Privacy
policy

1. Who is responsible for your data

The controller of your personal data, that is the entity deciding why and how it is used, is:

• Mateusz Grabka, a natural person conducting unregistered activity within the meaning of article 5 of the Polish Entrepreneurs' Law, operating under the Saint 11 brand
• Correspondence address: ul. Kazimierza Wielkiego 6, 40-766 Katowice, Poland
• E-mail address: info@saint11.pl

Unregistered activity means that Saint 11 is not entered in the Polish Central Register and Information on Economic Activity and holds no NIP or REGON number. This does not change the scope of your rights under the GDPR. The controller is the natural person named above and that person is responsible for the security of the data.

For anything concerning personal data, write to info@saint11.pl or by post to the correspondence address. We answer every message.

We have not appointed a data protection officer, because we are not required to. All data protection matters are handled directly by the controller.

2. Where your data comes from

We receive it directly from you. That happens when you:

• write to us at info@saint11.pl, including when you click a contact button on saint11.pl,
• sign up to the Saint 11 newsletter,
• contact us through Instagram @11saint.art,
• place an order and give the details needed to issue a sales document and to deliver.

We do not buy databases and we do not take your data from any other source.

There is no contact form on the site. saint11.pl collects no data and sends nothing to our server. The contact buttons simply open your own mail application with the subject line already filled in. You decide what to write and whether to send it at all, and the message leaves your own mailbox. Your data reaches us exactly as it would with an ordinary e-mail, and it is stored in our mailbox.

3. Why and on what basis we process data

The law requires us to state a legal basis for every purpose. Below are all the situations that apply to us.

Purpose	Data	Legal basis	How long
Replying to your e-mail enquiry	Name, e-mail address, optionally phone number, the content of your message, a photo of your interior if you send one	Article 6(1)(b) GDPR, steps prior to entering into a contract, and where the enquiry does not lead to a contract, article 6(1)(f) GDPR, our legitimate interest in conducting correspondence	Until the conversation ends, then up to 12 months in case the subject comes back
Preparing a quote and completing an order	Full name, address, e-mail, phone number, details for the sales document, dimensions and what was agreed about the piece	Article 6(1)(b) GDPR, performance of a contract	For the duration of the work, then for the limitation period for claims
Issuing invoices and keeping sales records	Data required by tax law, provided when you ask for an invoice	Article 6(1)(c) GDPR, legal obligation under tax law	5 years from the end of the tax year in which the document was issued
Handling a complaint or a withdrawal from a contract	Order data and the content of the report	Article 6(1)(c) GDPR and article 6(1)(f) GDPR, defence against claims	Until claims become time barred
Sending the Saint 11 newsletter	E-mail address, optionally first name	Article 6(1)(a) GDPR, your consent, together with electronic communications rules on direct marketing	Until you unsubscribe or withdraw consent
Website visit statistics	Visit data collected by cookies, including IP address	Article 6(1)(a) GDPR, your consent given in the cookie banner	As set out in the cookie policy
Saint 11 advertising directed at people who visited the site	Visit data collected by advertising cookies	Article 6(1)(a) GDPR, your consent given in the cookie banner	Until consent is withdrawn
Pursuing and defending claims	Data necessary for the case	Article 6(1)(f) GDPR, our legitimate interest	Until claims become time barred

4. Do you have to give us data

Providing data is voluntary, but without some of it we will not be able to help you.

• A name and an e-mail address are needed so that we can reply. Without them we cannot answer your enquiry.
• Phone number and dimensions are optional. They make the conversation about the piece easier.
• Address and invoice details are needed only at the order stage, because tax law requires them.
• Signing up to the newsletter is entirely voluntary. Declining has no effect on your ability to order a piece.

5. Who we entrust data to

We do not sell or share your data for profit. We do, however, use companies that process data on our behalf, under data processing agreements. These are:

• The hosting company JDM (jdm.pl), which maintains the saint11.pl website and the info@saint11.pl mailbox
• Courier companies and carriers, to whom we pass the details needed to deliver a piece

We use no analytics or advertising tools, so we pass no data to their providers. The Saint 11 newsletter is not yet running, so we do not use an external mailing system either. If that changes, we will update this list before the first mailing.

Your data may also be disclosed to state authorities if they request it on a legal basis.

6. Transfers outside the European Economic Area

Some internet tools have servers outside Europe, most often in the United States. If we use such a tool, the transfer takes place on the basis of a European Commission adequacy decision or on the basis of standard contractual clauses approved by the European Commission.

At present we use no tools that would transfer your data outside the European Economic Area.

7. How long we keep data

Retention periods for each purpose are in the table in section 3. The general rule is that we keep data for as long as we need it for the purpose we collected it for, and then for the period required by tax law or for the period in which claims may arise.

Once those periods have passed we delete the data or permanently anonymise it.

8. Your rights

The GDPR gives you specific rights in relation to us. You can exercise them by writing to info@saint11.pl. We reply without undue delay and within one month at the latest.

• Right of access. You can ask whether we process your data and request a copy of it.
• Right to rectification. If the data is incorrect or incomplete, we will correct it.
• Right to erasure. Also known as the right to be forgotten. We will delete the data unless we have to keep it because of tax law or an ongoing dispute.
• Right to restriction of processing. You can ask us only to store the data and do nothing with it, for example while its accuracy is being checked.
• Right to data portability. Data we process on the basis of consent or a contract will be given to you in a commonly used format or sent to an entity you nominate.
• Right to object. If we process data on the basis of legitimate interest, you can object. For direct marketing the objection is unconditional, we simply stop.
• Right to withdraw consent. You can withdraw consent to the newsletter or to cookies at any time. Withdrawal does not affect what we lawfully did before you withdrew it.

You can change your cookie consent with the Cookie settings button, also available in the footer of every page. You can unsubscribe from the newsletter using the link at the end of every message.

9. Complaint to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Polish Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. If you live in another EU country you may also complain to your local supervisory authority. We would be glad if you wrote to us first, because most matters can be sorted out straight away.

10. Profiling and automated decisions

We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.

If you consent to marketing cookies, advertising tools may tailor the ads shown to you to the pages you have visited. This is a form of profiling for marketing purposes, which you can always refuse or withdraw.

11. Security

The site runs over an encrypted HTTPS connection. The site itself transmits none of your data, and correspondence goes directly to our mailbox. Access to the mailbox and to the systems holding data is protected by a password and, where possible, two factor authentication. Only the controller and the entities listed in section 5 can see the data.

12. Cookies

How we use cookies is described separately, in our cookie policy. You will find there a list of every file, what it is for and how long it is stored.

13. Minors

The site is not directed at children. We do not knowingly collect data from people under 16. If it turns out we have received such data without a guardian's consent, we will delete it.

14. Changes to this document

We may update this policy, for example when we add a new tool or when the law changes. A new version is published on this page together with the date it comes into force. If a change is significant for people signed up to the newsletter, we will tell them by e-mail.