Privacy policy

§1. Data controller

  1. The controller of personal data collected in the Bulvonia Shop (bulvonia.com) is DTC Factory spółka z ograniczoną odpowiedzialnością, with its registered office in Tajęcina, Tajęcina 51E, 36-002 Jasionka, Poland, KRS 0001256088, NIP 5170473800, REGON 545311784 (hereinafter: the "Controller").
  2. For any matters concerning personal data, you can write to halo@bulvonia.com.

§2. What data we process

Identification and contact data (first name, last name, delivery address, e-mail, telephone number), order and payment data (card data is processed by payment operators, not by the Controller), the content of correspondence, and technical data collected automatically: IP address, information about your device and browser, the source of your visit (e.g. an advertisement you clicked) and cookies.

§3. Purposes and legal bases of processing

  • concluding and performing the contract (in Model A, the sales contract; in Model B, the intermediation contract), including processing the order, payment, delivery, returns and complaints — Article 6(1)(b) GDPR;
  • legal obligations, in particular tax and accounting obligations — Article 6(1)(c) GDPR;
  • establishing, pursuing and defending claims, preventing abuse, handling enquiries, statistics and development of the Shop — the Controller's legitimate interest, Article 6(1)(f) GDPR;
  • reminders about an unfinished order by e-mail or SMS — the Controller's legitimate interest (Article 6(1)(f) GDPR); you may object at any time;
  • newsletter and commercial information — consent, Article 6(1)(a) GDPR, which you may withdraw at any time;
  • marketing and measuring the effectiveness of advertising using cookies and pixels — consent given in the cookie settings.

§4. Recipients of data

Your data may be disclosed to entities that help us run the Shop: the Shop platform provider (Shopify), payment operators, carriers and couriers, providers of hosting, e-mail and SMS services, our accounting firm, providers of analytics and advertising tools (e.g. Meta, Google) and, in Model B, the Foreign Seller (§5).

§5. Transfer of data outside the European Economic Area

  1. In Model B, we transfer the data necessary for delivery (first name, last name, delivery address, telephone number, e-mail, order number) to the Foreign Seller, which has its registered office outside the EEA, usually in China or Hong Kong. The European Commission has not issued an adequacy decision for these countries, which means your data may be less well protected there than in the EU.
  2. The legal basis for the transfer is that it is necessary to perform the intermediation contract concluded at your request (Article 49(1)(b) GDPR). We transfer only the data needed to process and deliver the order.
  3. Some service providers (e.g. Shopify, Meta, Google) may process data outside the EEA on the basis of a European Commission decision (EU-US Data Privacy Framework) or standard contractual clauses.

§6. Retention period

We keep order data for the limitation period for claims and for the period required by tax law (usually 6 years). We keep data processed on the basis of consent until you withdraw that consent. We keep data processed on the basis of legitimate interest until you successfully object or the interest ceases to exist.

§7. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability. You also have the right to object to processing based on legitimate interest (including marketing) and the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You may also lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, or with the supervisory authority in your country of residence.

§8. Cookies

The Shop uses cookies that are necessary for it to function (shopping cart, checkout, security) and, with your consent, analytics and marketing cookies. You can manage your consent in the cookie banner and in your browser settings.

§9. Voluntary provision of data

Providing your data is voluntary, but it is necessary to place and process an order. Without it, we cannot conclude or perform the contract.

§10. Changes to the policy

We may update this Policy, e.g. when laws or our services change. The current version is always available in the Shop.

This Privacy Policy is effective as of 22 October 2026.