Privacy policy

Last Updated: 12 March 2026

AF.CRBN, operated by Filip Ambroży, operates this website and online store, including all related websites, content, features, products, services, and customer support functions (collectively, the “Services”).

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, create an account, place an order, contact us, or otherwise use our Services.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and the Polish Act of 10 May 2018 on Personal Data Protection.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The controller of your personal data is:

AF.CRBN – Filip Ambroży
Address: Ożarowska 40/42, Duchnice, 05-850 Poland
Email: sales@afcrbn.com

Business registration details:

NIP/VAT: 5223367846

The Data Controller determines the purposes and methods of processing your personal data.

You may contact us at any time regarding your personal data or the exercise of your rights.

2. Personal Data We Collect

Personal data means any information relating to an identified or identifiable individual.

Depending on how you use our Services, we may collect the following categories of personal data:

Contact and identification data

  • Name and surname
  • Email address
  • Telephone number
  • Billing address
  • Shipping address

Account information

If you create an account, we may process:

  • Username
  • Password (stored securely in encrypted form)
  • Account preferences
  • Saved addresses
  • Order history

Order and transaction information

We may collect:

  • Products purchased
  • Order details
  • Returns and exchanges
  • Delivery information
  • Transaction history

Payment information

Payments are processed through third-party payment providers.

AF.CRBN does not store complete payment card numbers or security codes.

Payment providers may process payment information necessary to complete transactions in accordance with their own privacy policies.

Communication data

When you contact us, we may process:

  • Email correspondence
  • Customer service requests
  • Messages and inquiries

Technical and usage data

When you use our Services, we may automatically collect:

  • IP address
  • Browser type
  • Device information
  • Operating system
  • Website activity
  • Cookie identifiers
  • Interaction with our website

3. Sources of Personal Data

We collect personal data:

  • Directly from you when you create an account, place an order, subscribe to communications, or contact us.
  • Automatically through cookies and similar technologies.
  • From trusted service providers that help us provide our Services.

4. Legal Bases for Processing Personal Data

We process personal data based on the following legal grounds:

Performance of a contract – GDPR Article 6(1)(b)

We process your data when necessary to:

  • Process and complete orders
  • Arrange delivery
  • Handle returns and exchanges
  • Manage your account

Legal obligations – GDPR Article 6(1)(c)

We process certain data to comply with legal requirements, including:

  • Accounting obligations
  • Tax regulations
  • Consumer protection laws

Legitimate interests – GDPR Article 6(1)(f)

We may process data to:

  • Improve our Services
  • Protect our website and customers
  • Prevent fraud
  • Maintain security
  • Handle customer communications

Consent – GDPR Article 6(1)(a)

Where required, we process data based on your consent, including:

  • Marketing communications
  • Newsletter subscriptions
  • Non-essential cookies
  • Personalized advertising

You may withdraw your consent at any time.

5. How We Use Personal Data

We use personal data to:

Provide our Services

Including:

  • Processing orders
  • Managing payments
  • Shipping products
  • Providing customer support
  • Managing accounts

Improve customer experience

Including:

  • Remembering preferences
  • Improving website functionality
  • Providing relevant product recommendations

Marketing communications

Where you have provided consent, we may send:

  • Newsletters
  • Product updates
  • Promotional offers
  • Personalized marketing communications

You may unsubscribe at any time.

Security and fraud prevention

We use data to:

  • Detect suspicious activity
  • Protect customer accounts
  • Prevent unauthorized transactions

Legal compliance

We may process data when required by:

  • Tax authorities
  • Courts
  • Public authorities
  • Applicable law

6. Profiling and Automated Processing

We may use automated processing to improve your shopping experience, including:

  • Product recommendations
  • Personalized content
  • Marketing customization

Such processing is used only to improve our Services and does not create legal effects concerning you.

You may object to certain forms of profiling where applicable under GDPR.

7. Sharing Personal Data

We may share personal data with trusted third parties that provide services necessary to operate our business.

These may include:

E-commerce platform providers

  • Shopify or other website infrastructure providers

Payment providers

  • Payment processors used to complete transactions

Delivery providers

  • Courier and logistics companies

Technology providers

  • Hosting providers
  • IT support providers
  • Security providers

Marketing providers

Where you have provided consent:

  • Email marketing platforms
  • Advertising platforms
  • Analytics providers

Legal authorities

We may disclose information where required by law or necessary to protect our rights.

All processors are required to process personal data according to applicable data protection laws.

8. International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure appropriate safeguards, including:

  • European Commission Standard Contractual Clauses (SCCs)
  • Transfers to countries recognized as providing adequate protection

9. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.

Typical retention periods include:

Order and transaction data

Stored for the period required by Polish tax and accounting regulations.

Customer accounts

Stored until you request account deletion or the account becomes inactive.

Marketing data

Stored until you withdraw consent or unsubscribe.

Customer communications

Stored only as long as necessary to handle the matter and maintain records.

 


10. Your Rights Under GDPR

You have the right to:

Access

Request information about the personal data we hold about you.

Rectification

Request correction of inaccurate or incomplete data.

Erasure

Request deletion of your personal data where legally possible.

Restriction

Request limitation of processing in certain situations.

Objection

Object to processing based on legitimate interests or direct marketing.

Data portability

Receive your personal data in a structured, commonly used format.

Withdrawal of consent

Withdraw previously provided consent at any time.

Withdrawal of consent does not affect processing performed before withdrawal.

To exercise your rights, contact:

sales@afcrbn.com

We may request verification of your identity before processing your request.

11. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to provide functionality, improve performance, analyze traffic, and support marketing activities.

Cookies may include:

Necessary cookies

Required for website operation, security, shopping cart functionality, and account services.

Analytics cookies

Used to understand how visitors use our website and improve performance.

Marketing cookies

Used to provide relevant advertising and measure campaign effectiveness.

Non-essential cookies are used only after obtaining your consent where required by law.

You can manage cookie preferences through our cookie consent banner or browser settings.

12. Children’s Privacy

Our Services are not intended for children under 16 years of age.

We do not knowingly collect personal data from children.

If we become aware that personal data of a child has been collected without appropriate authorization, we will take steps to delete such information.

13. Security of Personal Data

We apply appropriate technical and organizational measures to protect personal data against:

  • Unauthorized access
  • Loss
  • Misuse
  • Alteration
  • Disclosure

However, no internet transmission or storage system can be guaranteed to be completely secure.

You are responsible for keeping your account credentials confidential.

14. Complaints

If you believe your personal data is processed unlawfully, you may contact us first:

AF.CRBN – Filip Ambroży
Email: sales@afcrbn.com

You also have the right to lodge a complaint with:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO)

Website:
https://uodo.gov.pl

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes in legal requirements
  • Changes to our Services
  • Changes in data processing practices

The updated version will always be published on this website with a revised “Last Updated” date.

Effective Date: 12 March 2026