Privacy policy

Last updated: October 4, 2026

1. Personal Data Controller

The Controller of your personal data is:

Jagoda Adamik-Borowska, operating as a sole proprietor under the business name Riad Loom

22/207 Księdza Jerzego Popiełuszki St., 80-864 Gdańsk

Tax ID (NIP): 945 216 03 33, Business Registration Number (REGON): 381957062

Email: hello@riadloom.com

Phone: +48 504 582 942

(hereinafter: “Controller” or “Store”). The Store operates at riadloom.com on the Shopify platform.

For all matters regarding personal data, you can contact us at hello@riadloom.com or by mail at the Data Controller’s address.

2. Legal Basis

We process data in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR),
• the Act of May 10, 2018, on the Protection of Personal Data,
• the Act of July 18, 2002, on the Provision of Electronic Services,
• the Electronic Communications Law (with regard to cookies and electronic marketing).

3. What data do we process, for what purpose, and on what legal basis?

Purpose	Scope of Data	Legal Basis	Retention period
Order Fulfillment and Sales Agreement (Shipping, Payment, Order Inquiries)	first and last name, shipping and billing addresses, email, phone number, order details, payment information	Article 6(1)(b) of the GDPR (performance of a contract)	until the contract is fulfilled, and thereafter until the statute of limitations for claims expires
Customer Account Management	contact information, username, password (in encrypted form), order history	Article 6(1)(b) of the GDPR	until the account is deleted
Handling Returns, Contract Cancellations, and Complaints	contact information, order details, content of the request	Article 6(1)(b) and (c) of the GDPR	until the statute of limitations on claims expires
Tax and Accounting Obligations	data from invoices and sales documents	Article 6(1)(c) of the GDPR	5 years from the end of the year in which the tax liability arose (or for the period required by accounting regulations)
Communication with You (contact form, email, phone)	first name, email, phone number, message content	Article 6(1)(f) of the GDPR (our legitimate interest: responding to an inquiry)	until the matter is resolved, and then until the statute of limitations on claims expires
Investigation and Defense of Claims	information needed to prove the facts	Article 6(1)(f) of the GDPR	until the statute of limitations on claims expires
Store Security and Fraud Prevention	IP address, device data, logs	Article 6(1)(f) of the GDPR	in accordance with the time periods used by service providers, not exceeding 12 months
Newsletter (direct marketing via email)	email address, first name (if provided)	Article 6(1)(a) of the GDPR (consent) and Article 10 of the Act on the Provision of Electronic Services	until you withdraw your consent; after you withdraw it, we may retain proof of your consent until the statute of limitations for claims expires (Article 6(1)(f) of the GDPR)
Analytics and Statistics (Google Analytics)	online identifiers, IP address, device information, and in-store activity	Article 6(1)(a) of the GDPR (consent given via the cookie banner)	until consent is withdrawn or the cookie expires

 

4. Voluntary Provision of Data

Providing your data is voluntary, but necessary to place an order, create an account, or complete a transaction. Without it, we cannot enter into or fulfill a contract. Subscribing to the newsletter and consenting to analytical cookies are entirely voluntary and do not affect your ability to make purchases.

5. Data Recipients

Your data may be shared with entities that help us operate our store and fulfill orders:

• Shopify: Shopify International Limited (Ireland) and entities within the Shopify group, which provide the store platform, hosting, and store tools. For certain features (e.g., advanced security and personalization features), Shopify may act as a separate data controller. More information: https://privacy.shopify.com/pl
• Payment processors supporting the payment methods available in the store: Przelewy24, credit/debit card, BLIK, Google Pay, Apple Pay, and Klarna:
  • Shopify Payments is a payment service provided by Shopify in collaboration with payment partners, which supports payments via credit card, BLIK, Google Pay, and Apple Pay. The data necessary to process, verify, and secure payments is transmitted. The provider processes this data in accordance with its own privacy policy: https://privacy.shopify.com/pl
  • PayPro S.A. (Przelewy24), 15 Kanclerska St., 60-327 Poznań. When paying via Przelewy24, your first name, last name, email address, payment amount, payment description, and information necessary to verify and secure the transaction are transmitted. PayPro S.A. processes this data as a separate data controller, in accordance with its own privacy policy: https://www.przelewy24.pl/polityka-prywatnosci
  • Klarna Bank AB (publ) (Sweden), if you choose to pay via Klarna. Klarna processes data as a separate data controller, in accordance with its own privacy policy.
  • Google Ireland Limited (Google Pay) and Apple Distribution International Ltd. (Apple Pay), if you choose these payment methods. They process payment data in accordance with their own privacy policies.
• Courier companies: InPost and DPD Polska Sp. z o.o., to whom we provide your first and last name, shipping address, phone number, and email address to the extent necessary to deliver your package and notify you of its status.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), the provider of Google Analytics, provided that you consent to analytical cookies.
• Shopify Email, a newsletter distribution tool provided by Shopify, provided that you subscribe to the newsletter.
• an accounting firm and legal or tax advisors, if we use their services,
• entities authorized by law (e.g., government agencies).