PRIVACY POLICY
Online shop LIGHTBAY.SHOP • version of 17 July 2026
| Controller | LIGHTBAY Artur Marek |
| Address | ul. Nad Źródłem 6, 30-298 Kraków |
| NIP | 6792502854 |
| GDPR contact | email address for personal data matters: kontakt_rodo@lightbay.shop |
This policy explains how we process the data of persons using the lightbay.shop shop, placing orders, contacting us or using other functions of the Shop. The document takes into account sales in the dropshipping model, in which the goods may be dispatched to the Customer directly by the supplier, manufacturer or logistics operator.
1. Controller of personal data
The controller of personal data is LIGHTBAY Artur Marek, ul. Nad Źródłem 6, 30-298 Kraków, NIP 6792502854 (hereinafter: “Controller”, “LIGHTBAY” or “we”).
In matters concerning personal data, you may contact us by post at the above address or electronically: [TO BE COMPLETED: email address].
The Controller has not appointed a data protection officer, unless such an obligation arises in the future from the provisions of law. All privacy-related matters are handled directly by the Controller.
2. Scope of data collected
Depending on the manner of using the Shop, we may process:
- identification and contact data: first name, surname, company name, NIP, email address, telephone number;
- address data: billing address, delivery address and data of the recipient of the shipment;
- order data: selected products, quantity, price, method of delivery, order status, content of remarks and correspondence;
- payment and settlement data: selected payment method, transaction identifier and status, data necessary for issuing a sales document; we do not store full payment card data;
- complaint and withdrawal data, including description of the problem, photographs, account number for refund and history of handling the matter;
- technical and operational data: IP address, cookie identifiers, device and browser type, operating system, addresses of visited subpages, source of entry and information on activity in the Shop;
- Customer account data, if an account is created: login, order history and account settings;
- marketing data, including information on consents granted and withdrawal of consent.
As a rule, we obtain data directly from the person to whom it relates. If the ordering party indicates another person as the recipient of the shipment, they should inform that person of the transfer of their data to us and make this policy available to them.
3. Purposes, legal bases and processing periods
| Purpose | Legal basis | Scope | Period |
| Account and order handling, payment, delivery, contact | Art. 6(1)(b) GDPR | identification, contact, address, order and payment data | until performance of the contract, and thereafter until the expiry of the limitation periods for claims |
| Invoices, accounting and tax obligations | Art. 6(1)(c) GDPR | settlement and transactional data | for the period required by tax and accounting provisions |
| Complaints, returns, pursuit and defence of claims | Art. 6(1)(b), (c) and (f) GDPR | order, contact, complaint data, correspondence | until conclusion of the matter and expiry of the relevant limitation periods |
| Ensuring the operation and security of the Shop, prevention of abuse | Art. 6(1)(f) GDPR | logs, IP, technical data, information on events | for the period necessary for security and clarification of an incident |
| Response to enquiries not yet related to a contract | Art. 6(1)(f) GDPR or (b) – steps taken at the request of the data subject prior to entering into a contract | contact data and content of correspondence | until conclusion of the contact, and thereafter until the time of defence against claims |
| Newsletter and commercial information | Art. 6(1)(a) GDPR; required communication consents | email or telephone, history of consents | until withdrawal of consent or effective objection |
| Analytics and marketing based on optional cookies | Art. 6(1)(a) GDPR | cookie identifiers, IP, activity and device data | until withdrawal of consent or for the lifetime of the given cookie |
4. Is the provision of data mandatory?
The provision of data marked in the form as required is necessary for the creation of an account, placing and performance of an order, delivery of goods, issuance of a sales document or handling of a complaint. Failure to provide such data may prevent the performance of the relevant action. Data used solely for marketing or analytics based on consent is voluntary and refusal does not affect the possibility of making a purchase.
5. Dropshipping and recipients of data
LIGHTBAY remains the seller and controller of the Customer’s data in connection with the handling of sales. In order to fulfil an order in the dropshipping model, we transfer to the supplier, manufacturer or logistics operator only the data necessary for completing, labelling and delivering the shipment, handling a return or complaint. This may include in particular: first name and surname of the recipient, delivery address, telephone, email, order number and information on the ordered goods.
Data may be received by the following categories of entities:
- Janex Sp. z o.o. and the relevant manufacturers or warehouses – in the scope of direct dispatch, returns and complaints;
- courier companies, carriers, collection point operators and logistics entities;
- payment operators – to the extent necessary to carry out, confirm or refund a payment;
- provider of hosting, email, domain, backups and security;
- providers of the shop platform and its extensions, including order handling, invoicing, accounting and IT support systems;
- accounting office, law firms, debt collection entities and insurers – if this is necessary for the performance of an obligation or protection of the Controller’s rights;
- providers of analytical, advertising and newsletter tools – solely to the extent resulting from the tools used and the consents granted.
These entities act – depending on their role – as separate controllers of data or as processors processing data on our documented instructions. We do not sell personal data.
6. Payment operator and external providers
Payment data is transferred to the operator of the payment method selected by the Customer. Payments by payment and debit cards as well as by means of Apple Pay and Google Pay are handled by the WooPayments service, operating in cooperation with Stripe. In connection with the performance of transactions, data may be transferred to entities belonging to the Automattic group and to Stripe Payments Europe, Limited, with its registered office in Ireland. These entities may process data as separate controllers in accordance with their own privacy policies. The scope of data transferred may include in particular first name and surname, email address, telephone number, billing and delivery address, value and subject of the order, transaction currency, IP address and information necessary for authorisation and handling of payments, prevention of fraud, refund of funds and handling of payment complaints. The Shop does not receive full payment card data of the Customer. The availability of Apple Pay and Google Pay may depend on the device, browser and configuration of the Customer. Detailed information concerning the processing of data is contained in the privacy policies of Automattic and Stripe.
7. Transfer of data outside the European Economic Area
As a rule, we use the services of entities operating in the European Economic Area. However, some providers of technology, analytics, advertising, email or infrastructure may process data in countries outside the EEA. In such a case, the transfer takes place on the basis of a mechanism permitted by the GDPR, in particular a decision of the European Commission stating an adequate level of protection or standard contractual clauses, with the application of additional safeguards where required. Information on the specific mechanism may be obtained by contacting the Controller.
8. Rights of data subjects
On the terms set out in the GDPR, you have the right to:
- rectification of inaccurate data and completion of incomplete data;
- access to data and obtaining a copy thereof;
- erasure of data (“right to be forgotten”), where the statutory conditions are met;
- restriction of processing;
- data portability of data processed on the basis of consent or a contract in an automated manner;
- objection to processing based on a legitimate interest, and to direct marketing – at any time;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
- lodging a complaint with the President of the Personal Data Protection Office.
A request may be sent to the Controller’s correspondence address or to the email address indicated in point 1. We may ask for information allowing confirmation of the identity of the applicant, but solely to the extent necessary for the secure exercise of the right.
9. Automated decision-making and profiling
We do not take decisions concerning Customers based solely on automated processing that would produce legal effects or similarly significantly affect them. If, with the user’s consent, we use advertising or analytical cookies, information on activity may be used to create general interest segments and to match advertisements. This does not, however, have legal effects on the user.
10. Cookies and similar technologies
Cookies are small files stored on the user’s device or information read from it when using the Shop. Not all cookies are anonymous – cookie identifiers, IP address and activity data may constitute personal data.
We may use the following categories:
- necessary – required for the operation of the basket, session, login, security, remembering consents and performance of a purchase; they are used without separate consent where this is permitted by law;
- functional – remember selected settings and facilitate use of the Shop;
- analytical – help to measure traffic, errors and the manner of using the pages;
- advertising – serve to measure campaigns, limit the number of displays and match advertisements.
Cookies other than necessary are stored or read after obtaining the appropriate consent in the privacy settings banner. The user may at any time change their choice using the consent management tool available in the Shop, and also change browser settings. Withdrawal of consent does not affect the lawfulness of earlier processing. Blocking necessary cookies may hinder or prevent use of the basket and purchases.
A detailed, up-to-date list of cookies – their names, providers, purposes and lifetime – should be available in the “Cookie settings” panel generated on the basis of the actual configuration of the Shop.
11. Data security
We apply technical and organisational measures adequate to the risk, including encryption of transmission, access control, backups, software updates and limitation of the scope of data transferred to partners. Access to data is held only by persons and entities that need it to perform the entrusted tasks.
12. Links and services of other entities
The Shop may contain links to external websites or functions made available by other entities. After going to such a website, the rules for processing data are determined by its controller. We encourage you to familiarise yourself with the relevant privacy policy before transferring data.
13. Changes to the privacy policy
The policy may be updated in the event of a change in the provisions of law, the manner of operation of the Shop, suppliers or tools used. The new version will be published on lightbay.shop with an indication of the date of applicability. A change to the policy does not deprive users of acquired rights nor does it legitimise processing that requires separate consent.
14. Information to be completed before publication
Before placing the policy on the website, the Controller should confirm and complete:
- the email address intended for contact in personal data matters;
- the full name of the payment operator and the active payment methods;
- the names of the courier companies used or leave the correct category of recipients;
- whether Google Analytics, Google Ads, Meta Pixel, newsletter, chat, review system or other tracking tools are used;
- whether the cookie banner blocks analytical and advertising tools until consent is obtained;
- whether contracts with hosting, IT, accounting and other processors contain the required provisions concerning data protection;
- the current list of suppliers carrying out dropshipping dispatch and the rules for transferring data to them.