Last updated: 12 August 2026

This Privacy Policy explains what personal data we collect when you use auradynart.com, why we collect it, who we share it with and what rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is Cukiernia AleTort Jarosław Dyniewicz, a sole proprietorship registered in Poland, ul. Dwernickiego 22/U2, 04-391 Warsaw, Poland, tax identification number (NIP) 8211056131, trading online as AuraDynArt.

For any question about your data, or to exercise any of the rights described in section 7, write to auradynart@gmail.com. We answer within one month.

2. What data we collect

Data you give us

• Order and delivery details — first and last name, email address, delivery address, billing address and, if you choose to provide it, a phone number for the carrier.
• Account details — if you create an account, your email address and password (stored only as an encrypted hash, never in readable form).
• Correspondence — the content of emails you send us, including any photographs you attach to a complaint.

Data we receive automatically

• Payment confirmation data — the result of the transaction, the last four digits of the card and the card brand. We never receive or store your full card number, expiry date or security code. These go directly to our payment provider.
• Technical data — IP address, browser type and version, operating system and the pages you visited, recorded in standard server logs.

We do not collect special category data (such as health, religion, ethnicity or political opinions) and we ask you not to send it to us.

3. Why we use your data, and on what legal basis

• To fulfil your order — producing the print, arranging delivery, sending order confirmations and tracking information. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• To process payment and prevent fraudulent transactions. Legal basis: performance of a contract, Article 6(1)(b), and our legitimate interest in preventing fraud, Article 6(1)(f).
• To handle complaints and returns described in our Refund and Returns Policy. Legal basis: performance of a contract and compliance with consumer protection law, Article 6(1)(b) and (c).
• To meet accounting and tax obligations — issuing and retaining invoices. Legal basis: legal obligation, Article 6(1)(c).
• To keep the website secure and diagnose faults. Legal basis: legitimate interest, Article 6(1)(f).
• To send marketing messages — only if you have separately and explicitly asked us to. Legal basis: consent, Article 6(1)(a), which you may withdraw at any time.

Providing your data is voluntary, but without the order and delivery details we cannot conclude or perform a sales contract with you.

4. Who we share your data with

We do not sell your personal data and we never share it for someone else’s advertising. We share it only with the service providers we need in order to complete your order:

• Gelato and its print production partners — they receive your name and delivery address in order to print and dispatch your order. Depending on where you live, the print is produced in the European Union, the United Kingdom or the United States.
• Carriers — postal operators and courier companies appropriate for the destination country receive the delivery address and, if provided, your phone number.
• WooPayments, our payment provider, which processes the transaction and performs fraud checks.
• Our hosting provider, which stores the website and its database.
• Our accountant and, where required, the tax authorities, in relation to invoices and accounting records.

Each of these providers processes your data only on our instructions and only for the purpose described, under a data processing agreement.

5. Transfers outside the European Economic Area

Because prints are produced close to the delivery address, an order shipped to the United Kingdom or the United States is processed by a print facility located there. In those cases your name and delivery address leave the European Economic Area.

Such transfers take place on the basis of the safeguards permitted by Chapter V of the GDPR — an adequacy decision of the European Commission where one applies to the destination country, or otherwise the European Commission’s Standard Contractual Clauses. You may ask us for details of the safeguards applied to your order.

6. How long we keep your data

• Order and invoice data — for five years from the end of the tax year in which the order was placed, as required by Polish accounting and tax law.
• Complaint correspondence — for the period needed to resolve the claim and for as long as related claims may be brought.
• Account data — until you delete your account or ask us to delete it.
• Server logs — for a short technical period, then deleted or anonymised.
• Marketing consent records — until you withdraw consent.

7. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• rectify data that is inaccurate or incomplete;
• erase your data, where we are not required to keep it for tax or accounting reasons;
• restrict how we process your data;
• data portability — receive the data you gave us in a structured, machine-readable format;
• object to processing based on our legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email auradynart@gmail.com. Exercising them is free of charge.

You also have the right to lodge a complaint with a supervisory authority. Our authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. If you live in another EU or EEA country, you may instead complain to your local data protection authority.

8. Cookies

Our website uses only the cookies it needs in order to work:

• Essential cookies set by WooCommerce, which remember the contents of your cart and keep you logged in during a session. Without them the store cannot function.
• Payment and fraud-prevention cookies set by our payment provider during checkout, which help confirm that a transaction is genuine.

At the date of this policy we do not use advertising cookies, third-party analytics or tracking pixels, and no external tracking scripts run on this website. If that ever changes, we will update this policy and ask for your consent before setting any non-essential cookies.

You can block or delete cookies in your browser settings at any time. Blocking essential cookies will prevent the cart and checkout from working.

9. Automated decision-making

We do not make decisions about you by purely automated means with legal or similarly significant effects, and we do not profile you for advertising purposes. Our payment provider applies automated fraud checks to transactions; if a payment is declined on that basis, you may contact us and we will look into it.

10. Children

Our store is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

The website is served over an encrypted HTTPS connection. Access to order data is limited to the store owner. Payment card details are handled entirely by our payment provider and never reach our servers.

12. Changes to this policy

We may update this policy, for example if we add a new service provider or a new payment method. The date at the top always shows the current version. Material changes will be announced on the website.

13. Contact

Cukiernia AleTort Jarosław Dyniewicz, ul. Dwernickiego 22/U2, 04-391 Warsaw, Poland. NIP 8211056131. Email: auradynart@gmail.com. See also our Terms and Conditions.