Last updated: 09/25/2026
1. Who we are
This website is operated by GABRIELA KLYS, Cystersów 20d, Cracow, Poland (“we,” “us,” “Gabriela Atelier”). Contact: hello@gabrielaatelier.com.
For the purposes of the EU GDPR and the UK GDPR, we are the data controller of the personal data described below.
2. Personal data we collect
a) Data you provide
- Name, email address (newsletter, contact form, account registration)
- Billing details at checkout (name, email, billing address, country) — required for tax purposes
- Payment data — processed directly by Stripe; we never see or store full card numbers
- Content of messages you send us
b) Data collected automatically
- IP address, approximate location derived from IP, browser and device type, operating system, pages viewed, referring URL, session duration
- Cookie and pixel identifiers (see our Cookie Policy)
c) Data from third parties
- Aggregate analytics from Pinterest, where you reach us via a pin
- Fraud-screening signals from our payment processor
3. Categories of personal information (for US state privacy laws)
In the terminology used by the California Consumer Privacy Act as amended (CCPA/CPRA) and comparable state laws, we collect:
| Category | Collected? | Purpose |
|---|---|---|
| Identifiers (name, email, IP) | Yes | Orders, newsletter, analytics |
| Commercial information (purchase history) | Yes | Order fulfilment, tax records |
| Internet activity (browsing, interactions) | Yes | Analytics, advertising |
| Geolocation (approximate, from IP) | Yes | Tax determination, analytics |
| Sensitive personal information | No | — |
| Biometric information | No | — |
4. Why we use your data, and our legal basis
| Purpose | GDPR legal basis |
|---|---|
| Delivering your purchase and download | Performance of a contract |
| Responding to your enquiries | Legitimate interests / contract |
| Newsletter and marketing emails | Consent |
| Analytics (Google Analytics 4) | Consent (via cookie banner) |
| Advertising and retargeting (Meta Pixel, Pinterest Tag) | Consent (via cookie banner) |
| Determining applicable VAT and retaining invoices | Legal obligation |
| Fraud prevention and site security | Legitimate interests |
5. Who we share data with
We share personal data with processors who help us run this business:
- Website hosting: Hostinger, located in the United States
- E-commerce and payments: WooCommerce, Stripe
- Email marketing: Intuit Mailchimp
- Analytics: Google Analytics 4 (Google Ireland Ltd.)
- Advertising: Pinterest
- Our accountant and, where needed, legal advisors
- Public authorities, where legally required
6. “Selling” and “sharing” under US state law
We do not sell personal information for money.
However, our use of advertising cookies and pixels (Meta Pixel, Pinterest Tag) may constitute “sharing” of personal information for cross-context behavioural advertising under the CPRA, and comparable “targeted advertising” provisions in other US state privacy laws.
You may opt out at any time by:
- Clicking “Your Privacy Choices” / “Do Not Sell or Share My Personal Information” in our website footer, or
- Enabling a Global Privacy Control (GPC) signal in your browser, which we honour automatically as a valid opt-out request
7. International data transfers
Our website is hosted in the United States, and several of our providers (Google, Meta, Pinterest, Hostinger) process data outside the European Economic Area. Where personal data is transferred outside the EEA or UK, we rely on:
- The provider’s certification under the EU–US Data Privacy Framework (and its UK extension), where applicable, and/or
- Standard Contractual Clauses approved by the European Commission, with the UK Addendum where relevant
You may request a copy of the relevant safeguards by emailing hello@gabrielaatelier.com.
8. How long we keep data
| Data | Retention |
|---|---|
| Order and invoice records | 5 years from the end of the tax year (Polish accounting law); 10 years where OSS VAT records apply |
| Newsletter subscribers | Until you unsubscribe, then suppression-list only |
| Contact form messages | 24 months |
| Analytics data | Per GA4 retention setting: 14 months |
| Website server logs | 30 days |
9. Security
We use HTTPS/TLS encryption across the site, restrict administrative access, keep software updated, and require our processors to maintain appropriate security measures. No method of transmission over the internet is completely secure; we cannot guarantee absolute security. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority as required by law.
10. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
11. Your rights
If you are in the EU or UK, you have the right to access, rectify, erase, restrict, object to processing, data portability, and to withdraw consent at any time.
- EU complaints: Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl
- UK complaints: Information Commissioner’s Office (ICO), ico.org.uk
If you are in the United States, depending on your state you may have the right to know, delete, correct, opt out of sale/sharing and targeted advertising, and to non-discrimination for exercising these rights. If we deny your request, you may appeal by replying to our decision email; we will respond to appeals within 45 days.
If you are in Canada, you may access and correct your personal information under PIPEDA and complain to the Office of the Privacy Commissioner of Canada.
If you are in Australia, you may access and correct your personal information under the Privacy Act 1988 and complain to the Office of the Australian Information Commissioner.
To exercise any right, email hello@gabrielaatelier.com. We will verify your identity before acting and respond within the timeframe required by your applicable law (one month under GDPR/UK GDPR; 45 days under most US state laws). Authorised agents may submit requests on your behalf with written proof of authority.
12. Children
Our services are intended for adults. We do not knowingly collect personal data from children under 16 (EU/UK) or under 13 (United States, under COPPA). If you believe a child has provided us data, contact hello@gabrielaatelier.com and we will delete it.
13. Cookies
See our separate Cookie Policy for the full cookie inventory and how to change your preferences.
14. Changes
We will post any changes here and update the date above. Material changes affecting your rights will be notified by email where we have your address.
Contact: hello@gabrielaatelier.com
