Privacy policy
Last updated: 14 October 2026
This policy explains what personal data we collect when you visit polskiekoszulki.co.uk, buy from us or contact us, why we collect it, who we share it with and what rights you have. We follow UK data protection law (UK GDPR and the Data Protection Act 2018) and, for customers in the European Union, the EU GDPR.
1. Who is responsible for your data
The data controller is GitGraf Limited, a company registered in England and Wales under number 13186047, registered office: 5 Delapre Court, London Road, Northampton NN4 8AT, United Kingdom. The shop trades as Polskie Koszulki.
Contact for data protection matters: kontakt@polskiekoszulki.co.uk, tel. +44 1604 760456. We are a small family business and deal with every request personally.
2. What data we collect
- Order details: name, delivery and billing address, email address, phone number, products ordered, amounts and order history.
- Personalisation text: the name, age, year or other text you give us to print.
- Design materials: photos, files and descriptions you send for our "Design your T-shirt" and "Have you got this one?" services.
- Payment data: payments are handled by payment providers (see section 5). We never see or store full card numbers.
- Customer account: if you create one, your email address and the details saved in it.
- Messages: messages you send us by email, contact form, Messenger, Instagram or WhatsApp.
- Newsletter: your email address and whether you subscribed or unsubscribed.
- Technical data: IP address, device and browser type, approximate location, pages visited and how you use the shop. We collect this through cookies and similar technologies (section 8).
3. Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Taking and fulfilling your order, printing and shipping, contacting you about it, returns and complaints | Performance of our contract with you |
| Preparing a design in our "Design your T-shirt" and "Have you got this one?" services | Performance of a contract, or steps taken at your request before entering into one |
| Keeping accounts and sales records | Legal obligation |
| Answering your messages and questions | Our legitimate interests (customer service) |
| Preventing fraud and protecting the shop | Our legitimate interests |
| Newsletter and the subscriber discount | Your consent (you can withdraw it at any time) |
| An occasional email to existing customers about similar products | Our legitimate interests; you can opt out in every email |
| Visitor statistics and advertising (e.g. Facebook, Instagram) | Your consent given in the cookie banner |
We do not make decisions about you based solely on automated processing that have legal effects. Shopify may automatically assess the risk of fraud at checkout; where in doubt, we check the order personally.
4. How long we keep data
- Order data and sales records: 6 years from the end of the financial year in which the order was placed, as required by UK company record-keeping rules.
- Customer account: until you delete it or ask us to (order data is kept for the period above).
- Newsletter: until you unsubscribe.
- Messages and design materials: for as long as needed to handle your order and any complaint. We will delete them earlier on request, unless the law requires us to keep them.
- Cookies: according to your banner and browser settings.
5. Who we share data with
We do not sell your data. We only share it with companies that help us run the shop, and only as far as needed for each purpose:
- Shopify - shop platform, checkout, customer accounts, sending emails and the newsletter.
- Payment providers - Shopify Payments, PayPal, Apple Pay and Google Pay (they process payment data under their own terms).
- Gelato - our print partner. It receives the details needed to make and ship your T-shirt (name, address, delivery contact, personalisation text). Your T-shirt is printed at the print shop closest to the recipient, which may be outside the UK.
- Courier and postal companies - to deliver your parcel.
- Meta Platforms (Facebook, Instagram, Messenger, WhatsApp) - if you contact us through these channels and, with your consent, to measure and show adverts.
- Our accountants - to keep the company's accounts.
- Public authorities - where the law requires it.
6. Transfers outside the UK
Some of our providers operate outside the UK, for example Shopify in Canada and the USA, Meta in the USA, and Gelato's print shops in the delivery country. In these cases your data is protected by adequacy regulations or by contracts with the safeguards required by law (such as the UK International Data Transfer Agreement or standard contractual clauses with the UK addendum).
7. Your rights
You have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- have your data erased,
- restrict processing,
- object to processing based on our legitimate interests, including marketing,
- data portability,
- withdraw your consent at any time (this does not affect processing carried out before you withdrew it).
To use your rights, email kontakt@polskiekoszulki.co.uk. We will reply within one month. We may ask you to confirm your identity.
8. Cookies
The shop uses cookies that are necessary for it to work (e.g. basket, checkout, security) and, only with your consent, statistics and advertising cookies, including the Meta pixel. You accept or reject them in the cookie banner and can change your choice at any time on the "Your privacy choices" page (link in the shop footer). More about Shopify cookies: shopify.com/legal/cookies.
9. Security
The shop runs over an encrypted connection, and only the people and companies who need your data can access it. No security measure is completely reliable, so please do not send us sensitive data over unsecured channels.
10. Children
The shop is not aimed at people under 16 and we do not knowingly collect their data. If you believe a child has given us their data, contact us and we will delete it.
11. Complaints
If you have a concern, please contact us first and we will be happy to help. You also have the right to complain to the UK data protection regulator: Information Commissioner's Office (ICO), ico.org.uk, tel. 0303 123 1113. Customers in the European Union may also complain to the data protection authority in their country.
12. Changes to this policy
We may update this policy, for example when the law or our providers change. The current version is always available in the shop, with the date of the last update at the top.