Privacy policy
PRIVACY POLICY AND COOKIES POLICY
for the nomaddika.com Store website
I. Definitions
For the purposes of this document, the following definitions shall apply:
**Personal Data Controller / Controller** – Bartosz Cal, conducting business activity under the business name Bartosz Cal Nomaddika, entered into the Central Registration and Information on Business maintained by the minister responsible for economy, with registered address at Aleja Jana Pawła II 43A, apt. 37B, 01-001 Warsaw, Poland, VAT ID (NIP): 6652289449, REGON: 542479320;
**Personal Data** – information relating to a natural person that identifies or enables the identification of such person, meaning that the identity of the person concerned may be determined directly or indirectly based on such information;
**Processing** – any operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, retrieval, consultation, or erasure;
**Privacy and Cookies Policy / Privacy Policy** – this document specifying the rules for the processing of Personal Data via the Store, pursuant to and in accordance with the GDPR;
**GDPR** – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation);
**Online Store / Store** – the website operated by the Controller under the domain nomaddika.com;
**User** – a User or Customer within the meaning of the Terms and Conditions whose Personal Data is processed within the Store and in connection with agreements concluded through it.
II. General Information
1. This Privacy Policy has been prepared pursuant to and in accordance with all GDPR requirements. In particular, it contains all information that the Controller is obliged to provide to persons whose Personal Data is processed and collected pursuant to Article 13 of the GDPR, i.e., information necessary to ensure fairness and transparency of the processing of Personal Data by the Controller.
2. Terms written with capital letters and not defined in this Privacy Policy shall have the meaning assigned to them in the Store Terms and Conditions available on the Store website.
3. This Privacy Policy describes issues related solely to the Processing of Personal Data via the Store, including agreements concluded remotely on the basis of information available on the Store website.
4. The Store website uses encrypted data transmission, meaning it uses an SSL (Secure Sockets Layer) certificate, i.e., a network protocol used for secure network connections.
5. This version of the Privacy Policy is effective as of 21 May 2026.
III. Personal Data Controller
1. The Controller of the User’s Personal Data is Bartosz Cal, conducting business activity under the business name Bartosz Cal Nomaddika, entered into the Central Registration and Information on Business maintained by the minister responsible for economy, with registered address at Aleja Jana Pawła II 43A, apt. 37B, 01-001 Warsaw, Poland, VAT ID (NIP): 6652289449, REGON: 542479320.
2. The User may contact the Controller regarding their Personal Data via the following contact methods:
a. by post: Bartosz Cal Nomaddika, Aleja Jana Pawła II 43A, apt. 37B, 01-001 Warsaw, Poland;
b. by e-mail: [contact@nomaddika.com](mailto:contact@nomaddika.com);
c. by phone: +48 573 431 990.
3. The Controller has not appointed a Data Protection Officer because, due to the limited scope and scale of the processed Personal Data, it is not considered necessary or legally required.
IV. Scope of Processed Personal Data
1. Via the Store, the Controller may process Personal Data through:
2. contact form;
3. newsletter;
4. Account;
5. ensuring continuity of communication and enabling contact with the Controller regarding business activity;
6. placing Orders and concluding Sales Agreements;
7. analytical tools such as Google Analytics and Meta Pixel;
8. advertising tool Google Ads;
9. operation of a business Instagram account related to the Controller’s business activity;
10. fulfillment of legal obligations arising from applicable law, including accounting, tax regulations, and the General Product Safety Regulation (GPSR).
11. The Controller may also process Personal Data in the event of establishing, pursuing, or enforcing claims in court or before other authorities.
12. All Personal Data processed by the Controller via the Store is provided voluntarily by the User.
13. The User is not obliged to provide Personal Data to the Controller, either directly (e.g., via an order form) or indirectly (e.g., data collected through third-party cookies). However, failure to provide certain Personal Data may result in the inability to perform a service or achieve a given purpose.
14. If the User provides Personal Data, the Controller shall process it within the limits of applicable law, including in accordance with the GDPR principle of data minimization.
15. Detailed legal bases for the processing of Personal Data are specified further in this Privacy Policy.
V. Contact Form
1. Through the contact form available on the Store website, the Controller processes Personal Data provided by the User when completing the form, in particular data required to send a message, such as: name, e-mail address, phone number.
2. The legal basis for processing Personal Data via the contact form is Article 6(1)(f) GDPR, i.e., processing necessary for the purposes of the Controller’s legitimate interests, namely enabling communication between the User and the Controller regarding the Controller’s business activity.
3. Personal Data processed through the contact form shall be processed no longer than necessary to maintain communication with the User for the purpose for which the User contacted the Controller, i.e., until correspondence is clearly concluded or until the User objects to the processing.
VI. Newsletter
1. By subscribing to the newsletter, the Controller processes Personal Data provided by the User in the newsletter subscription form, namely e-mail address, first name, surname – if included in the e-mail address.
2. The legal basis for processing Personal Data is Article 6(1)(a) GDPR, i.e., the User’s consent to receive the newsletter.
3. Personal Data processed in connection with the newsletter shall be processed until consent is withdrawn.
4. The User may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
5. The User may unsubscribe from the newsletter by clicking the unsubscribe link included in every newsletter e-mail.
VII. Account
1. Through the Account registration form and operation of the Account on the Store website, the Controller processes Personal Data provided by the User when completing the form or updating Account data, including in particular: e-mail address, first name, surname, delivery address.
2. The legal basis for processing Personal Data in connection with Account registration is Article 6(1)(b) GDPR, i.e., processing necessary to take steps at the request of the User prior to entering into an agreement and processing necessary for the performance of an agreement.
3. Personal Data processed within the Account shall be processed until the expiry of limitation periods related to the performance of the agreement.
The provisions concerning the Account apply only if the Account functionality is made available by the Controller within the Store.
VIII. Ensuring Communication and Contact with the Controller
1. In connection with enabling contact with the Controller regarding business activity, the Controller processes Personal Data provided by the User or Customer, including: first name, surname, company name, e-mail address, phone number, and other data voluntarily provided in messages.
2. The legal basis for processing is Article 6(1)(f) GDPR, i.e., processing necessary for the purposes of the Controller’s legitimate interests consisting of maintaining communication and enabling contact regarding business activity.
3. Personal Data processed for communication purposes shall be stored for the period necessary to conduct correspondence and fulfill the purpose for which the data was provided, and afterward may be processed for the duration resulting from the Controller’s legitimate interests.
4. The User has the right to object at any time to the processing of Personal Data for this purpose, which may result in termination of correspondence and deletion of data unless another legal basis for further processing exists.
IX. Orders and Sales Agreements
1. In connection with concluding a distance Sales Agreement via the Store website, the Controller processes Personal Data necessary to place an Order and conclude an agreement, including: first name, surname, e-mail address, phone number, residential address, business address, delivery address, VAT number, company name.
2. The legal basis for processing Personal Data is Article 6(1)(b) GDPR.
3. Personal Data processed in connection with Orders and Agreements shall be processed until the expiry of limitation periods resulting from applicable law.
X. Analytical Tools
1. The Controller uses analytical tools such as Google Analytics and Meta Pixel on the Store website.
2. Within these tools, the Controller may process the following categories of Personal Data:
3. Google Analytics: IP address, approximate location limited to city level, gender, age;
4. Meta Pixel: IP address, device information, User activity on the website, location data, language settings.
5. The purposes of processing Personal Data include:
6. Google Analytics – statistical analysis of website traffic and User interaction with the Store website to optimize Store operations;
7. Meta Pixel – tracking advertising campaign effectiveness, personalization of advertisements within Meta platforms, retargeting Users, analysis of traffic and User behavior.
8. The legal basis for processing is Article 6(1)(a) GDPR, i.e., User consent.
9. Consent may be granted via the cookies banner displayed during the User’s first visit to the Store website.
10. The User may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
11. Consent may be withdrawn by disabling cookies in cookie settings.
12. Personal Data is processed for varying periods depending on the tool:
13. Google Analytics – up to 2 years or until consent withdrawal;
14. Meta Pixel – up to 90 days or until consent withdrawal.
XI. Google Ads
1. The Controller uses the Google Ads marketing tool on the Store website.
2. Within Google Ads, the Controller processes: IP address, approximate location limited to city level, gender.
3. The purpose of processing is conducting advertising campaigns promoting the Controller’s business activity online.
4. The legal basis is Article 6(1)(a) GDPR, i.e., User consent.
5. Consent may be granted via the cookies banner.
6. Consent may be withdrawn at any time.
7. Cookies may be disabled in browser or cookie settings.
8. Personal Data shall be processed for the duration defined in cookie settings or until consent withdrawal.
XII. Business Instagram Account
1. In connection with operating the Controller’s business Instagram account, the Controller processes Personal Data of Users interacting with the account, including by following the account, reacting to content, commenting, sharing, or sending private messages.
2. The legal basis for processing is:
a. Article 6(1)(f) GDPR – legitimate interest consisting of promoting Products and maintaining relations with Users;
b. Article 6(1)(b) GDPR – taking steps at the request of the User before entering into an agreement.
3. Personal Data is processed for the period necessary to fulfill the purposes for which it was collected.
4. Meta Platforms Ireland Limited (Instagram) is also an independent controller regarding operation of the Instagram platform itself.
XIII. Processing Personal Data to Fulfill Legal Obligations
1. The Controller processes Personal Data necessary to fulfill legal obligations such as issuing invoices, including structured invoices through the National e-Invoicing System (KSeF), tax settlements, and obligations arising from GPSR.
2. Processed Personal Data may include: first name, surname, correspondence address, e-mail address, phone number, bank account number, VAT number, REGON number, company name, and data required under applicable law.
3. The legal basis is Article 6(1)(c) GDPR.
4. Personal Data shall be processed for periods required by applicable law.
XIV. Processing Personal Data in Connection with Claims
1. In the event of establishing, pursuing, enforcing, or defending claims, the Controller may process Personal Data necessary for such purposes.
2. Processed data may include: first name, surname, address, e-mail address, phone number, bank account number, PESEL number, VAT number, REGON number, company name.
3. The legal basis is Article 6(1)(f) GDPR.
4. Personal Data shall be processed until the expiry of limitation periods.
XV. Processing by Other Entities
Personal Data may also be processed by:
1. website hosting providers;
2. IT and programming service providers;
3. e-commerce platform providers;
4. print-on-demand fulfillment and shipping providers;
5. accounting service providers;
6. invoicing software providers;
7. public authorities including tax authorities and KSeF-related authorities;
8. electronic payment service providers;
9. shipping and delivery providers;
10. newsletter service providers;
11. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;
12. Meta Platforms Inc.
XVI. Transfers of Personal Data to Third Countries
1. The Controller does not directly transfer Personal Data outside the EEA.
2. Personal Data may nevertheless be transferred outside the EEA by Google LLC, Meta Platforms Inc., and Shopify Inc.
3. Google LLC participates in the EU-US Data Privacy Framework.
4. Meta Platforms Inc. also participates in the EU-US Data Privacy Framework.
5. Shopify may transfer Personal Data outside the EEA, including to Canada and the United States.
6. Shopify applies safeguards ensuring compliance with GDPR. More information is available in Shopify’s Privacy Policy:
[Shopify Privacy Policy](https://www.shopify.com/legal/privacy?utm_source=chatgpt.com)
XVII. Automated Decision-Making and Profiling
The User’s Personal Data is not used by the Controller for automated decision-making, including profiling.
XVIII. User Rights
1. Pursuant to Articles 16–21 GDPR, the User has the right to:
2. access Personal Data;
3. rectify Personal Data;
4. erase Personal Data;
5. restrict processing;
6. data portability;
7. object to processing.
8. The User also has the right to withdraw consent at any time.
9. The User has the right to lodge a complaint with the competent supervisory authority.
10. In Poland, the competent authority is the President of the Personal Data Protection Office (UODO).
11. Before lodging a complaint, the Controller encourages Users to contact the Controller first to clarify concerns.
XIX. Cookies – General Information
1. The Store website uses cookies.
2. Cookies are small text files stored on the User’s device.
3. Cookies may be read by the Controller’s systems (first-party cookies) or third-party systems (third-party cookies).
XX. Cookies and Processing of Personal Data
1. By reading cookies, the Controller may gain access to information constituting Personal Data.
2. Some information stored in cookies may also be accessed by third parties.
3. Some cookies are necessary for proper functioning of electronic services.
4. Non-essential cookies are blocked until the User grants consent.
5. Consent may be granted through the cookies banner displayed during the first visit.
6. The legal basis is Article 6(1)(a) GDPR.
7. The User may manage cookie settings at any time via browser settings.
XXI. Cookies Used on the Store Website
1. The Store uses first-party and third-party cookies.
2. First-party cookies are used to ensure proper operation of the website.
3. Third-party cookies include:
4. Google Analytics and Google Ads – Google LLC;
5. Meta Pixel – Meta Platforms Inc.;
6. Shopify – Shopify International Ltd.
7. The Store also uses cookies and analytical functionalities provided by Shopify, necessary for proper Store operation, checkout functionality, remembering User preferences, and analyzing Store performance. Shopify may use its own tracking technologies in accordance with its privacy and cookies policies.
XXII. Final Provisions
1. Matters not regulated in this Privacy Policy shall be governed by Polish law and the GDPR. In the event of discrepancies between language versions of this Privacy Policy, the Polish version shall prevail.
2. The Controller reserves the right to amend this Privacy Policy, in particular where required due to changes in Personal Data processing, technological changes, or amendments to applicable law.