What I know and what I do with it

The controller of personal data is Aleksander, running an unregistered business activity (działalność nierejestrowana) under Polish law, correspondence address: contact@hrutrforge.com.

Contact on personal data matters: contact@hrutrforge.com.

The controller has not appointed a data protection officer — there is no such obligation at this scale of activity. All matters are handled at the address above.

Only from you: from the order form, the account registration form or a message you send me.

I do not buy databases, do not collect data from other services and do not combine it with any external profiles.

Fulfilling the order — name, delivery address, e-mail, phone, order content. Basis: Art. 6(1)(b) GDPR, i.e. performance of a contract. I keep the data:

• a)for the time it takes to fulfil the order and handle any complaints;
• b)then until the limitation periods for claims under the contract expire.

Accounting and sales records — data needed to document revenue. Basis: Art. 6(1)(c) GDPR, i.e. a legal obligation. Retention: 5 years from the end of the year in which the tax obligation arose.

Shop account — e-mail address, first name, hashed password, order history. Basis: Art. 6(1)(b) GDPR. I keep the data until the account is deleted; orders remain in the records because of tax obligations.

Account created with Google — the same as above, except that instead of a password I keep the account identifier at Google. Such an account has no password and can only be accessed through Google.

Details for future orders — name, phone and delivery address saved with the account so that checkout fills them in next time. I save them only when you ask me to: by ticking the box when ordering or filling them in in the account settings. There you can also change or clear them with one click. Basis: Art. 6(1)(b) GDPR. Retention: until cleared or until the account is deleted.

Correspondence — the content of the message and the sender's address. Basis: Art. 6(1)(f) GDPR, i.e. the legitimate interest of replying. Retention: up to a year after the matter is closed.

New-piece notifications — e-mail address and sign-up date. Basis: Art. 6(1)(a) GDPR, i.e. your consent, and Art. 398 of the Polish Electronic Communications Law, which requires consent for commercial information sent by e-mail. You confirm the sign-up by clicking the link in the e-mail; without that click I send nothing. You can withdraw consent with one click in any message, and afterwards I keep the address only so that it does not accidentally end up back on the list.

Visit statistics — country, the address of the page opened, the time and whether the visit looks automated. Basis: Art. 6(1)(f) GDPR, i.e. the legitimate interest of knowing what is viewed in the shop. I do not store the IP address at all:

• a)from the IP address, browser, date and a secret string I compute an irreversible hash and store only its first twelve characters;
• b)the hash changes at midnight, so the same person cannot be recognised the next day or linked to an order or account;
• c)the cart, the order page and the account are not counted at all;
• d)entries older than a year are deleted.

Defending against claims and pursuing my own — within the data already collected. Basis: Art. 6(1)(f) GDPR.

Providing data is voluntary, but without it a sales contract cannot be concluded or performed.

Only those without whom the shop would not work:

• a)Cloudflare, Inc. — shop hosting, database and photo storage;
• b)Google Ireland Ltd. — only when you log in with a Google account. Google verifies who you are and passes me three things: a permanent account identifier, your e-mail address and your first name. I never see your Google password. If you log in with a password, Google receives nothing about you;
• c)Stripe Payments Europe, Ltd. — card payments; payment data goes directly to the operator, the Seller never sees the card number;
• d)Resend (transactional e-mail provider) — sending confirmations and order status notifications;
• e)the carrier chosen at checkout — name, address and phone needed to deliver the parcel;
• f)the bank holding the account — within the data visible on a bank transfer.

I have data processing agreements with the technical service providers. I do not sell data or share it for marketing purposes — with anyone.

Cloudflare and Resend are based in the United States, so data may be processed outside the European Economic Area. This takes place on the basis of standard contractual clauses approved by the European Commission and the adequacy decision for entities certified under the Data Privacy Framework.

At any time you can:

• a)access your data and obtain a copy of it;
• b)rectify inaccurate data or complete incomplete data;
• c)request erasure of data, unless a legal obligation, for example a tax obligation, prevents it;
• d)request restriction of processing;
• e)transfer data to another controller — for data processed on the basis of a contract;
• f)object to processing based on legitimate interest.

A message to contact@hrutrforge.com is enough. I reply within one month.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, or with the data protection authority in your own EU country.

There is no Google Analytics, no advertising pixels and no tool that tracks you across websites. My own visit statistics are counted by the server, which stores nothing in your browser (described above). Exactly four things live in your browser, all essential for the shop to work:

• a)the “sesja” cookie — set only after logging in, keeps the session; not accessible to scripts, valid for 30 days, removed on logout;
• b)browser local storage (localStorage) under the key “hrutr-forge:cart:v1” — holds the contents of the cart so it does not disappear when the page is refreshed; the data is not sent to the server or shared with anyone;
• c)local storage under the key “hrutr-forge:ciasteczka:v1” — a single value, saved after you close the cookie notice so it does not pop up on every visit;
• d)local storage under the key “hrutr-forge:waluta:v1” — the code of the currency in which you want to see prices, saved only when you click the currency switcher yourself. Without it, the currency is chosen by the language version. This is not sent to the server either.

Because each of these is strictly necessary to provide the service, none requires consent. This exemption follows from Art. 399(3) of the Polish Electronic Communications Law of 12 July 2024 (Journal of Laws item 1221), in force since 10 November 2024, which implements Art. 5(3) of Directive 2002/58/EC (ePrivacy). I still inform you about them — that is what the notice on your first visit is for. It has no “Reject” button because there is nothing to reject: without the cart and the session the shop stops working. If analytics or advertising is ever added, it will come with a request for consent — which you will then be able to withdraw.

The language is carried by the address itself: the Polish version has no prefix, the others have their own (“/en”, “/de”, “/cs”, “/fr”, “/nl”). You change the version with the switcher in the header. Only the home page, opened by typing the bare shop address, sends you to the version in the language set in your browser — based on a header your browser sends by itself. Nothing about this choice is stored in your browser.

The visit statistics described above do not use any cookie or identifier stored in your browser. They are counted by the server and leave nothing on your device.

Fonts are served from my own server, so opening the page does not connect you to Google's servers or any other third party.

The connection to the shop is encrypted (HTTPS). I store passwords only as cryptographic hashes — I do not know them and they cannot be recovered from the database.

Only the shop administrator has access to the admin panel and order data.

I do not profile you or make automated decisions about you. You do not get different prices or different content from anyone else.

I may change this policy when the way the shop works or the law changes. The new version applies from the day it is published on this page.

The policy is published in Polish and in translations into other languages. In the event of discrepancies between versions, the Polish version prevails.

This policy applies from 27 September 2026.