Overview
Natali Borei respects the privacy of every visitor and customer. Below is what personal data we collect, how we use it, and how we protect it when you use the site or place an order.
Data controller
The data controller for this site is NATALI BOREI, owned by Nataliia Ivashchenko, a sole proprietorship registered in Poland (NIP 9571191305, REGON 545106239), registered address: al. Aleja Zwycięstwa 46 lok. 3, 80-210 Gdańsk, Poland. For any question about this policy or your data, contact us at the email in the Contact section below.
What data we collect
- When you place an order: name, email, phone, shipping address fields, optional note, language, and currency.
- When you use the contact form: name, email, subject, and message. Messages go by email only. They are not stored in our database.
- Payment is handled by Stripe. We do not store card numbers.
- Order records are stored in our database. You open an order via a secret access link. There are no customer accounts.
- In your browser: cart, favourites and order references in localStorage. A checkout draft in sessionStorage. Your language (nb-lang), currency (nb-currency) and cookie choice (nb-consent) in cookies.
- Brief technical data such as IP address may be used to rate-limit forms and checkout.
How we use your data
- To create reservations, process payment, and fulfil orders (necessary to perform our contract with you).
- To send order emails with a link to view your order, and so you can contact us about it (necessary to perform our contract with you).
- To reply to messages sent through the contact form (based on our legitimate interest in providing customer support).
- For studio work needed to prepare and ship your order (necessary to perform our contract with you).
- To keep the site running and secure, and to rate-limit abuse (based on our legitimate interest in protecting the site).
Sharing with third parties
We do not sell your personal data. We share only what the shop needs: Stripe for payment, our email provider for transactional email, optionally Telegram for studio order notifications, carriers for delivery, hosting and database providers for the site, Sentry for error monitoring, and Google (Google Analytics / Tag Manager) for site analytics, but only if you allow analytics or marketing cookies in the cookie banner. Some of these providers, including our email provider, Telegram, Sentry, and Google, are established outside the EU/EEA; where that happens, we rely on their EU-US Data Privacy Framework certification or Standard Contractual Clauses as a safeguard.
Cookies & browser storage
The table below lists every cookie and browser-storage item this site uses. Analytics and marketing cookies run only if you allow them in the cookie banner, and you can change your choice anytime via Cookie settings in the footer.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| nb-lang | Cookie | Remembers your selected language. | 1 year |
| nb-consent | Cookie | Stores your cookie-banner choice. | 6 months |
| nb-cart | localStorage | Shopping cart contents. | Until you clear it |
| nb-cart-count | Cookie | Number of items in your cart, so the cart page can show the right placeholder while it loads. | 1 year |
| nb-fav-count | Cookie | Number of favourite products, so the favourites page can show the right placeholder while it loads. | 1 year |
| nb-fav | localStorage | Favourited products. | Until you clear it |
| nb-currency | Cookie | Selected currency (EUR/PLN). | 1 year |
| nb-orders | localStorage | Links to your recent orders, for quick access in the header. | Removed automatically a few days after delivery |
| nb-cart-step | sessionStorage | Current step of the checkout flow. | Until the tab is closed |
| nb-checkout-draft | sessionStorage | Unsaved checkout form draft. | Until the tab is closed |
| nb-purchase-sent | sessionStorage | Prevents a purchase event from being tracked twice. | Until the tab is closed |
| _ga, _gid … | Cookie (third-party) | Site analytics (Google Analytics / Tag Manager). | Set only if you allow analytics cookies. See Google's own cookie policy for exact names and durations. |
Data retention
Unpaid reservations expire after about one hour. Paid orders stay in our database for up to 5 years, to meet Polish tax and accounting record-keeping requirements. Until then, the link from your order email still opens the order page, so you can check status and write to us about it. Contact-form messages are handled by email only. Order shortcuts in the header are removed automatically a few days after delivery, or when a reservation ends. Cart, favourites, currency, and language stay until you clear them. The checkout draft is session-only.
Your rights
You have the right to access, correct, delete, or restrict the processing of your personal data, to receive a copy of it in a portable format, and to object to processing based on legitimate interest. Where processing relies on your consent (analytics and marketing cookies), you can withdraw it at any time via the cookie settings link in the footer. We respond to requests within one month. If you believe your data has been processed unlawfully, you can lodge a complaint with the Polish data protection authority (Urząd Ochrony Danych Osobowych, uodo.gov.pl) or the supervisory authority in your own EU country of residence.
Contact
For privacy questions: info@natali-borei.com
Still have questions?
Write to us - we'll answer everything about privacy and data processing.
Get in Touch