Privacy policy
Last updated: August 12, 2026
1. General Information
This Privacy Policy explains how personal data is processed when you visit or use the Rose on Fire online store available at:
The data controller is:
Roman Kuźniak TOSIA
ul. Ogrodowa 3
63-800 Gostyń
Poland
NIP: 6961022655
REGON: 410260755
E-mail: store.roseonfire@gmail.com
Telephone: +48 663 676 907
The Seller operates the store under the Rose on Fire brand.
2. Personal Data We Process
Depending on how you use the Store, we may process:
- first and last name,
- e-mail address,
- telephone number,
- delivery address,
- billing address,
- order and purchased product information,
- payment and transaction information,
- information provided when you contact us,
- IP address,
- information about your device and browser,
- information concerning your use of cookies and similar technologies.
We do not store full payment card details where payment is processed by an external payment provider.
3. Sources of Personal Data
We may obtain personal data:
- directly from you, for example when you place an order or contact us;
- automatically when you use the Store, including through cookies and similar technologies;
- from service providers acting on our behalf where necessary to fulfil your order or operate the Store.
4. Purposes and Legal Bases for Processing
Order Fulfilment
We process personal data to accept and fulfil orders, process payments, arrange delivery, handle returns and process complaints.
The legal basis is Article 6(1)(b) GDPR, processing necessary for the performance of a contract.
Legal Obligations
We may process personal data to maintain accounting and tax records and to comply with other legal obligations.
The legal basis is Article 6(1)(c) GDPR.
Communication
If you contact us by e-mail, telephone or through a contact form, we process the information you provide in order to respond to your enquiry and provide customer support.
The legal basis is Article 6(1)(f) GDPR, our legitimate interest in communicating with customers and handling enquiries.
Legal Claims
We may process personal data to establish, exercise or defend legal claims and to protect our rights.
The legal basis is Article 6(1)(f) GDPR.
Marketing
If you have consented to receive marketing communications, we may use your e-mail address to send information about products, new collections, promotions and other marketing materials.
The legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Shopify
Our online Store operates using Shopify.
Shopify provides the technical infrastructure for the Store and may process personal data in connection with your use of the Store, orders and related services.
Information about Shopify's processing of personal data is available in Shopify's Privacy Policy.
As part of Shopify's services, personal data may be transferred to or processed outside the European Economic Area in accordance with the safeguards and mechanisms used by Shopify.
6. Service Providers and Recipients
Personal data may be shared with service providers necessary to operate the Store, including:
- Shopify,
- payment providers,
- courier and delivery providers,
- InPost where InPost Parcel Locker delivery is selected,
- IT and hosting providers,
- accounting service providers,
- customer service providers,
- marketing service providers where we use such services and where permitted by law.
Personal data may also be disclosed to competent public authorities where required by law.
7. Payments
Payments may be processed by external payment providers.
Depending on the payment method selected, information necessary to complete the transaction may be provided to the relevant payment provider.
Payment providers process personal data in accordance with their own privacy policies and applicable law.
8. Delivery and InPost
If you select InPost Parcel Locker delivery, information necessary to fulfil the delivery may be provided to InPost.
This may include:
- your name,
- telephone number,
- e-mail address,
- the selected Parcel Locker and related delivery information,
- shipment information.
This processing is necessary to provide the delivery method selected by you.
9. Cookies
The Store uses cookies and similar technologies.
Cookies may be used to:
- ensure that the Store operates correctly,
- remember settings and preferences,
- operate the shopping cart and checkout,
- maintain security,
- analyse the use of the Store,
- conduct marketing activities where such tools are used.
Some cookies are necessary for the operation of the Store and cannot be disabled without affecting its functionality.
Where consent is required for certain cookies, you will be asked to provide consent through the relevant mechanism available on the Store.
10. Data Retention
We retain personal data for no longer than necessary for the purpose for which it was collected, taking into account applicable legal retention requirements. Data should not be retained indefinitely and retention periods should be linked to the relevant processing purpose.
In particular:
- order-related data is retained for the period necessary to fulfil the order, handle returns and complaints and comply with legal obligations;
- accounting and tax records are retained for the period required by applicable law;
- information relating to customer enquiries is retained for the period necessary to handle the enquiry;
- data processed on the basis of marketing consent is retained until consent is withdrawn or the purpose of processing ends, subject to any applicable legal obligations.
11. Your Rights
Subject to the conditions provided by the GDPR, you have the right to:
- access your personal data,
- obtain a copy of your personal data,
- correct inaccurate data,
- request erasure of your data,
- request restriction of processing,
- request data portability,
- object to processing where provided by law,
- withdraw consent where processing is based on consent.
The scope of these rights depends on the legal basis and circumstances of the processing.
To exercise your rights, please contact us at:
We may request information necessary to verify your identity where reasonably required to protect personal data.
12. Right to Lodge a Complaint
If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the competent data protection supervisory authority.
In Poland, the supervisory authority is:
President of the Personal Data Protection Office (UODO)
UODO confirms that individuals may lodge a complaint where they believe that data protection rules have been violated.
13. Data Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction or unauthorised disclosure.
However, no method of transmitting or storing information over the Internet can guarantee complete security.
14. Children's Data
The Store is not intended to knowingly collect personal data from children.
If we become aware that we have received personal data relating to a child without an appropriate legal basis, we will take appropriate action in accordance with applicable law.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, including to reflect changes in applicable law, the operation of the Store or the services we use.
The current version of this Privacy Policy is always available at:
The date of the latest update is stated at the beginning of this document.
16. Contact
If you have any questions about this Privacy Policy or the way we process personal data, please contact us:
Rose on Fire
Roman Kuźniak TOSIA
ul. Ogrodowa 3
63-800 Gostyń
Poland
E-mail: store.roseonfire@gmail.com
Telephone: +48 663 676 907