Privacy policy

Version of October 2026

This English translation is provided for information. In case of discrepancies, the Polish version prevails.

We explain how we process the data of people who visit the adoro-me.pl shop (in its Polish and English versions), create an account, contact us or buy our products. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council. Rules on storing information on, and accessing it from, your device also follow from the Polish Electronic Communications Law of 12 July 2024.

1. Who is responsible for your data?

The controller is HK Distribution Sp. z o.o., ul. Pory 78, 02-757 Warsaw, Poland, KRS 0001204576, NIP 5214140681, REGON 543227625. For privacy matters and to exercise your rights, write to contact@adorome.com or to the postal address above.

2. What data do we process and why?

Customer account: first name, surname, email address and the information you add to your profile. You sign in with a one-time code sent to your email address. We use the data to create and run your account – Art. 6(1)(b) GDPR. Address and phone number in the profile are optional unless the form says otherwise.

Orders, delivery and payments: contact details, delivery and billing address, order details, chosen delivery, payment method and status and, where needed, invoice details. We use them to conclude and perform the contract – Art. 6(1)(b) GDPR; we keep tax and accounting records under legal obligations – Art. 6(1)(c) GDPR.

Contact, complaints and returns: name, email address, the content of correspondence, order details and the information needed to handle the matter. The legal basis is performance of the contract or steps prior to it (Art. 6(1)(b)), a legal obligation (point c) or our legitimate interest in answering and handling enquiries (point f).

Newsletter: your email address and information about subscribing, confirming and unsubscribing. We send marketing messages only after a separate, voluntary sign-up – Art. 6(1)(a) GDPR and the relevant provisions of the Electronic Communications Law. Signing up is not a condition of creating an account or buying. You can unsubscribe via the link in any message or by contacting us.

Wishlist: products added to your wishlist are saved only in your browser's storage. They do not reach our servers, and you can delete them at any time by clearing your browser data.

Security and technical operation: IP address, date and time of the request, browser data, error information and necessary session identifiers. The legal basis is our legitimate interest in protecting the shop and data, preventing abuse and establishing, pursuing and defending claims – Art. 6(1)(f) GDPR.

Optional shop statistics: described in sections 6–7; we enable them on the basis of your consent – Art. 6(1)(a) GDPR and Art. 399 of the Electronic Communications Law.

Providing data is voluntary, but data marked as required is needed for the chosen service. Without delivery details we cannot ship, and without an email address we cannot create an account or reply by email. We do not ask for general consent to process data needed to fulfil an order. We do not take decisions with legal or similarly significant effects solely by automated means; the statistics described here are not used to personalise advertising.

3. Who do we share data with?

Access is given to authorised persons and to providers of services needed to run the shop. The shop platform, hosting, cart and checkout, customer accounts and email sending (including the newsletter) are provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, acting as a processor on our behalf. We also use email (Microsoft 365), accounting and legal services. Entities acting on our behalf receive data only to the extent needed for their tasks, under appropriate data-protection terms.

We pass delivery details to the carrier chosen in the order – in particular InPost sp. z o.o., Kraków (Paczkomat parcel lockers and InPost courier), and for shipments abroad, the courier company handling the parcel. Data may also be disclosed to authorities entitled to it by law.

Payments: BLIK, card, Apple Pay and Google Pay payments are handled by Shopify Payments – Shopify's payment service provided in cooperation with a licensed payment provider (Stripe). Payment providers receive the data needed to process the payment, in particular identification and contact details, the order ID and amount, and may act as independent controllers for handling and securing payments and for their own legal obligations. Details are in the privacy information shown during payment. The shop receives the payment confirmation and status; it does not store full card numbers or card security codes.

With your consent to statistics, data about how the shop is used is processed by Shopify as part of the statistics service described in section 7. Accepting the terms of sale alone does not switch this service on.

4. Transfers outside the European Economic Area

Shopify stores and processes data in, among other places, Canada and the United States. Using global providers – in particular Shopify, Stripe and Microsoft – may involve access to or processing of data outside the EEA. This means not all data remains only in Poland or the EEA.

Any transfer must rely on an appropriate GDPR mechanism: a European Commission adequacy decision (one has been issued for Canada, among others), including the EU–US Data Privacy Framework to the extent of the recipient's valid certification, or standard contractual clauses with the required safeguards. Information about the safeguards used for a specific transfer, and how to obtain a copy, is available from contact@adorome.com.

5. How long do we keep data?

Account: for as long as the account exists. After it is closed we keep only data needed for legal obligations or claims.

Orders, complaints and returns: for as long as the matter is being handled, then for the limitation period applicable to it. The period depends on the type of claim and may be extended, e.g. by proceedings.

Tax and accounting records: for the period required by law; tax records as a rule for 5 years from the end of the year in which the tax payment deadline passed, subject to statutory extensions.

Enquiries unrelated to a contract: until the correspondence ends, then for up to 12 months, unless the matter requires longer retention for a specific claim.

Newsletter: until you unsubscribe or the service ends. Limited proof of subscription and unsubscription may be kept for as long as needed to demonstrate compliance and defend claims.

Technical logs: for the period Shopify applies to keep its platform secure; data extracted about an incident may be kept until it is resolved and for as long as needed to pursue or defend a specific claim.

Cookies: for the periods described in section 6.

6. Cookies and your choices

Cookies are small pieces of information stored in your browser. Browser storage (localStorage) can serve similar functions. Essential mechanisms make the cart, checkout, sign-in, security, chosen language and currency work, and remember your consent choices. They do not require consent to the extent necessary to provide the service you request.

Optional statistics are off by default. The privacy banner lets you accept them, decline them or choose settings. Doing nothing, scrolling or closing the banner does not mean consent. Declining does not block purchases or the shop's basic functions.

Cookie settings let you change or withdraw your choice at any time – the link is in the shop footer. We remember your choice for up to 1 year; after that, or after a significant change, we will ask again. Withdrawing consent does not affect the lawfulness of earlier processing.

Essential cookies are kept from the length of the session up to 1 year, and statistics cookies – only with consent – from 30 minutes up to 1 year. The wishlist is stored only in your browser. Your browser may shorten these periods or block storage. Deleting essential cookies may sign you out or empty your cart. Cookie names and durations are set by Shopify and may change; Shopify publishes the current list in its cookie policy.

7. Shop statistics

With your consent we use the statistics built into the Shopify platform to understand how visitors use the shop and to improve it. Statistics may include a browser identifier, pages visited, the time and course of the visit, device data and approximate location. We do not treat this data as fully anonymous. We do not use it to personalise advertising. Without consent, no statistics are collected.

8. Your rights

Under the GDPR you have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interest on grounds relating to your particular situation; objection to direct marketing is unconditional. You may withdraw consent at any time. Deleting your account or withdrawing consent does not delete documents we must keep by law.

Contact us at contact@adorome.com. We may ask for information needed to confirm your identity; we never ask for a password. As a rule we reply within one month and will inform you of any justified extension in line with the GDPR. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO): uodo.gov.pl.

9. Security and changes to this policy

We use HTTPS, access control and the account security provided by the Shopify platform. We do not store passwords – you sign in with a one-time code sent to your email address. We update this policy when our services or processing change. We inform you of significant changes in a manner appropriate to their scope; a new purpose requiring consent will not be started on the basis of an earlier choice.