privacy-policy

FIRMA JUBILERSKA FROART S.C. ERWIN FRONT, ANDRZEJ FRONT
Last updated: October 2026
froart@froart.pl · +48 603 351 676 · ul. Gołębia 10, 31-007 Kraków, Poland

We care about your privacy. Below, we explain what personal data we process, why we process it and the legal basis for doing so. We also explain the rights you have under data protection law.

The rules for using our online store are set out in our Terms & Conditions.

1. Who is the controller of your data?

The controller of your personal data is:

FIRMA JUBILERSKA FROART S.C. ERWIN FRONT, ANDRZEJ FRONT
ul. Gołębia 10, 31-007 Kraków, Poland
Tax ID (NIP): 6790044235 · REGON: 350206437
Email: froart@froart.pl
Phone: +48 603 351 676

We have not appointed a Data Protection Officer (DPO).

If you have any questions about how we process your personal data, please contact us at froart@froart.pl.

2. What data do we collect?

Depending on how you use our Store, we may process different types of data:

Data provided when placing an Order: first name, last name, delivery address, email address, phone number, delivery and payment information, and the information needed to issue a sales document if you request one.
Payment-related data: transaction number, payment identifier, payment status and data provided by the payment provider. We do not store your full payment card details.
Customer Account data: email address, registration details, Order history, saved delivery addresses, Account settings and login-related information.
Google or Facebook login data: if you create or access your Account using Google or Facebook, we receive only your email address from that service. We never receive your Google or Facebook password.
Contact form data: name, email address, message content and information provided in further correspondence.
Newsletter data: email address, information about your consent and selected marketing preferences.
Complaint data: information about the Product, the issue reported and the solution you have requested.
Technical data: IP address, date and time of connection, device, browser and operating system information, and cookie identifiers.
Analytics and marketing data: information about pages visited, time spent in the Store, clicks, device information and campaign effectiveness. This data is processed using relevant tools only after obtaining the required consent.
Server log data: IP address, date and time, URL visited, and information about technical errors and events.

We receive data directly from you, for example when you place an Order, create an Account, subscribe to our newsletter or contact us.

Technical and analytics data may be collected automatically when you use our website, including through cookies and similar technologies.

If you log in using Google or Facebook, some information may be provided to us by those services.

Providing your data is voluntary, but some information is necessary to place an Order, create an Account or use a selected service. If you do not provide the information required for the service, we may not be able to provide it.

3. Why and on what legal basis do we process your data?

Purpose of processing	Data processed	Legal basis	Retention period
Use of the Store and ensuring its security	IP address, technical data	Article 6(1)(f) GDPR	For as long as necessary to operate and secure the Store and to establish, exercise or defend legal claims
Creating and managing an Account	Email address, first and last name, Account data	Article 6(1)(b) GDPR	Until the Account is deleted, except for data that must be retained longer by law or in connection with legal claims
Processing Orders and selling Products	First and last name, email address, phone number, delivery address, Order-related data	Article 6(1)(b) GDPR; Article 6(1)(c) GDPR where required by law; Article 6(1)(f) GDPR for claims	For as long as necessary to perform the Contract, and afterwards for the period required by law or necessary to establish, exercise or defend legal claims
Email communication	Email address, first and last name, information provided in the message	Article 6(1)(b) or (f) GDPR, depending on the purpose of the contact	For as long as necessary to handle the matter and, where justified, for the period necessary to establish, exercise or defend legal claims
Phone communication	Phone number, first and last name, information provided during the call	Article 6(1)(b) or (f) GDPR, depending on the purpose of the contact	For as long as necessary to handle the matter and, where justified, for the period necessary to establish, exercise or defend legal claims
Accounting and tax records	Data contained in sales and accounting records	Article 6(1)(c) GDPR	For the period required by applicable tax and accounting laws, generally 5 years, although this period may be extended in certain circumstances
Analytics of Store use	IP address, cookie identifiers, activity data	Article 6(1)(a) GDPR – consent; and Article 399 of the Polish Electronic Communications Law where applicable to storing or accessing information on your device	Until consent is withdrawn or for the period determined by the settings and duration of the relevant tool
Newsletter and email marketing	Email address, consent information and preferences	Article 6(1)(a) GDPR – consent	Until you withdraw your consent or unsubscribe from the newsletter
Social media interactions	Profile information and information voluntarily provided as part of the interaction	Article 6(1)(f) GDPR	For as long as necessary to maintain the communication and handle the matter, taking into account the rules of the relevant platform
Handling complaints	First and last name, contact details, Product and complaint information	Article 6(1)(c) and (f) GDPR	For as long as necessary to handle the complaint and afterwards for the period necessary to establish, exercise or defend legal claims
Error diagnostics and security	IP address, date and time, URL, error information	Article 6(1)(f) GDPR	For as long as necessary to maintain security, detect errors and incidents, and defend against claims

We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

3.1. Marketing and profiling

We may use information about your use of the Store for marketing purposes, including creating advertising audiences and personalising marketing communications, where you have given the required consent.

This may include analysing your activity on the website, such as the Products or pages you have viewed.

You may withdraw your consent at any time. You may also object at any time to the processing of your data for direct marketing purposes, including profiling related to such marketing.

4. Who may we share your data with?

We share your data only with entities that are needed to operate the Store, fulfil Orders and provide our services.

These may include:

Shopify – our e-commerce platform, hosting provider and provider of services related to Order and Customer Account management. Shopify generally processes our customers’ data on our behalf, but for certain services it may act as an independent data controller.
Courier companies and delivery providers – to deliver your Order. They receive only the data necessary to provide the delivery service.
Payment providers – data necessary to process your payment is provided to the provider of the payment method you choose. We do not store full payment card details.
Accounting office – to handle accounting and financial settlements.
IT service providers – where necessary to maintain, secure and technically support the Store.
Google and Meta – where the relevant analytics or marketing tools have been accepted by you through the cookie banner. Depending on the specific tool and its configuration, these companies may act as processors or as independent data controllers.
Legal advisors and law firms – where necessary to establish, exercise or defend legal claims.

We may also disclose your data to authorised public authorities where required by law, such as courts, tax authorities or law enforcement authorities.

Each entity to which we entrust personal data is required to provide an appropriate level of security and confidentiality in accordance with applicable law.

5. Is your data transferred outside the European Economic Area?

Yes. In connection with the use of certain services provided by our partners, your data may be transferred to countries outside the European Economic Area, including the United States.

Such transfers are based on an appropriate mechanism provided for by the GDPR, in particular:

a European Commission adequacy decision, where the recipient benefits from an applicable framework such as the EU–U.S. Data Privacy Framework;
Standard Contractual Clauses (SCCs);
or another transfer mechanism permitted under the GDPR.

More information about how individual service providers process personal data can also be found in their own privacy policies.

6. What are your rights?

In connection with the processing of your personal data, you have, to the extent provided by the GDPR, the right to:

access your data – you can find out what personal data we process about you;
rectification – you can ask us to correct inaccurate data or complete incomplete data;
erasure – you can ask us to delete your data unless we are legally required to keep it or have another valid legal basis for further processing;
restriction of processing – in certain situations, you can ask us to temporarily restrict the processing of your data;
data portability – where provided by the GDPR, you can receive your data in a structured format and transfer it to another controller;
object – you may object to processing based on our legitimate interests. You may also object at any time to the processing of your data for direct marketing purposes, including profiling related to such marketing;
withdraw consent – where we process your data based on your consent, you may withdraw that consent at any time;
lodge a complaint – you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Withdrawing your consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

6.1. How to exercise your rights

You can send a request regarding your personal data to froart@froart.pl.

We will respond without undue delay and no later than one month after receiving your request. In justified cases, this period may be extended by up to another two months. We will inform you about the extension and the reasons for it.

When can we refuse to delete your data?
For example, when we are legally required to retain it or when retaining it is necessary to establish, exercise or defend legal claims.

When can you request restriction of processing?
For example, when you dispute the accuracy of your data or object to its processing, for the time needed to review your request, where the conditions set out in the GDPR are met.

If you live or work outside Poland, you may also lodge a complaint with the data protection authority responsible for your usual place of residence, place of work or the location of the alleged infringement.

7. Cookies and tracking technologies

Our website uses cookies and similar technologies. These are small files or pieces of information stored on your device that help the website function properly, remember selected settings and, after obtaining the required consent, analyse how the Store is used and support marketing activities. Details are set out in our Cookie Policy.

7.1. Types of cookies

Essential cookies – these are necessary for the Store to function properly, for example to operate the shopping cart, login, user session and basic security functions. Where they are necessary to provide the service, they do not require consent.
Analytics cookies – these help us understand how the Store is used, for example which pages are visited, what users click and how long visits last. They are used only after obtaining your consent.
Marketing cookies – these may be used to show more relevant advertising and measure its effectiveness. They are used only after obtaining your consent.

You can manage your preferences using the cookie banner on our website by choosing “Accept all”, “Accept necessary” or “Manage preferences”.

7.2. Types of cookies by how they operate

Session cookies – remain active until you close your browser.
Persistent cookies – remain on your device for a specified period or until you delete them.
First-party cookies – are set by our website or in connection with the Shopify platform.
Third-party cookies and technologies – may be used by providers such as Google or Meta where you have given the required consent.

We do not use mechanisms designed to make it difficult for you to refuse consent or to pressure you into accepting unnecessary cookies.

7.3. Managing cookies

You can change your cookie preferences at any time through the cookie banner, block cookies in your browser settings or delete stored cookies.

Disabling certain cookies may limit some Store functionality.

8. How do we protect your data?

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or destruction.

Depending on the systems and services we use, these measures may include:

encrypted data transmission – your connection to our Store is protected using HTTPS;
access controls – access to personal data is limited to people and entities that need it to perform their duties;
security measures used by our service providers – we work with providers that apply appropriate security measures to their systems;
technical updates and security measures – we take appropriate steps to reduce risks related to the security of our systems.