Umbray Store — Privacy Policy
This is an English translation provided for convenience. The Polish version (Polityka prywatności) governs in case of any discrepancy.
Last updated: 27 September 2026
1. Data controller
The controller of personal data collected through the umbray.store online store is Anton Abrosymov, Tax ID (NIP): 5273108667, registered address: Józefa Sowińskiego 25/250, 01-105 Warszawa ("the Controller").
For any questions about personal data, contact: hello@umbray.store.
2. What data we collect
When you place an order, we collect: name, delivery address, email address, phone number (if provided), and — if you request an invoice — your Tax ID and company name. We do not store payment card data ourselves; this is processed exclusively by our payment provider, Stripe.
When you subscribe to our mailing list, we collect your email address and, optionally, your first name.
While browsing the site, technical data (IP address, device and browser type) may be collected automatically through cookies — see section 7.
3. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Order fulfillment (acceptance, payment, shipping, complaints/returns handling) | Art. 6(1)(b) GDPR — performance of a contract |
| Issuing invoices and meeting tax/accounting obligations | Art. 6(1)(c) GDPR — legal obligation (tax and accounting law) |
| Sending the newsletter about new lamps and behind-the-scenes updates | Art. 6(1)(a) GDPR — consent (may be withdrawn at any time) |
| Handling inquiries and correspondence | Art. 6(1)(f) GDPR — legitimate interest of the Controller |
| Establishing, exercising, or defending legal claims | Art. 6(1)(f) GDPR — legitimate interest of the Controller |
4. Who we share data with
Personal data may be shared with the following recipients, strictly as needed for the purposes above:
- Stripe (Stripe Payments Europe, Ltd.) — online payment processing.
- Resend — sending transactional emails (order confirmations) and the newsletter.
- Carriers / postal operators (e.g. InPost, courier services, Poczta Polska) — the address data needed for delivery.
- Our accounting office — data appearing on accounting documents.
- Vercel Inc. — website hosting.
- Public authorities — only where required by law.
5. Transfers outside the European Economic Area
Some of the providers listed above (notably Stripe and Resend) may process data on servers located outside the European Economic Area (e.g. in the United States). Any such transfer relies on the European Commission's Standard Contractual Clauses or another GDPR-recognized safeguard ensuring an adequate level of data protection.
6. Retention periods
- Order and accounting-related data — for the period required by Polish tax and accounting law (generally 5 years from the end of the tax year in which the tax obligation arose).
- Data processed on the basis of consent (newsletter) — until consent is withdrawn.
- Data processed to establish or defend legal claims — until the relevant claims become time-barred.
7. Cookies
The Store uses cookies necessary for it to function correctly (e.g. keeping your cart and checkout session). You can change your cookie settings at any time in your browser.
8. Your rights
You have the right to: access your data, rectify it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest, and — where processing is based on consent — withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, contact us at hello@umbray.store.
You also have the right to lodge a complaint with the supervisory authority:
Urząd Ochrony Danych Osobowych (UODO) — Poland's data protection authority ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland Email: kancelaria@uodo.gov.pl · Phone: +48 22 531-03-00
9. Data security
The Controller applies appropriate technical and organizational measures (including encrypted HTTPS connections and restricted data access) to keep personal data secure.
10. Changes to this policy
This Privacy Policy may be updated from time to time, in particular following changes in the law or in the services we offer. The current version is always available at umbray.store.