Privacy policy

The controller of your personal data is NakedArt.

For data protection matters, write to: [email protected].

To handle your orders we process the following data:

• first and last name,
• email address,
• phone number,
• delivery address (street, postal code, city, country) or parcel locker details,
• order data (cart contents, amount, payment method, delivery method),
• the Stripe payment session identifier (without full card details — those are processed by Stripe directly).

The newsletter (if you consent to it) involves processing your email address.

If you consent to analytics, we also process anonymous data about how the site is used: session identifier, pages visited, clicks, scrolls, time on site, approximate location based on your IP address, device and browser type, traffic source, and which A/B test variant you were assigned.

• Performance of the sales contract — Art. 6(1)(b) GDPR (accepting the order, payment, shipping, handling complaints and returns).
• Accounting and tax obligations — Art. 6(1)(c) GDPR (issuing sales documents, keeping records for the period required by law).
• Own marketing and defense against claims — Art. 6(1)(f) GDPR (the controller’s legitimate interest).
• Newsletter — Art. 6(1)(a) GDPR (voluntary consent, which you can withdraw at any time).
• Analytics and A/B tests — Art. 6(1)(a) GDPR (voluntary consent given through the cookie banner; the data serves only to measure traffic and improve the shop, and you can withdraw it at any time).

We pass your data only to parties whose involvement is necessary to fulfill the order or provide the service:

• Stripe Payments Europe, Ltd. — payment processor (BLIK, Przelewy24, cards).
• InPost S.A. or another carrier selected with the order — parcel delivery.
• Cloudflare, Inc. — site hosting (Cloudflare Pages, D1 database). Standard contractual clauses (SCC) as the basis for transfers outside the EEA.
• PostHog Inc. — site analytics and A/B tests (only with your consent). Data stored in the EU (Frankfurt). Standard contractual clauses (SCC) as the basis for transfers outside the EEA.
• The email service provider (transactional correspondence).
• Our accountants — to the extent needed for bookkeeping.

We do not sell your data and we do not pass it on for marketing purposes outside NakedArt.

• Order data — for 5 years from the end of the year in which the sales document was issued (a tax law requirement).
• Contact data connected with complaints and returns — until claims become time-barred.
• An email address signed up to the newsletter — until consent is withdrawn.

Under the GDPR you have the following rights:

• the right of access to your data and to a copy of it,
• the right to rectify inaccurate data,
• the right to erasure (“the right to be forgotten”),
• the right to restrict processing,
• the right to data portability,
• the right to object to processing based on a legitimate interest,
• the right to withdraw consent at any time (this does not affect the lawfulness of processing carried out before the withdrawal).

To exercise these rights, write to us at [email protected].

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa.

We use the following categories of cookies, plus data stored in your browser (localStorage):

• Technical cookies (necessary) — cart contents, the admin session, the anonymous A/B test variant identifier (na_uid, na_hero_v). These need no consent, because the shop cannot work without them.
• Analytics cookies (PostHog) — set only after you consent in the cookie banner. We collect anonymous statistics about pages visited, elements clicked, time on site and user behavior, including data for the A/B tests that measure how well page variants perform. The tool is operated by PostHog Inc. and the data is stored in the EU (Frankfurt).

Withdrawing consent. You can withdraw consent to analytics cookies at any time by clearing this site’s data in your browser settings (the “Cookies and site data” section) or by contacting us at [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You can also block cookies entirely in your browser settings — that may, however, affect how some parts of the shop work (the cart, for example).