Privacy Policy
Effective from 19 October 2026
1. Controller
The controller of personal data collected in the SAPA online shop (sapa-patterns.com) is SAPA-KOWAL Spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Świdnica, Plac Św. Małgorzaty 13/5, 58-100 Świdnica, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Wrocław-Fabryczna in Wrocław, 9th Commercial Division of the National Court Register, under KRS number 0001053461, NIP (tax ID) 8842821078, REGON 526137111, share capital PLN 5,000 (the “Controller”). Contact in matters concerning personal data: hello@sapa-patterns.com or by post to the registered office address. The Controller has not appointed a data protection officer.
2. What data, for what purpose and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Account and login (e-mail link or Google account) | e-mail; when logging in with Google, also the name, surname and profile picture provided by Google | Art. 6(1)(b) — Account contract |
| Purchase and supply of files, order confirmation | e-mail, purchased products and file type, amount, date and time of the consent to supply the files, download history | Art. 6(1)(b) — contract; Art. 6(1)(c) — obligation to confirm on a durable medium |
| Payment | payment data is processed by Stripe; we receive the e-mail, amount, status and payment ID (no full card details) | Art. 6(1)(b) |
| Invoice for a company | company name, address, tax number or EU VAT number | Art. 6(1)(c) — tax law |
| Accounting and taxes | data from orders and invoices | Art. 6(1)(c) |
| Complaints, withdrawal from the contract, handling claims | data from correspondence | Art. 6(1)(b) and (c); Art. 6(1)(f) — establishing and defending claims |
| Free patterns | e-mail, which pattern was downloaded and when | Art. 6(1)(b) — contract to provide the pattern; Art. 6(1)(f) — statistics of interest in patterns |
| Post-purchase message asking whether the files work and offering help (once, a few days after the purchase, no advertising) | e-mail, order number, purchased products | Art. 6(1)(b) — performance of the contract (support in using the files) |
| Newsletter and marketing e-mails (new patterns, offers, production tips; selection of suggested patterns based on previous purchases) | e-mail, date of consent and its withdrawal, purchased products | Art. 6(1)(a) — consent (given voluntarily with a free pattern or in the cart); withdrawal: the “Unsubscribe” link in every message or an e-mail to hello@sapa-patterns.com |
| Contact form and e-mail | name, e-mail, subject and content of the message | Art. 6(1)(f) — answering the question; Art. 6(1)(b) where it concerns an order |
| Security and operation of the Shop | IP address, browser and device data, server logs | Art. 6(1)(f) — security, protection against abuse |
3. Voluntary provision of data
Providing data is voluntary, but without an e-mail address it is not possible to place an order, create an Account or download a free pattern, and without company details — to receive an invoice for a company. Consent to the newsletter is not a condition for anything.
4. Recipients of data
Data is processed on behalf of the Controller by (processors):
- Cloudflare, Inc. — hosting of the Shop, content delivery network, protection against attacks, visit statistics,
- Neon, Inc. — database (AWS servers in the EU, Frankfurt),
- Amazon Web Services EMEA SARL — storage of product files and images (EU region, Frankfurt),
- Resend, Inc. — sending e-mails (login link, order confirmations, post-purchase messages and newsletter, contact form messages),
- Zoho Corporation B.V. — the hello@sapa-patterns.com mailbox (servers in the EU),
- persons cooperating with the Controller under contracts, including accounting — to the extent necessary to perform their tasks and subject to confidentiality.
Separate controllers are:
- Stripe Payments Europe Ltd (Ireland) — payment processing, including the obligations of a payment institution (e.g. fraud and money laundering prevention); policy: stripe.com/privacy,
- Google Ireland Ltd — when logging in with a Google account; policy: policies.google.com/privacy,
- public authorities — where required by law.
5. Transfers of data outside the European Economic Area
Some providers (Cloudflare, Neon, Resend, Stripe, Google, Amazon Web Services) have their registered office or subprocessors in the USA. Data may be transferred there on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) for entities covered by it, or standard contractual clauses approved by the Commission. A copy of the safeguards can be obtained by writing to hello@sapa-patterns.com.
6. How long we keep data
- orders, invoices and accounting documents — 5 years from the end of the calendar year in which the tax payment deadline expired,
- Account and download history — until the Account is deleted; after deletion, order data is kept for the period stated above,
- complaints and withdrawals — until the limitation period for claims expires,
- newsletter — until consent is withdrawn,
- contact form and e-mail correspondence — until the matter is closed, and then until the limitation period for any claims expires,
- server logs — up to 30 days.
7. Rights of data subjects
Everyone has the right to access their data, to rectification, erasure, restriction of processing and data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing before its withdrawal). Requests: hello@sapa-patterns.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
8. Profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the Customer.
9. Cookies and statistics
The Shop uses only necessary cookies — to maintain the login session and secure forms; the contents of the cart are stored in the browser’s storage. Visits are counted with Cloudflare Web Analytics, which does not use cookies and does not identify users. We do not use advertising or tracking cookies. Cookies can be deleted or blocked in the browser settings; blocking the necessary cookies will make logging in impossible.
10. Changes to the policy
We announce material changes on this page and, to users with an Account, also by e-mail.