Privacy Policy

Effective Date: 01.06.2025

Welcome to Craftworks. We take your privacy seriously and are committed to protecting the personal data you share with us. This Privacy Policy outlines how we collect, use, and protect your information in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Who We Are

Craftworks Sp. z o.o.
Registered in Poland
KRS: 0001162316
Email: [email protected]

We provide a commerce platform that enables retailers to place product orders which are routed to producers for manufacturing.

2. Data We Collect

From Customers (Buyers):

• Full name
• Shipping address
• Email address
• Phone number (if provided)
• Order details

Note: We do not collect or store payment information directly. All payments are processed externally by third-party providers.

From Retailers and Producers:

• First and last name
• Email address
• Company name
• Company type (Retailer or Producer)

3. How We Use Your Data

We process your data to:

• Fulfill and manage orders
• Route order information to producers for manufacturing
• Contact you about your order
• Provide operational communications
• Maintain platform security

Legal basis: Processing is carried out under legitimate interest (e.g., fulfilling an order, operational communication) or as required to perform a contract.

4. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing or unrelated purposes.

We do not allow vendors or producers access to customer personal data unless required to fulfill an order (e.g., for warranty or remanufacturing purposes).

5. Cookies and Analytics

Our site uses cookies and similar technologies for basic functionality and analytics. We use Vercel Analytics to understand website performance, without tracking individual user identities.

You can control or disable cookies via your browser settings.

6. Data Retention

We retain order-related personal data for up to 1 year, or longer if required for warranty or legal compliance.

7. Security

We take appropriate technical and organizational measures to protect your data. These include:

• TLS encryption for data in transit
• Secure password storage (encrypted)
• Access controls to platform services

Authentication and data services are provided via Supabase, hosted within the EU.

8. Your Rights

If you are an EU resident, you have the following rights under GDPR:

• Access to your personal data
• Rectification of inaccurate data
• Erasure of your data ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing

To exercise these rights, contact us at [email protected].

9. International Transfers

We strive to keep all data hosted within the EU. Services like Supabase and Vercel are selected with data residency and GDPR compliance in mind.

10. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact:

Data Protection Contact
Email: [email protected]

You also have the right to lodge a complaint with your local data protection authority.

We may update this Privacy Policy periodically. We encourage you to review it regularly to stay informed of changes.