Privacy Policy
PRIVACY POLICY — METAPHORIC TOOLS
Version: 1.2 | Effective date: 27 October 2026
This Privacy Policy describes how WOJCIECH WIECONKOWSKI METAPHORIC TOOLS (the Controller) processes the personal data of users of the online store at metaphorictools.com, in accordance with Regulation (EU) 2016/679 (GDPR).
§ 1. DATA CONTROLLER
WOJCIECH WIECONKOWSKI METAPHORIC TOOLS
ul. Śląska 6, 84-230 Rumia, Poland
Tax ID (NIP): 5882256306
REGON: 221709919
Contact: contact@metaphorictools.com
The Controller has not appointed a Data Protection Officer, as the GDPR does not require one for the type and scale of processing carried out by the Store. For all questions about personal data, please contact us at the email address above.
§ 2. WHAT DATA WE COLLECT AND WHY
2.1. Order fulfilment (Art. 6(1)(b) GDPR)
Purpose: concluding and performing the sales contract, delivering the ordered product and handling complaints and returns.
Data: name, delivery address, email, phone number (optional, passed to the carrier for delivery contact), company name and tax ID (if you buy as a business), order history, payment data (processed by mBank PayNow or Stripe, depending on the payment method chosen — the Controller does not store card data).
Retention: for the duration of the contract and complaint periods; data needed for accounting — 5 years from the end of the calendar year in which the tax payment deadline expired.
2.2. Customer account (Art. 6(1)(b) GDPR)
Purpose: providing the customer account.
Data: name, email, password in encrypted form, order history, saved addresses.
Retention: until the account is deleted, subject to statutory retention obligations.
2.3. Newsletter (Art. 6(1)(a) GDPR — consent)
Purpose: sending the newsletter via MailerLite with news about instruments, workshops, promotions and educational content. Signing up is voluntary — at checkout there is a separate, unticked checkbox for this.
Data: email address, first name (optional).
Retention: until consent is withdrawn. You can unsubscribe via the link in every email or by contacting us. The newsletter rules are set out in the Newsletter Terms.
2.4. Cookies, videos and third-party tools
We use strictly necessary cookies without consent (Art. 6(1)(b) and (f) GDPR) and functional cookies only with your consent given in the CookieYes banner (Art. 6(1)(a) GDPR). YouTube videos load in privacy-enhanced mode (youtube-nocookie.com) only after you click. We keep a log of your cookie choices on our server so that we can demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
We currently do not use analytics or advertising tools (e.g. Google Analytics, Meta Pixel). If we enable them, this will happen only with your consent and after we update this Policy and the Cookie Policy.
2.5. Legal obligations (Art. 6(1)(c) GDPR)
Purpose: issuing invoices and receipts, meeting tax and accounting obligations — including, where required by law, sending invoices to the Polish National e-Invoicing System (KSeF) — and handling complaints in line with consumer law. Retention: 5 years from the end of the calendar year in which the tax payment deadline expired.
2.6. Legitimate interests (Art. 6(1)(f) GDPR)
Purpose: establishing, pursuing or defending legal claims, Store security (e.g. protection against attacks and spam) and fraud prevention. Retention: until the limitation period for claims expires (as a rule up to 6 years).
2.7. Enquiries and quote requests (Art. 6(1)(b) and (f) GDPR)
Purpose: responding to messages sent through the contact form, the custom instrument enquiry form and the custom case enquiry form, and preparing a proposal or quote at your request (Art. 6(1)(b) GDPR — steps taken before entering into a contract); answering other questions is our legitimate interest (Art. 6(1)(f) GDPR). Data: name, email, delivery country, details of your enquiry and any photos you attach. Enquiries about custom cases are sent directly to Laura Mulica, who sews our cases (see § 3). Retention: for the time needed to handle the enquiry and up to 12 months after our last contact; if the enquiry leads to an order, the data is kept as described in point 2.1.
Providing data is voluntary, but without the data marked as required in the order form we cannot accept and fulfil your order. We do not make decisions based solely on automated processing, including profiling.
§ 3. RECIPIENTS OF PERSONAL DATA
| Recipient | Role | Transfer outside the EEA |
|---|---|---|
| mBank S.A. (PayNow) | Payment processing — service terms / data processing agreement | None (Poland / EEA) |
| Stripe Payments Europe, Ltd. (Ireland) | Card and online payment processing — Stripe Services Agreement / DPA | Possible transfer to Stripe, Inc. (USA) — EU-US Data Privacy Framework and Standard Contractual Clauses |
| MailerLite (UAB MailerLite, Lithuania) | Newsletter delivery and sign-up forms — data processing agreement | None (EEA) |
| SEOHOST.pl | Server and database hosting — data processing agreement | None (servers in Poland — EEA) |
| Fakturownia | Invoicing system — issuing and storing invoices and sending them to KSeF — data processing agreement | None (EEA) |
| MK5 accounting firm | Bookkeeping — data processing agreement or service contract | None |
| Laura Mulica (e-mail: eksykat@gmail.com) | Sewing instrument cases and preparing quotes for custom cases (custom case enquiry form) — data processing agreement | Possible — her email account is hosted by Google (Gmail): SCCs + EU-US Data Privacy Framework |
| Google Ireland Ltd. (YouTube) | Playback of embedded videos — only after you click and consent to functional cookies | Possible transfer to Google LLC (USA) — EU-US Data Privacy Framework and SCCs |
| Carriers and shipping intermediaries (e.g. InPost, DPD, DHL, UPS, FedEx, Furgonetka) | Parcel delivery — only the data needed for delivery | For deliveries outside the EEA — to the extent necessary for delivery (Art. 49(1)(b) GDPR) |
| Public authorities (e.g. tax office, KSeF) | Where required by law | None |
§ 4. TRANSFERS OUTSIDE THE EEA
Data may be transferred to the USA as part of the Stripe and Google (YouTube, Gmail) services — on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework and Standard Contractual Clauses. For deliveries to countries outside the EEA, we pass to the carrier and customs authorities the data necessary for delivery (Art. 49(1)(b) GDPR). You may request a copy of the safeguards by contacting us.
§ 5. YOUR RIGHTS
- Access (Art. 15 GDPR) — obtain confirmation of processing and a copy of your data,
- Rectification (Art. 16) — correct inaccurate or incomplete data,
- Erasure (Art. 17) — when the data is no longer necessary,
- Restriction (Art. 18) — in certain circumstances,
- Portability (Art. 20) — receive your data in a machine-readable format,
- Objection (Art. 21) — to processing based on legitimate interests,
- Withdrawal of consent — at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, write to contact@metaphorictools.com. We respond without undue delay and within one month at the latest.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl. People in other EU countries may also contact the supervisory authority in their country.
§ 6. COOKIES
The Store uses cookies. Full details, including the list of cookies and how to manage consent via the cookie icon at the bottom of the screen, are set out in our Cookie Policy.
§ 7. SECURITY
- SSL/TLS encryption (HTTPS),
- Passwords stored in encrypted form (WordPress standard),
- Admin panel protected by two-factor authentication (2FA), a strong password, a non-standard login address and the Wordfence firewall,
- Regular updates of WordPress, WooCommerce and plugins,
- Regular backups of the database and files, stored securely and overwritten after a limited period,
- Payment data handled exclusively by mBank PayNow and Stripe (PCI DSS compliant) — no card data is stored on the Store server.
§ 8. CHANGES TO THIS POLICY
We will announce material changes by email or with a notice on the Store website. The current version is always available on the Store website.
§ 9. CONTACT
Email: contact@metaphorictools.com
ul. Śląska 6, 84-230 Rumia, Poland
