Privacy policy

PRIVACY POLICY

Last updated: August 10, 2026

BUYBAJO (BAJO HANDEL BARBARA BAJOR) operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”).

This Privacy Policy explains how BUYBAJO collects, uses, stores and otherwise processes your personal data when you visit or use our website, purchase our products, use our Services, or otherwise communicate with us.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), BUYBAJO (BAJO HANDEL BARBARA BAJOR) is the data controller of your personal data, except where another entity acts as a controller for specific processing activities.

The Services are hosted and powered by Shopify. Shopify may process personal data on our behalf as a service provider or, in certain circumstances, as an independent controller for its own purposes.

Please read this Privacy Policy carefully to understand how and why we process your personal data and what rights you have in relation to your personal data.

1. DATA CONTROLLER

The data controller is:

BUYBAJO (BAJO HANDEL BARBARA BAJOR)
Stradomska 18/49
31-058 Kraków
Poland

Email: info@buybajo.com
Phone: +48 669 231 502
NIP: 6771090412
REGON: 350833708

If you have any questions about how we process your personal data or wish to exercise your rights, please contact us at info@buybajo.com.

2. PERSONAL DATA WE COLLECT

Depending on how you interact with our Services, we may collect and process the following categories of personal data:

Contact and delivery information, such as your name, email address, telephone number, billing address and delivery address.

Order and transaction information, such as products purchased, returned or exchanged, order number, transaction date, order value and information relating to your purchases.

Payment information, such as payment method, payment status and transaction details. Payment card details may be processed directly by our payment service providers and may not be stored by us.

Account information, if you create an account, such as your login details, preferences and account settings.

Communications, including information you provide when contacting us by email or through customer service.

Device and technical information, such as IP address, browser type, device type, operating system, language settings and other technical identifiers.

Website usage information, including information about how you interact with our website, the pages you visit, products you view and other interactions with our Services.

Cookie and similar technology information, where applicable and in accordance with our Cookie Policy and your choices.

We only collect personal data that is reasonably necessary for the purposes described in this Privacy Policy or otherwise permitted or required by law.

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

  • directly from you when you place an order, create an account, contact us, subscribe to communications or otherwise provide us with your information;

  • automatically when you use our website, including through cookies and similar technologies, where permitted by applicable law;

  • from service providers who process personal data on our behalf;

  • from payment providers, delivery companies and other business partners where necessary to provide the Services or fulfil your order; and

  • from other third parties where permitted by applicable law.

4. HOW WE USE YOUR PERSONAL DATA

We process personal data only for specific and lawful purposes.

Processing and fulfilling orders

We may process your personal data in order to:

  • process and fulfil your orders;

  • process payments;

  • arrange delivery;

  • process returns, refunds and exchanges;

  • provide customer support;

  • communicate with you about your orders; and

  • otherwise perform our contract with you.

The legal basis for this processing is generally Article 6(1)(b) GDPR – processing necessary for the performance of a contract.

Legal and accounting obligations

We may process your personal data where necessary to comply with our legal obligations, including accounting, tax, consumer protection and other legal requirements.

The legal basis for this processing is Article 6(1)(c) GDPR – compliance with a legal obligation.

Security and fraud prevention

We may process personal data to protect our website, customers and business, prevent fraud, detect security incidents and investigate potentially unlawful activity.

Depending on the circumstances, the legal basis may be Article 6(1)(f) GDPR – our legitimate interests, or another legal basis applicable under GDPR.

Customer service and communication

We may process personal data to respond to your enquiries, provide customer support and communicate with you regarding your relationship with us.

Depending on the circumstances, the legal basis may be the performance of a contract, compliance with a legal obligation, or our legitimate interests.

Improving our website and Services

We may process information about how customers use our website in order to maintain, analyse and improve our Services, products and customer experience.

Where applicable, this processing is based on our legitimate interests under Article 6(1)(f) GDPR or, where consent is required, on your consent under Article 6(1)(a) GDPR.

Marketing

We may use your personal data to send marketing communications, such as information about products, promotions and offers, where permitted by applicable law.

Where consent is required, we will send marketing communications only after obtaining your consent. You may withdraw your consent or unsubscribe from marketing communications at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies to operate the website, remember your preferences, understand how the Services are used and, where permitted by law and based on your choices, support analytics and marketing activities.

Some cookies are necessary for the operation and security of the website and cannot be disabled through our cookie settings.

Where consent is required, non-essential cookies will only be used after you provide the required consent.

You can manage your cookie preferences through the cookie consent mechanism available on our website and through your browser settings.

For more information, please refer to our Cookie Policy.

6. WHO WE SHARE PERSONAL DATA WITH

We may disclose personal data to third parties where necessary for the purposes described in this Privacy Policy and where permitted by applicable law.

These recipients may include:

  • Shopify, which provides the e-commerce platform on which our website operates;

  • payment service providers and financial institutions;

  • delivery and fulfilment providers;

  • IT, hosting, cloud storage and technical service providers;

  • customer service and communication providers;

  • accounting, legal and professional advisers;

  • analytics and marketing service providers, where applicable and permitted by law; and

  • public authorities or other entities where disclosure is required by law.

We only provide third parties with access to personal data to the extent reasonably necessary for the relevant purpose, subject to applicable legal requirements and appropriate contractual or other safeguards where required.

7. SHOPIFY

Our online store is powered by Shopify.

Shopify processes personal data relating to your use of our Services in order to provide and maintain the Shopify platform and related services.

Depending on the circumstances and the particular Shopify service or feature involved, Shopify may process personal data on our behalf or may process certain data as an independent controller for its own purposes.

For more information about how Shopify processes personal data and about the rights available to you in relation to processing carried out by Shopify, please refer to https://privacy.shopify.com

8. INTERNATIONAL DATA TRANSFERS

Some of our service providers, including Shopify and other technology providers, may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will ensure that the transfer is carried out in accordance with applicable data protection law and that an appropriate legal transfer mechanism is used where required, such as an adequacy decision or Standard Contractual Clauses.

9. HOW LONG WE KEEP YOUR PERSONAL DATA

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

The retention period depends on the nature of the data and the purpose for which it is processed.

For example:

  • order and transaction information may be retained for the period required by applicable accounting, tax and consumer protection laws;

  • information relating to customer enquiries may be retained for as long as necessary to handle the enquiry and, where appropriate, for a reasonable period afterwards;

  • information processed based on consent may generally be retained until you withdraw your consent, unless another lawful basis for retention applies; and

  • certain information may be retained for longer where necessary to establish, exercise or defend legal claims.

When personal data is no longer required, we will delete it or anonymise it where reasonably possible.

10. YOUR RIGHTS UNDER THE GDPR

Subject to the conditions and limitations set out in applicable law, you may have the following rights:

Right of access – you may request access to your personal data and information about how we process it.

Right to rectification – you may request correction of inaccurate or incomplete personal data.

Right to erasure – you may request deletion of your personal data in certain circumstances.

Right to restriction of processing – you may request that we restrict the processing of your personal data in certain circumstances.

Right to data portability – where applicable, you may request to receive personal data that you have provided to us in a structured, commonly used and machine-readable format or request that it be transferred to another controller.

Right to object – you may object to certain processing based on our legitimate interests. You have an absolute right to object to the processing of your personal data for direct marketing purposes.

Right to withdraw consent – where we process your personal data based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

These rights are not absolute and may be subject to conditions or exceptions provided by applicable law.

To exercise your rights, contact us at info@buybajo.com.

We may need to verify your identity before fulfilling a request in order to protect your personal data.

We will respond to requests concerning your rights without undue delay and, in principle, within one month of receiving the request, in accordance with applicable law.

11. MARKETING COMMUNICATIONS

If you receive promotional emails from us, you can unsubscribe at any time by using the unsubscribe link included in the relevant communication or by contacting us at info@buybajo.com.

Even if you opt out of marketing communications, we may continue to send you non-promotional communications that are necessary, such as information concerning your order, payment, delivery, returns or other transactions.

12. CHILDREN'S DATA

Our Services are intended for a general audience and are not directed specifically at children.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided us with personal data and you would like us to review or delete that information, please contact us at info@buybajo.com.

13. DATA SECURITY

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration or unlawful processing.

However, no method of transmission or storage can be guaranteed to be completely secure.

14. THIRD-PARTY WEBSITES AND LINKS

Our Services may contain links to websites or services operated by third parties.

If you follow such links, those third parties may process your personal data in accordance with their own privacy policies. We are not responsible for the privacy practices, security or content of third-party websites or services that we do not control.

We recommend that you review the privacy policies of third-party websites before providing them with personal data.

15. COMPLAINTS

If you have concerns about how we process your personal data, please contact us first at info@buybajo.com so that we can review and address your concern.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

As BUYBAJO is established in Poland, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO).

Personal Data Protection Office (UODO) – complaints

The right to lodge a complaint with a supervisory authority is provided by the GDPR and does not prevent you from exercising other legal remedies available to you. citeturn0search0turn0search1

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our processing activities, Services, legal requirements or other operational reasons.

When we make changes, we will publish the updated Privacy Policy on our website and update the “Last updated” date above.

Where required by applicable law, we will provide additional notice regarding material changes.

17. CONTACT

If you have any questions about this Privacy Policy, our privacy practices, or your personal data rights, please contact us:

BUYBAJO (BAJO HANDEL BARBARA BAJOR)
Stradomska 18/49
31-058 Kraków
Poland

Email: info@buybajo.com
Phone: +48 669 231 502
NIP: 6771090412
REGON: 350833708

For the purposes of applicable data protection laws, BUYBAJO (BAJO HANDEL BARBARA BAJOR) is the data controller of your personal data, except where another entity acts as a controller for specific processing activities.