Last updated: August 29, 2026
Here you can find out what data is collected by us, why we need it, and what we do with it.
We take your privacy seriously, that's why we encrypt our whole website with SHA256 TLS1.2 SSL technology (https and green lock icon at the beginning of the webpage address). Our e-commerce solution provider - Shopify - is a certified Level 1 PCI DSS compliant. If you have further questions, contact us.
Who is the data controller?
Keyshorts Sebastian Kończak
sole proprietorship entered in the Central Register and Information on Economic Activity (CEIDG), Republic of Poland
Gdańska 141/125
90-536 Łódź
Poland
VAT/NIP: PL8942690598
REGON: 932892563
Email: contact@keyshorts.com
Because Keyshorts is established in Poland, our processing of personal data is generally subject to the EU General Data Protection Regulation ("GDPR"). Depending on where you live, additional local privacy laws may also apply.
What data is collected, how, and for what?
Depending on how you use our website and services, we may process:
- your name;
- email address;
- telephone number;
- billing address;
- shipping address;
- company name and tax/VAT identification number if provided;
- order details and purchase history;
- payment and transaction information;
- correspondence with customer support;
- information required to prepare a customized product, such as your device model, keyboard layout, measurements, photographs, artwork, files, instructions or other specifications;
- information relating to returns, complaints and warranty claims;
- reviews and feedback you submit;
- IP address;
- browser, device and operating-system information;
- website activity, referral information and other technical data;
- cookie identifiers and similar online identifiers;
- information supplied to us by payment, fraud-prevention, shipping or other service providers where necessary to complete or protect a transaction.
We do not receive or store your complete payment card number. Card and other payment details are processed by the applicable payment provider.
Why we process personal data and our legal bases
Orders and performance of contracts
We process your contact, billing, shipping, order and customization information in order to:
- process your order;
- manufacture your products;
- contact you where additional information is needed to complete your order;
- process payment;
- deliver your order;
- provide order-status information;
- process cancellations, returns, complaints and other contractual requests.
The legal basis is Article 6(1)(b) GDPR — processing necessary to enter into or perform a contract with you.
If you do not provide information that is necessary to process and deliver an order, we may be unable to enter into or perform the contract.
Customer service and inquiries
When you contact us, we use the information you provide to answer your question or resolve your request.
Where the communication concerns an existing or proposed order, the legal basis is Article 6(1)(b) GDPR.
For other customer-service communications, the legal basis is our legitimate interest under Article 6(1)(f) GDPR in communicating with customers and users of our website.
Accounting, tax and legal obligations
We process transaction, invoice and accounting information where required to comply with tax, accounting and other legal obligations.
The legal basis is Article 6(1)(c) GDPR — compliance with a legal obligation.
Fraud prevention, security and abuse prevention
We may process transaction, technical and account information to detect and prevent fraud, payment abuse, attacks on our website, misuse of our services and other unlawful activity.
The legal basis is our legitimate interest under Article 6(1)(f) GDPR in protecting Keyshorts, our customers and our services.
Establishing and defending legal claims
We may retain and use relevant transaction, correspondence and other information where necessary to establish, exercise or defend legal claims.
The legal basis is our legitimate interest under Article 6(1)(f) GDPR in protecting and enforcing our legal rights.
Product reviews and customer feedback
We may ask customers for feedback about an order or our customer service.
Where a message constitutes electronic direct marketing or applicable law otherwise requires consent, we send it only on the basis of your consent under Article 6(1)(a) GDPR and the applicable electronic-communications rules.
Where a communication is solely a non-promotional request for feedback and applicable law permits it without consent, our legal basis may be our legitimate interest under Article 6(1)(f) GDPR in evaluating and improving our products and services.
You may object to such communications or withdraw your consent at any time.
Website analytics
Where required by law, we use non-essential analytics only after obtaining your consent.
The legal basis for personal-data processing associated with these technologies is Article 6(1)(a) GDPR.
You can withdraw or change your consent at any time through the Cookie Settings available on our website.
Data transfers and automated decision-making
Keyshorts is established in Poland, but some of the service providers we use operate internationally.
Personal data may therefore be processed outside Poland or outside the European Economic Area ("EEA"), including in countries such as Canada and the United States.
Where the GDPR requires protection for an international transfer, we use the transfer mechanism applicable to the particular recipient, which may include:
- a European Commission adequacy decision;
- the European Commission's Standard Contractual Clauses ("SCCs");
- approved Binding Corporate Rules ("BCRs");
- another transfer mechanism permitted by Chapter V GDPR.
We use the following services:
- Shopify Inc. (Canada and US) - e-commerce software
- HelpScout (US) - customer service management
- Stripe (US) - credit card processing
- PayPal (US) - payments
- Yotpo (US) - reviews
- Superhuman (US) - customer service
We may also transfer data to the following third parties, which store data in the EU: InFakt, Apaczka, Heroku (a subsidiary of Salesforce), Asendia and their logistics/customs partners, InPost, DPD, DHL, UPS, Mollie. We will share data with these third parties only to the extent necessary to perform services offered by these third parties (accounting, order management, shipping, handling payments).
We may collect, use, retain, and share your information if we have a good faith belief that it is reasonably necessary to: respond to legal process or to government requests; enforce our agreements, terms and policies; prevent, investigate, and address fraud and other illegal activity, security, or technical issues; protect the rights, property, and safety of our customers or others.
Shopify, payment providers and fraud-prevention services may use automated systems to evaluate transactions for indicators of fraud, abuse or security risk.
Depending on the payment service, these systems may flag, delay or reject a transaction.
Some payment or fraud-prevention providers process such information under their own legal responsibilities and privacy policies.
Where a decision controlled by Keyshorts is based solely on automated processing and produces legal effects or similarly significantly affects you, and applicable law gives you the right to obtain human intervention or challenge the decision, you may contact us at contact@keyshorts.com.
Data retention
We keep personal data only for as long as necessary for the purpose for which it was collected and for any additional period required by applicable law.
In particular:
- Order and contract information is retained for the period necessary to perform the contract and afterwards for the period necessary to handle complaints, claims and applicable limitation periods.
- Invoices, accounting and tax records are retained for the periods required by Polish tax and accounting law, generally for at least five years calculated according to the applicable statutory rules.
- Customer-service correspondence is retained for as long as necessary to resolve the matter and, where relevant, for the period necessary to establish or defend legal claims.
- Customization files, photographs and artwork are retained for as long as necessary to manufacture and support your order and may be retained afterwards where reasonably necessary for complaints, remanufacturing, warranty handling or legal claims.
- Cookie and analytics data is retained according to the duration applicable to the particular cookie or service, as shown through our Cookie Settings or the relevant service configuration.
Where information is no longer required, it is deleted or anonymized unless continued storage is required by law.
Cookies
Cookie categories we use
| Category | Purpose | Examples |
|---|---|---|
| Essential | Required for basic website functionality and checkout. | `cart`, `checkout_token`, `secure_customer_sig`, `_shopify_essential` |
| Analytics | Help us understand how visitors interact with our site to improve performance. | Shopify `_landing_page`, `_y` |
| Preferences | Store choices like currency, language, or region to enhance experience. | Shopify Translate & Adapt settings |
Your rights
Subject to the conditions and limitations established by applicable law, you may have the right to:
- obtain confirmation as to whether we process your personal data;
- access your personal data;
- correct inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- receive personal data you provided to us in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller;
- object to processing based on our legitimate interests;
- object at any time to processing for direct-marketing purposes;
- withdraw consent at any time where processing is based on consent;
- exercise applicable rights concerning certain solely automated decisions;
- lodge a complaint with a competent data-protection supervisory authority.
If you object to processing based on our legitimate interests, we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.
An objection to processing for direct marketing is absolute: once you object, we will no longer process your personal data for that purpose.
To exercise your rights, contact us at contact@keyshorts.com.
We may need to verify your identity before acting on a request.
Complaints
You have the right to lodge a complaint concerning our processing of your personal data with:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO), Poland
You may also have the right to lodge a complaint with another competent data-protection authority where applicable.
We encourage you to contact us first at contact@keyshorts.com so that we can try to resolve your concern.
Security
We use appropriate technical and organizational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.
Our e-commerce infrastructure is provided by Shopify, which maintains security measures for its platform and payment environment.
No internet transmission or storage system can be guaranteed to be completely secure.
Third-Party Services
Some services available through our website, particularly payment services such as PayPal or Shop Pay, may involve a direct relationship between you and the third-party provider.
Where a third party determines independently how and why it processes your personal data, it acts as an independent controller and its own privacy policy applies in addition to this Policy.
Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, service providers or applicable legal requirements change.
The current version will be published on this page together with its last-updated date.
Material changes will be communicated in an appropriate manner where required by law.
Contact
For questions about this Privacy Policy, our processing of personal data or the exercise of your data-protection rights, contact:
Keyshorts Sebastian Kończak
Gdańska 141/125
90-536 Łódź
Poland
Email: contact@keyshorts.com
