Privacy policy
- We collect only the data we need to take, send and account for your order.
- We use no advertising or analytics cookies and send no newsletter.
- We don't sell data. We pass it only to companies that help us run the shop, such as payments and couriers (section 3).
1. Who processes your data
The controller is Blackfinch Sebastian Szczygieł, VAT EU ID: PL8512988148, registered office: ul. Twarda 18, 00-105 Warszawa, who runs the shop at steelnoir.com. For anything about your data, write to contact@steelnoir.com. We are a Polish company, so the GDPR and Polish law apply on both sites; the supervisory authority remains the President of the UODO (section 4). We have not appointed a data protection officer.
2. What data, why and for how long
| Why | What data | Legal basis | How long |
|---|---|---|---|
| Taking and fulfilling your order: payment and delivery | name, e-mail, phone, address or pick-up point, the products ordered | the contract (GDPR art. 6(1)(b)) | until the contract is performed, then as in the rows below |
| Receipts, invoices and accounts | the order data; for an invoice, the company name and VAT or tax number | a legal obligation: tax and accounting law (GDPR art. 6(1)(c)) | 5 years from the end of the year in which the tax fell due |
| Returns, withdrawals from the contract, complaints and any disputes | the order data and our correspondence; for a withdrawal made through the shop's page, the name, e-mail, order number and what you typed, to handle it and as proof that it was made | the contract and our legitimate interest (GDPR art. 6(1)(b) and (f)) | until claims are time-barred, at most 6 years from the end of the year |
| Answering your messages | e-mail or phone number and the message | our legitimate interest: answering your question (GDPR art. 6(1)(f)) | until the matter is settled; if it concerns an order, as above |
| Pick-up point search | the address or town you type | your request before a contract (GDPR art. 6(1)(b)) | we don't store it; the search result is gone after 24 hours at most |
| Protecting the shop from attacks | IP address | our legitimate interest: security (GDPR art. 6(1)(f)) | not recorded on a normal visit; addresses of blocked, suspicious connections up to 90 days |
Giving your data is voluntary, but without the order form's data we can't take or send your order. We don't profile you or make automated decisions about you.
3. Who receives your data
- PayPro SA (Przelewy24), ul. Pastelowa 8, 60-198 Poznań: payments. Przelewy24 also processes the data you give on its payment page under its own rules.
- Stripe Payments Europe, Limited (Ireland): payments on steelnoir.com. You enter your card details on Stripe's payment page, not with us; we also send Stripe your e-mail address and order number. Stripe processes them as a separate controller, also under its own rules.
- DPD: delivering the parcel (name, phone, e-mail, address or pick-up point).
- OpenStreetMap (Nominatim): shows on the map the address you type when you look for a pick-up point. It gets only the address, not your IP address.
- Companies that run parts of the shop for us: servers and e-mail in the European Union, the parcel broker through which we order labels, our accounting office.
- Public authorities, where the law requires it.
Your data stays in the European Economic Area, with two exceptions. The first is payments on steelnoir.com: Stripe Payments Europe, Limited may pass data to Stripe group companies in the United States and other countries outside the EEA, under the EU-US Data Privacy Framework and standard contractual clauses. The second is the pick-up point map. OpenStreetMap is run from the United Kingdom, which the European Commission recognises as protecting data adequately. Your browser loads the map itself from OpenStreetMap's servers, which see your IP address, as every website you open does.
4. Your rights
You can ask us:
- to see your data and get a copy of it;
- to correct it;
- to delete it, once we no longer have to keep it;
- to restrict its processing;
- to pass the data from your order to you or to another company;
- to stop processing based on our legitimate interest (objection).
Write to contact@steelnoir.com. We answer within a month. You may also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, or to the data protection authority of the country where you live (GDPR art. 77).
5. Cookies
We use only the cookies the shop can't work without: the basket, form protection and the language you chose. We use no advertising or analytics cookies, so we don't ask for consent.
| What it is for | Expires after | Name |
|---|---|---|
| Remembers what is in your basket and the discount code you entered. | 30 days | __Host-sn_basket |
| Protects the forms from being sent from another website. | 30 days | __Host-sn_csrf |
| Remembers the language you chose for the site. Set only when you change the language. | 365 days | __Host-sn_ui |
YouTube videos on product pages load only when you click them, from youtube-nocookie.com. From then on Google's privacy rules apply. You can delete or block cookies in your browser; without them the basket and checkout won't work.
6. Changes
When we change how we process data, we publish a new version of this policy. Earlier versions are available on this page. The rules for buying are in the Terms.