Datenschutzerklärung

Last updated: 31 October 2026

Resoraki operates this shop and website, including all related information, content, features, tools, products and services, in order to provide you with a curated shopping experience (the “Services”). The Resoraki shop is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use and disclose your personal information when you visit and use the Services, make a purchase through them or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy will govern the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described in this Privacy Policy.

Personal information we collect and process

When we use the term “personal information”, we are referring to information that identifies you or can reasonably be linked to you. Personal information does not include information that is collected anonymously or that has been de-identified so that it cannot identify you or be linked to you. We may collect or process the following categories of personal information, including inferences drawn from it, depending on how you use the Services and where you live, and as permitted or required by applicable law:

• Contact details including your name, address, billing address, shipping address, phone number and email address.
• Financial information including credit card, debit card and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details.
• Account information including your username, password, security questions, preferences and settings.
• Transaction information including the items you view, put in your cart, add to your wishlist, purchase, return, exchange or cancel, as well as your past transactions.
• Communications with us including the information you include in your communications with us, for example when sending a customer support inquiry.
• Device information including information about your device, browser or network connection, your IP address and other unique identifiers.
• Usage information including information about your interaction with the Services, including how and when you use or navigate the Services.

Sources of personal information

We may collect personal information from the following sources:

• Directly from you including when you create an account, visit or use our Services, communicate with us or otherwise provide us with your personal information.
• Automatically through the Services including from your device when you use our products or services or visit our websites, and through the use of cookies and similar technologies.
• From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf.
• From our partners or other third parties

How we use your personal information

Depending on how you interact with us and which Services you use, we may use your personal information for the following purposes:

• Providing, tailoring and improving the Services. We use your personal information to provide the Services, including to perform our contract with you, process your payments, fulfil your orders, remember your preferences and the items you are interested in, send you notifications related to your account, process purchases, returns, exchanges or other transactions, create, maintain and otherwise manage your account, arrange shipping, facilitate returns and exchanges, enable you to post reviews and create a personalised shopping experience for you, for example by recommending products related to your previous purchases. This may include using your personal information to personalise and improve the Services.
• Marketing and advertising. We may use your personal information for marketing and promotional purposes, such as sending marketing, advertising and promotional communications by email, text message or postal mail, and showing you online advertisements for products or services on our Services or other websites, including based on items you have purchased or added to your cart or other activity on the Services.
• Security and fraud prevention. We use your personal information to authenticate your account, provide secure payments and shopping, detect and investigate potentially fraudulent, illegal, unsafe or malicious activity and take appropriate steps to address it, protect public safety and secure our services. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We strongly advise you not to share your username, password or other access details with anyone.
• Communicating with you. We use your personal information to provide you with customer support, respond to your questions, provide effective services to you and maintain our business relationship with you.
• Legal reasons. We use your personal information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, potential or actual litigation or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.
• Back-in-stock notifications. If you enter your email address in the “Notify me when available” form for a sold-out item, we will use it only to let you know that this item is available again (Article 6(1)(b) of the GDPR (RODO): steps taken at your request). We keep the address until the notification is sent or until you unsubscribe, which you can do using the link in the message or by writing to sklep@resoraki.com. The form and the emails are handled by the Stok: Back In Stock Alert app; details are in the section “Third-party tools we use”.
• Collection buy-back. If you submit a collection for valuation using the “Collection buy-back” form, we process the name, email address, phone number (if provided), collection description and uploaded photos in order to prepare a valuation and reply to your submission (Article 6(1)(b) GDPR – steps taken at your request prior to entering into a contract). We automatically remove metadata from the photos, including location and device data, and the photos themselves are deleted automatically after 90 days. The content of the submission goes to our email inbox and we keep it for as long as needed to value and possibly buy the collection. The form is protected by an anti-spam check that assesses whether the sender is a human on the basis of technical browser data and the IP address (Article 6(1)(f) GDPR – protection against spam and abuse). The tools that operate the form are described in the section “Third-party tools we use”.

How we disclose personal information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes in accordance with this Privacy Policy. Such circumstances may include:

• With Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping).
• With business and marketing partners, to provide marketing services and show you advertisements. For example, we use Shopify to support personalised advertising with third-party services based on your online activity with different merchants and on different websites. Our business and marketing partners will use your information in accordance with their own privacy notices. Depending on where you live, you may have a right to direct us not to share your information to show you personalised advertising and marketing based on your online activity with different merchants and on different websites.
• When you direct, request or otherwise consent to our disclosure of certain information to third parties, for example to ship you products or through your use of social media widgets or login integrations.
• With our affiliates or otherwise within our corporate group.
• In connection with a business transaction such as a merger or bankruptcy, to comply with applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce applicable terms of service or policies, and to protect or defend the Services, our rights, your rights or the rights of others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit through the Services will be transmitted to and shared with Shopify, as well as with third parties that may be located in countries other than where you live, in order to provide services to you. In addition, to help protect, grow and improve our business, we use certain advanced Shopify features that incorporate data and information obtained from your interactions with our Store, with other merchants and with the Shopify platform. To provide you with these advanced features, Shopify may use personal information collected during your interactions with our Store, with other merchants and with the Shopify platform. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights regarding the use of your personal information for these purposes. To learn more about how Shopify uses personal information and any rights you may have, visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise applicable rights regarding your personal data here: Shopify Privacy Portal link.

Third-party tools we use

Apart from Shopify, we use the tools listed below. Each of them receives only the data it needs for its function and also processes it under the terms described in the provider's own privacy policy.

• Stok: Back In Stock Alert (PantherCodX LLP, India): the form and the emails about an item being available again; it receives your email address and information about which item it concerns. Data may be processed outside the European Economic Area, including in a country for which the European Commission has not found an adequate level of data protection. Provider's privacy policy: https://docs.google.com/document/d/1kH9fAAKiSfXGWoxvAJN94Zcb9nFRq7pcOLPI4-s-Yj8/edit?usp=sharing
• Judge.me Reviews (Judge.me Ltd, United Kingdom): showing selected reviews from the Google Business Profile of our bricks-and-mortar shop on the home page. The app has access to order data (first and last name, email address), but it does not send review requests or collect reviews of Goods; edrone does that. Data may be stored on servers in the United States; when transferring data, the provider declares the use of standard contractual clauses or transfers to countries with an adequate level of data protection. Provider's privacy policy: https://judge.me/privacy
• edrone (edrone sp. z o.o., Kraków, Poland): the newsletter and automated emails to newsletter subscribers (e.g. abandoned-cart reminders, new arrivals, similar models), review requests after a purchase and publishing reviews of Goods, newsletter sign-up windows and the shop's AI assistant chat. It runs on the website only after you consent to marketing cookies. It receives your email address, first name, information about orders and about Goods you viewed or added to the cart, the content of your review if you leave one, and in the chat the content of the conversation. Acts as a processor on our behalf. Some of the provider's subcontractors are based in the United States (including Amazon Web Services), so data may be processed there under the mechanisms provided for in the GDPR (the EU-US Data Privacy Framework or standard contractual clauses). Provider's privacy policy: https://edrone.me/pl/polityka-prywatnosci
• Boost AI Search & Filter (Boost Commerce, USA): product search and filters in the shop; it stores an anonymous identifier on your device that is used to analyse how the search works, and it has access to order data (the provider states that it does not store customers' personal data from orders). Data is transferred outside the European Economic Area, including to Canada and the United States; the provider states that it uses standard contractual clauses. Provider's privacy policy: https://boostcommerce.net/company/privacy-policy
• Base (BaseLinker sp. z o.o., Poland): software for handling sales and order fulfilment; it has access to order data, including name, email address, phone number and address. As a rule, data is not transferred outside the European Economic Area; where it is, the provider states that it uses standard contractual clauses. Provider's privacy policy: https://base.com/en-US/policy/
• InPost Paczkomaty Orlen Paczka (Codie, Kraków, Poland): displays at checkout a list of the InPost pickup points nearest to the delivery address and saves the selected point in the order; it receives the delivery address, email address and order number. It acts as a processor on our behalf. The Paczkomat map uses Google Maps (Google LLC, USA), so the delivery address may be processed in the United States on the basis of standard contractual clauses; the provider processes the remaining data in the European Economic Area. Provider's privacy policy: https://inpostpaczkomatyorlenpaczka.pl/polityka-prywatnosci
• Carriers: InPost sp. z o.o. (Poland) and DHL Parcel Polska sp. z o.o. (Poland): delivery of the parcel; they receive your name, delivery address or chosen Paczkomat, phone number and email address (for shipment notifications).
• Cloudflare (Cloudflare, Inc., USA) – operation of the “Collection buy-back” form: storage of uploaded photos (Cloudflare R2, servers in the European Union, automatic deletion after 90 days) and the Cloudflare Turnstile anti-spam check, which assesses whether the sender is a human on the basis of technical browser data and the IP address. Acts as a processor on our behalf. Technical data from the check may be processed outside the European Economic Area; the provider declares participation in the EU-US Data Privacy Framework and the use of standard contractual clauses. Provider's privacy policy: https://www.cloudflare.com/privacypolicy/
• Lumato sp. z o.o. (Poland) and Resend (Resend, Inc., USA) – technical operation of the “Collection buy-back” form and sending email notifications about submissions to our inbox; they receive the submission data: name, email address, phone number, collection description and links to the photos. Lumato acts as a processor on our behalf and Resend as a sub-processor. Data may be processed in the United States; Resend declares the use of standard contractual clauses. Resend privacy policy: https://resend.com/legal/privacy-policy

Third-party websites and links

The Services may contain links to websites and other online platforms operated by third parties. If you follow links to websites not affiliated with or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such websites, including the accuracy, completeness and reliability of the information found on them. Information you provide in public or semi-public places, including information you share on third-party social networking platforms, may also be visible to other users of the Services and/or users of those third-party platforms, without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as explained in the Services.

Children's data

The Services are not intended to be used by children. We do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details below to request that it be deleted. As of the effective date of this Privacy Policy, we have no actual knowledge of “sharing” or “selling” (as those terms are defined in applicable law) the personal information of individuals under 16 years of age.

Security and retention of your information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee “perfect security”. In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

How long we retain your personal information depends on various factors, such as whether we need the information to maintain your account, provide the Services to you, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

Your rights and choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

• Right to access / know. You may have the right to access the personal information we hold about you.
• Right to delete. You may have the right to request that we delete the personal information we hold about you.
• Right to correct. You may have the right to request that we correct inaccurate personal information we hold about you.
• Right of portability. You may have the right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
• Managing communication preferences. We may send you promotional emails, and you may opt out of receiving them at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or the orders you have placed.

You may exercise any of these rights where indicated in the Services or by using the contact details below. To learn more about how Shopify uses your personal information and the rights you may have, including rights related to data processed by Shopify, visit https://privacy.shopify.com/pl.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your request, in accordance with applicable law. In accordance with applicable laws, you may authorise an agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require proof that you have authorised them to act on your behalf, and we may ask you to confirm your identity directly with us. We will respond to your request within the time limit required by applicable law.

Complaints

If you have complaints about how we process your personal data, please contact us using the contact details below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details below, or to lodge a complaint with your local data protection authority. You can find a list of the competent data protection supervisory authorities in the EEA here.

International data transfers

We may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information outside the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms, such as the European Commission's standard contractual clauses or equivalent contracts issued by the relevant supervisory authority in the United Kingdom, unless the data is transferred to a country that has been deemed to provide an adequate level of protection. We indicate exceptions to this rule for individual tools in the section “Third-party tools we use”.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal or regulatory reasons. We will post the revised Privacy Policy on this website, update the “Last updated” date and notify you of the changes as required by applicable law.

Contact

If you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us by phone at +48 604 848 639, by email at sklep@resoraki.com or by post at Resoraki sp. z o.o. (limited liability company under Polish law), ul. Bartosza Głowackiego 4/14, 30-085 Kraków, Poland. The controller of your personal data is Resoraki sp. z o.o. (KRS 0001016914, VAT EU: PL9452268059).