Privacy Policy

This Privacy Policy explains how we process personal data belonging to customers and visitors to the Filmfy online shop, which cookies and analytics tools we use, and the rights available to users. We protect your data and process it in accordance with applicable law.

1. Data controller

The controller of your personal data is:

• JDG „Wasz Stół"
• NIP: 5223233873
• Address: ul. Widawska 5/21, 01-494 Warszawa
• Phone: +48 45 104 05 40
• Email: sales@filmfy.eu

For all personal-data matters, contact the controller at sales@filmfy.eu.

2. Data processed and purposes

We process personal data for the following purposes:

• fulfilling orders — name, delivery address, phone number and email address, plus invoicing details when a VAT invoice is requested,
• processing payments — online payments are handled by an external payment provider; we send it the information required for the transaction, including the amount, email address and order number. We neither see nor store card details; you enter them directly with Stripe or PayPal,
• handling complaints and returns — contact details and order information,
• responding to enquiries — when you contact us by phone or email,
• analytics and marketing — anonymous or pseudonymous website-use data collected through cookies with your consent,
• accounting and tax obligations — information included in accounting documents.

3. Legal bases under the GDPR

We process data under Regulation (EU) 2016/679 (GDPR). The applicable legal bases are:

• Article 6(1)(b) GDPR — performance of a contract (order fulfilment, delivery and payment handling),
• Article 6(1)(c) GDPR — legal obligations of the controller, including tax, accounting and complaint-handling obligations,
• Article 6(1)(f) GDPR — legitimate interests including communication, establishing or defending claims, and keeping the website secure,
• Article 6(1)(a) GDPR — consent for optional statistics, analytics, advertising, remarketing and session recording.

4. Cookies, analytics and marketing tools

The shop uses cookies, which are small text files saved on a user's device. Essential cookies required for cart operation and security are always active. Optional analytics, marketing and session-recording tools run only after you give consent through the cookie banner shown on your first visit.

We use the following cookie and storage categories:

• essential — required for the cart, saved product configuration, session security and remembering your consent choices. They are always active on the basis of the controller's legitimate interest and do not require consent,
• analytics — help us understand visits, product views and page performance so we can improve the shop. They run only with your consent,
• marketing — measure advertising performance, build audiences and support relevant advertising and remarketing. They run only with your consent,
• session recording — records cursor movement, clicks and scrolling and creates aggregated heatmaps to improve the website. Form fields containing names, email addresses, phone numbers and addresses are masked and not recorded. This category runs only with separate consent.

Until you consent, analytics, marketing and session-recording tags do not run and do not place their optional cookies or send data to their providers. Consent is voluntary and separate for each category; refusing it does not prevent you from ordering.

You can withdraw consent at any time as easily as you gave it by selecting Cookie settings in the footer. Withdrawal does not affect processing that was lawful before withdrawal; the relevant optional tags stop running afterwards. You can also block or delete cookies in your browser settings.

With consent, external providers support the following functions:

• tag management — coordinates optional tools and releases them only after the appropriate consent signal,
• web analytics — analyses shop traffic and use so we can improve the website and offer,
• advertising measurement and optimisation — measures advertising campaigns and supports remarketing,
• session recording and heatmaps — analyses visits to improve the website. Personal details in form fields are masked before transmission and are not recorded.

With your consent, these tools may use cookies and device identifiers to measure conversions, build audiences and display remarketing advertisements. Each provider explains its own processing in its privacy policy.

5. Recipients of personal data

We share data only as necessary with service providers that support order fulfilment and shop operation and under appropriate contractual safeguards. Recipient categories include:

• courier and logistics providers — to deliver and track parcels,
• online payment providers — to process the payment method you select,
• order-management providers — to accept, fulfil and account for orders, including customer and order details,
• IT, hosting, email and communication providers — including internal order-notification tools required for fulfilment,
• analytics, advertising and session-recording providers — only within the scope of your consent,
• accounting providers — for accounting and tax services.

Some providers, including analytics, advertising and communication providers, may process data outside the European Economic Area. Where this occurs, transfers rely on GDPR-compliant safeguards, particularly standard contractual clauses.

6. Retention periods

• order data — for contract performance and the period required by tax and accounting law, usually five years,
• consent-based data — until consent is withdrawn or the processing purpose ends,
• data needed to establish or defend claims — until the relevant limitation period expires.

7. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access your personal data and receive a copy,
• correct inaccurate personal data,
• request erasure of personal data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time without affecting processing that was lawful before withdrawal,
• complain to the competent supervisory authority; for the Polish controller this is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

Providing personal data is voluntary but necessary to enter into and fulfil a sales contract. Without it, we cannot process your order.

8. Contact

To ask about personal data or exercise these rights, email sales@filmfy.eu or call +48 45 104 05 40. Our sales rules are set out in the Terms and Conditions.