) and entities to which we entrust data for the performance of services on our behalf:

  • the provider of the store platform and hosting (Shopify),
  • courier and transport companies handling deliveries,
  • banks and payment institutions — to the extent necessary to settle payments,
  • accounting office and legal advisors,
  • IT tool providers (email, internal systems).

Processors act solely on the basis of data processing agreements, in accordance with our instructions, and are obliged to maintain confidentiality.

7. Transfer of data to third countries

We use the Shopify Inc. platform, whose servers and processors may be located outside the European Economic Area. The transfer of data takes place based on mechanisms compliant with the GDPR:

Provider Basis for data transfer Documentation
Shopify Inc. (Canada; subcontractors in the USA) European Commission adequacy decision (Canada) and standard contractual clauses (SCC); entities covered by the EU–U.S. Data Privacy Framework shopify.com/legal/privacy

8. Security

We apply technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Access to systems is restricted to authorized persons.

9. Your rights

In connection with the processing of personal data, you have a number of rights. To exercise them, please contact us using the details provided in point 2.

9.1 Right of access to data

You have the right to obtain confirmation as to whether we process your data, and access to them along with information about the processing.

9.2 Right to rectification of data

You have the right to request the rectification of incorrect data and the completion of incomplete data.

9.3 Right to erasure of data

In cases provided for by law, you may request the erasure of data before the expiry of the standard retention period.

9.4 Right to restriction of processing

In cases provided for by law, you may request the restriction of data processing to its storage.

9.5 Right to object

You may object to the processing of data based on a legitimate interest, and to processing for direct marketing purposes — at any time.

9.6 Right to data portability

In cases provided for by law, you may receive your data in a structured, commonly used, and machine-readable format.

9.7 Right to withdraw consent

If the processing is based on consent, you may withdraw it at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9.8 Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

10. Changes to the privacy policy

We update the privacy policy regularly to ensure it meets current legal requirements. We will inform you of significant changes on the website or via email.

Last updated: September 2026