1. Data controller
The controller of your personal data is 13th Floor Adam Karbowski, ul. Wacława Lachmana 26/85, 09-407 Płock, Poland, tax ID (NIP) 7742676268, REGON 142014874 (the “Controller”). Contact regarding personal data: info@13f.pl.
2. What data we process
- data provided in the order form: first name, surname, e-mail address, billing address,
- invoice details (e.g. company name, tax ID), if you request an invoice by e-mail,
- the e-mail address given when signing up for the newsletter (e.g. in exchange for a free colouring page),
- order data: products purchased, amount, date, file download history,
- technical data: IP address, browser information, data stored in cookies (see the Cookie policy),
- data from correspondence, if you write to us by e-mail.
We do not receive payment card details – they are processed directly by the payment operator.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) | How long |
|---|---|---|
| Concluding and performing the contract (fulfilling the order, supplying files) | Art. 6(1)(b) | until the contract has been performed, then for the limitation period for claims |
| Handling complaints | Art. 6(1)(b) and (c) | until the matter is closed and claims are time-barred |
| Issuing invoices and keeping accounts | Art. 6(1)(c) (tax and accounting law) | 5 years from the end of the year in which the tax obligation arose |
| Establishing, pursuing or defending claims | Art. 6(1)(f) (legitimate interest) | until the limitation period expires |
| Replying to e-mails | Art. 6(1)(f) | until the correspondence ends, no longer than 12 months |
| Shop security and preventing payment fraud | Art. 6(1)(f) | for as long as necessary for this purpose |
| Newsletter (sending the free page, discount codes, news and information about the “Hannah Art Club”) | Art. 6(1)(a) (consent) | until consent is withdrawn (unsubscribe) |
Providing data in the order form is voluntary but necessary to conclude the contract. Signing up for the newsletter is voluntary; you can withdraw your consent at any time (the “unsubscribe” link in every message), without affecting the lawfulness of processing before its withdrawal.
4. Recipients of data
Your data may be received only by entities that help us run the shop:
- the hosting and e-mail provider: dhosting.pl,
- payment operators: Stripe Payments Europe Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – for payment processing they also act as separate data controllers,
- the newsletter provider: MailerLite,
- the accounting office serving the Controller,
- public authorities, where required by law.
5. Transfers outside the EEA
The payment operators (Stripe, PayPal) and the newsletter provider may transfer data to the USA. This is done on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
6. Your rights
You have the right to:
- access your data and receive a copy,
- rectify your data,
- erase your data (to the extent we are not required to keep it by law),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise your rights, write to info@13f.pl.
7. Automated decisions
We do not make decisions based solely on automated processing, including profiling. The payment operator may automatically assess the risk of fraud during payment.
8. Changes
This policy may be updated. The current version is always available on this page. Last updated: 15 October 2026.