Privacy policy

The controller of your personal data is NakedArt.

For data protection matters, write to: [email protected].

To handle your orders we process the following data:

• first and last name,
• email address,
• phone number,
• delivery address (street, postal code, city, country) or parcel locker details,
• order data (cart contents, amount, payment method, delivery method),
• the Stripe payment session identifier (without full card details — those are processed by Stripe directly).

The newsletter (if you consent to it) involves processing your email address.

To measure traffic and improve the shop, we process anonymous data about how the site is used: session identifier, pages visited, clicks, scrolls, time on site, approximate location based on your IP address, device and browser type, traffic source, and which A/B test variant you were assigned. We do this on the basis of our legitimate interest. Until you press OK on the cookie notice, this measurement runs without cookies and without anything stored in your browser: we count the visit anonymously and store nothing on your device. You can object at any time. Write to [email protected], or block the analytics scripts in your browser settings. Session recording and marketing tools (the Meta Pixel) start only after you press OK on the notice.

For every paid order we also send data to Meta from our server (Conversions API), see “Server-side purchase measurement” below.

• Performance of the sales contract — Art. 6(1)(b) GDPR (accepting the order, payment, shipping, handling complaints and returns).
• Accounting and tax obligations — Art. 6(1)(c) GDPR (issuing sales documents, keeping records for the period required by law).
• Own marketing and defense against claims — Art. 6(1)(f) GDPR (the controller’s legitimate interest).
• Newsletter — Art. 6(1)(a) GDPR (voluntary consent, which you can withdraw at any time).
• Analytics and A/B tests — Art. 6(1)(f) GDPR (legitimate interest: measuring traffic and improving the shop). The data is anonymous and is not used for advertising profiles. You can object at any time. An email to [email protected] is enough, or you can block the analytics scripts in your browser.
• Session recording, marketing cookies and the Meta Pixel — Art. 6(1)(a) GDPR (consent given by pressing OK on the notice, which you can withdraw at any time through “Cookie settings” in the footer).
• Server-side purchase measurement (Meta Conversions API, PostHog) — Art. 6(1)(f) GDPR (legitimate interest in measuring and optimising our advertising). You can object at any time by email to [email protected].

We pass your data only to parties whose involvement is necessary to fulfill the order or provide the service:

• Stripe Payments Europe, Ltd. — payment processor (BLIK, Przelewy24, cards).
• InPost S.A. or another carrier selected with the order — parcel delivery.
• Cloudflare, Inc. — site hosting (Cloudflare Pages, D1 database). Standard contractual clauses (SCC) as the basis for transfers outside the EEA.
• PostHog Inc. — site analytics and A/B tests (legitimate interest; cookies and session recording only after OK). Data stored in the EU (Frankfurt). Standard contractual clauses (SCC) as the basis for transfers outside the EEA.
• Meta Platforms Ireland Limited — recipient of the server-side purchase event (Conversions API), see “Server-side purchase measurement”. The Meta Pixel in the browser loads only after OK.
• The email service provider (transactional correspondence).
• Our accountants — to the extent needed for bookkeeping.

We do not sell your data and we do not pass it on for marketing purposes outside NakedArt.

• Order data — for 5 years from the end of the year in which the sales document was issued (a tax law requirement).
• Contact data connected with complaints and returns — until claims become time-barred.
• An email address signed up to the newsletter — until consent is withdrawn.

Under the GDPR you have the following rights:

• the right of access to your data and to a copy of it,
• the right to rectify inaccurate data,
• the right to erasure (“the right to be forgotten”),
• the right to restrict processing,
• the right to data portability,
• the right to object to processing based on a legitimate interest,
• the right to withdraw consent at any time (this does not affect the lawfulness of processing carried out before the withdrawal).

To exercise these rights, write to us at [email protected].

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa.

We use the following categories of cookies, plus data stored in your browser (localStorage):

• Technical cookies (necessary) — cart contents, the admin session, the anonymous A/B test variant identifier (na_uid, na_hero_v). These need no consent, because the shop cannot work without them.
• Analytics (PostHog) — runs on the basis of our legitimate interest. Until you press OK, PostHog works only in the memory of the open page: it sets no cookies and stores nothing in localStorage or sessionStorage, and the visit is counted anonymously. After OK, PostHog stores its identifier in a first-party cookie and in localStorage so that returning visits can be recognised.
• Session recording and marketing cookies (PostHog, Meta) — enabled only after you press OK on the notice. Before that there is no Meta Pixel, no _fbp or _fbc cookie and no session recording. After OK, session recording may record (on a sample of visits) and the Meta Pixel stores the _fbp and _fbc identifiers, used to measure how well Facebook and Instagram ads perform.

Withdrawing consent and objecting. You can withdraw consent at any time: the “Cookie settings” link in the footer reopens the notice, and a button there turns measurement off again. When you do, we delete the Meta cookies on your device and PostHog stops. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can also block these scripts yourself, in your browser settings or with a tracker-blocking extension. Clearing this site’s data (the “Cookies and site data” section) removes the identifiers stored on your device, but it does not stop further collection.

Server-side purchase measurement. Regardless of the cookie notice, for every paid order our server sends a purchase event to Meta Platforms Ireland Limited (Conversions API): hashed email address, hashed name, hashed phone number, hashed city and postcode, the country code (ISO), the order value and the currency, plus _fbp and _fbc only if they exist. We do this to measure and optimise our advertising, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). You can object to this processing at any time by email to [email protected]. We record the purchase server-side in PostHog as well, on the same basis.

You can also block cookies entirely in your browser settings — that may, however, affect how some parts of the shop work (the cart, for example).