Data controller

The controller of your personal data is Tomasz Stenka (Colayla), ul. Skarpowa 55, unit 6, 80-145 Gdańsk, Poland, NIP 5833574727. For any privacy matter write to [email protected] or to the business address. We have not appointed a data protection officer, as we are not required to.

What data we process

Contact and order data — name or company name, email, phone number, delivery address, order specification and correspondence with us.
Billing data — details for the bill or invoice (e.g. company tax ID), amount, currency and date of payment.
Online payment data — if you pay via Stripe: name, email, amount, card brand and last 4 digits, payment status. The full card number and CVC are processed only by Stripe — we never receive them.
Technical data — IP address and browser information, processed by the server and the Cloudflare network to deliver and protect the website.

Data in print files

Newspaper files often contain data about other people — names, photos, stories. We process it only to prepare the proof and print your order, on your instructions. You are responsible for being entitled to use it (e.g. having consent from people in photos). We delete files 90 days after shipping unless you ask us to keep them for reprints.

Purposes and legal bases

Preparing a quote and proof — steps prior to a contract at your request (Art. 6(1)(b) GDPR) and your consent given in the form (Art. 6(1)(a) GDPR).
Performing the contract: printing, shipping, taking payment and making refunds (Art. 6(1)(b) GDPR).
Issuing bills and keeping tax records (Art. 6(1)(c) GDPR).
Handling complaints and payment disputes, and establishing, pursuing or defending claims (Art. 6(1)(b), (c) and (f) GDPR).
Website security and preventing abuse (Art. 6(1)(f) GDPR).

Providing data is voluntary, but without it we cannot quote or fulfil your order. We do not make automated decisions or profile you. The website uses no analytics or marketing tools.

Recipients

Stripe — Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: online payment processor. Stripe processes payment data to carry out payments and refunds and, as a separate controller, to prevent fraud and meet legal obligations (stripe.com/privacy).
Delivery companies — InPost or the courier chosen for shipping: the recipient's name, address, phone and email, as needed for delivery.
Partner printing house — for offset printing (from 500 copies) we pass on the print files under a data processing agreement; we do not share your contact details with it.
Hosting and email provider — OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France — website and email server.
Cloudflare — Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — domain name service (DNS), content delivery and website protection.
Our accounting office — for data on bills and invoices, under a data processing agreement.
Our bank — for bank-transfer payments and refunds.
Public authorities — only where required by law.

We do not sell data or share it for marketing.

Transfers outside the EEA

Stripe and Cloudflare may transfer data to the United States. The basis is their participation in the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and standard contractual clauses. We will provide a copy of the safeguards on request.

Retention

Print files — 90 days after shipping (longer only at your request).
Enquiries that did not lead to an order — up to 12 months from the last contact.
Order, billing and payment data — 5 years from the end of the calendar year in which the tax payment deadline passed.
Data needed for complaints and claims — until the claims become time-barred.

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on our legitimate interests. You can withdraw consent at any time without affecting earlier processing. Write to [email protected]; we reply within one month.

Right to complain

You may lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in your country of residence. Cookies are described in the Cookie policy.

Privacy policy