Privacy policy

Effective date: 15 October 2026.

Controller and contact

The data controller is Paweł Choszczyk, trading as Creman – Paweł Choszczyk, ul. Stefana Batorego 18/108, 02-591 Warszawa, Polska, NIP 9522260213. We operate the Reflective store at reflective.ooo and manufacture lamps under this brand. Business information: creman.eu.

For data-related matters and to exercise your rights, email hello@reflective.ooo or write to the address above. Manufacturer information and contact: creman.eu.

This policy explains data processing when you purchase, contact us and use the store. Reading it or accepting the terms does not mean consenting to optional analytics or advertising.

Data and its sources

Purchase and delivery: name, contact details, delivery and billing addresses, company details and tax identification number if provided, products and variants, amounts, settlement information and order, payment and shipment statuses. You enter card details through the payment provider’s system; we use transaction information to process your order.
Customer account: identification and contact details, order history and information required to sign in and use account functions.
Contact, returns and complaints: contact details, the content of the matter, information identifying the purchase, the problem description and any photographs you provide. Supply only the data needed for the matter.
Store use: IP address, device and browser information, pages visited, visit time, referral source, session/cookie identifiers and interactions such as clicks, scrolling and shopping events. The scope of optional measurement depends on your privacy choices.
Privacy choices: information needed to remember your choice and demonstrate that consent was given, refused or withdrawn.

We receive data from you, your browser and providers involved in delivering services, such as transaction status from the payment provider or parcel status from DPD. If a purchaser names you as the recipient or contact person, we receive your data from them to the extent needed to arrange delivery and contact you.

Purposes and legal bases

The legal bases below refer to Article 6(1) of the GDPR.

Purpose	Legal basis
Pre-purchase arrangements at your request, ordering, payment and delivery	Performance of a contract or steps before entering into it — point (b)
Customer account operation	Performance of the account agreement — point (b)
Settlements, invoices and required tax documents	Legal obligation — point (c)
Withdrawal, complaints and exercise of customer rights	Performance of a contract and legal obligations — points (b) and (c), depending on the activity
Other correspondence, contact with a company representative or nominated recipient	Legitimate interest in responding, managing the relationship and arranging delivery — point (f)
Security, store maintenance and investigating faults or misuse	Legitimate interest in protecting services and users — point (f)
Optional Clarity behaviour analytics and Shopify visitor measurement	Consent — point (a), together with consent for device technologies where required
Measuring Meta advertising effectiveness and tailoring advertisements, including advertising profiling	Consent — point (a), together with consent required for device technologies
Remembering and documenting privacy choices and handling rights requests	Relevant legal obligations — point (c); protection against claims where necessary — point (f)
Establishing, pursuing or defending claims	Legitimate interest in protecting rights — point (f)

Marketing consent is not needed to send order data to BaseLinker and DPD to perform the contract. Purchasing is not conditional on optional consent. We do not send email marketing solely because you provided your email address when ordering or making an enquiry.

Providing data is voluntary, but data marked as required is necessary for the chosen service: we cannot send a parcel without a delivery address or respond to a request without contact details. The requirement to provide certain billing data arises from law. Refusing optional analytics or advertising does not prevent a purchase.

Recipients and services used

We share data to the extent necessary for the relevant purpose:

Shopify — store infrastructure, cart, account, orders, forms, system messages and store performance measurement. Shopify generally processes data on our behalf; for certain services and purposes of its own it may act as a separate controller, as described in Shopify’s information.
BaseLinker (Base), BaseLinker sp. z o.o. — order and shipment handling. Orders pass from Shopify to BaseLinker, after which we send the data needed for dispatch and delivery to DPD Polska sp. z o.o. This includes, in particular, recipient details, address, telephone/email and shipment information. DPD also acts as a separate controller for its transport services and its own obligations.
Shopify Payments, PayPal and Klarna, banks and entities involved in settling the selected payment — data needed for the transaction. Providers may act as separate controllers for their own financial, security or fraud-prevention obligations.
inFakt — invoicing and accounting; Microsoft 365/Outlook — business correspondence; OneDrive — documentation backups.
Microsoft, through Clarity — measuring behaviour on the website, click and scroll maps and session replays to identify problems and improve the store. Microsoft receives the technical data and interactions described in this policy. Depending on the consents given, processing may also include Microsoft advertising purposes described in its privacy statement.
Meta Platforms Ireland Limited — Meta Pixel, advanced matching and the Conversions API: measuring events and advertising effectiveness and tailoring advertisements in Meta services. The “Maximum” data-sharing level is enabled. In addition to browser events, the integration transmits events server-side; customer contact and identification data may be used for matching. Data includes device information, identifiers and website events, such as product views, adding to cart and purchases. Meta may link activity to a profile in its services if it recognises the user.
Providers of store technical support, accounting or legal assistance, within the scope of the work entrusted to them, and authorised public authorities on an appropriate legal basis.

Provider information: Shopify, Base, DPD, PayPal, Klarna, Microsoft, Meta. You may ask us for information about the recipients of your data.

Shopify Network Intelligence

Shopify Network Intelligence is enabled in the store. Shopify uses information about interactions with the store together with data from other stores on its platform to improve services, personalisation and advertising matching. Other merchants do not receive access to your data. For these services, Shopify also acts as a separate controller under its Consumer Privacy Policy. Shopify takes account of choices communicated through our consent mechanism. You may also exercise your rights directly with Shopify through its privacy portal.

Transfers outside the EEA

Shopify, Microsoft and Meta services use international infrastructure. This may involve transferring data, or allowing access to it, outside the European Economic Area, particularly in the United States.

Shopify’s data processing terms describe binding corporate rules for transfers from the EEA between Shopify companies and standard contractual clauses for relevant other transfers. A transfer requires a basis under Chapter V of the GDPR, such as an applicable European Commission decision or appropriate safeguards. EU–US Data Privacy Framework certification may serve as a basis only for the recipient and scope actually covered by it.

You may request information about the basis for a particular transfer and a copy of the relevant safeguards at hello@reflective.ooo; protected information may need to be appropriately redacted from the copy.

Retention periods

We keep data needed to fulfil an order for the period of fulfilment and handling of associated obligations. Afterwards, we retain only the data needed for accounting, legal obligations or the protection of claims.
Tax documentation is generally retained for 5 years from the end of the year in which the tax payment deadline expired. Suspension or interruption of limitation periods and specific provisions may extend the applicable period.
We retain account data while the account is maintained. Closing an account does not automatically delete order data subject to separate obligations.
We retain correspondence while handling the matter; further retention covers information needed for statutory obligations or the protection of claims. We also keep complaint and return records for the period needed to demonstrate that they were handled properly.
We retain data needed to protect claims until the applicable limitation period expires or proceedings end and their consequences are settled. As a rule, the periods are 6 years, or 3 years for claims connected with business activity and periodic payments, subject to specific provisions. This does not mean all data is kept for 6 years.
We process optional measurement and advertising data within the limits of consent and for the period needed for that purpose. Microsoft documents a usual Clarity replay availability period of 30 days and longer retention of selected replays and map data for up to 13 months. Retention in the service is separate from cookie validity in the browser.
We retain minimal evidence of consent, withdrawal or objection for the period needed to demonstrate compliance and defend claims. This does not authorise continued measurement or advertising after consent is withdrawn.

Cookies and advertising profiling

Essential technologies enable the cart, payments, sessions, security and the remembering of privacy choices. Optional technologies support Shopify/Clarity analytics and Meta advertising. Reflective does not use Google Analytics.

Optional storage or access to device information requires prior consent where the law requires it. For personal data, we also apply an appropriate GDPR legal basis. Analytics consent alone does not constitute advertising consent. Advertising profiling uses activity and interest in products to tailor advertising or audiences. It does not constitute consent to use all correspondence or billing data for advertising.

Make your choices in the banner and through the “Cookie settings” link. You may refuse optional purposes or change and withdraw consent. Withdrawal does not affect the lawfulness of earlier processing. Details are provided in our Cookie policy.

Your rights

Within the limits of the GDPR, you may:

Access your data, obtain a copy and rectify inaccurate data;
Request erasure or restriction of processing where the relevant conditions apply;
Receive data you supplied on the basis of consent or a contract, processed by automated means, or transfer it to another controller;
Object at any time to direct marketing, including related profiling;
Object, on grounds relating to your particular situation, to processing based on legitimate interests; continued processing requires demonstration of appropriate overriding grounds or a need to protect claims;
Withdraw consent at any time without giving a reason;
Lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or the competent authority in the country of your habitual residence, workplace or the alleged infringement.

Send your request to hello@reflective.ooo. We respond without undue delay, generally within one month. Due to complexity or the number of requests, this may be extended by a further two months; within the first month, we inform you of the extension and its reason. If we have reasonable doubts, we may request necessary information to verify your identity, without collecting excessive data. Exercising your rights is generally free of charge.

Changes

We update this policy when laws, services or processing change. A new version receives a date. Changing the document does not replace required consent or permit data to be used for an incompatible purpose. We inform you of material changes affecting your data as required by law.