Privacy policy
Last updated: August 15, 2025
This Privacy Policy explains how Agata Serge Photography ("we", "us", "our") collects, uses, and discloses personal information when you visit or purchase from our website and online store (the Services).
We operate the Services and are the data controller for personal information processed via the Services. The Services are hosted and powered by Shopify.
Controller: Agata Serge Photography
Privacy contact: shop@agataserge.com
Address: Wierzbowa 40/54, 90-133 Lodz, Poland
If this Privacy Policy conflicts with our Terms of Service, this Privacy Policy governs only with respect to the collection, use, and disclosure of personal information.
1. Scope
This Policy covers personal information we process when you:
- browse or use the Services;
- place an order or create an account (if available);
- contact us (e.g., by email) or otherwise interact with us.
2. Personal information we collect
Depending on how you interact with us and your location, we may collect:
- Contact details (name, email, billing/shipping address, phone number);
- Order & transaction data (items viewed, added to cart, purchased, returned/exchanged, order history);
- Payment information (payment method, billing details, transaction confirmations – card data is processed by payment providers; we do not store full card numbers);
- Account data (login, preferences, settings) if you choose to create an account (feature may not be available in all markets);
- Communications (messages you send to us, support requests);
- Device & usage data (IP address, device/browser information, identifiers, pages viewed, actions on the Services, cookies/SDK identifiers).
Sources. We collect information: (i) directly from you (checkout, account, emails); (ii) automatically via cookies and similar technologies when you use the Services; (iii) from our service providers (e.g., payment, logistics, security), and partners (where permitted by law).
We do not seek to collect special‑category data (e.g., health, biometric or political opinions). Please do not provide such information.
3. How we use personal information (and legal bases)
We use personal information for:
- Providing and operating the Services – to process orders and payments, fulfil and deliver products, manage your account (if you choose to create one), handle returns/exchanges, provide support.
(Legal bases: performance of contract; legitimate interests for service operation; legal obligation for invoicing/tax.)
- Security, fraud prevention and misuse detection – to protect accounts, investigate suspicious or prohibited activity, and keep the Services secure.
(Legal bases: legitimate interests; legal obligation where applicable.)
- Service improvement and analytics – to understand how the Services are used and improve performance and usability (using aggregated or de‑identified data where possible).
(Legal bases: legitimate interests; in the EU/UK we obtain consent for non‑essential cookies/trackers.)
- Communicating with you – order confirmations, shipping updates, support responses, and important service notices.
(Legal bases: performance of contract; legitimate interests for service communications.)
- Marketing (email, ads) – current status. We do not send promotional email or run ad pixels at launch. If we enable these features later, we will do so in compliance with law (e.g., consent for marketing cookies in the EU/UK, and the ability to opt out/unsubscribe at any time).
(Legal bases, if enabled: consent in the EU/UK; legitimate interests where permitted.)
- Legal compliance – to comply with accounting, tax, consumer, and other legal obligations; to respond to lawful requests.
(Legal basis: legal obligation.)
Automated decision‑making. We do not use automated decision‑making (including profiling) that produces legal or similarly significant effects for you.
4. Disclosures and recipients
We share personal information only as needed for the purposes above, with:
- Shopify (store hosting/platform; may also provide analytics and enhanced features);
- Payment processors (to process payments and prevent fraud);
- Logistics & shipping partners (e.g., our fulfilment/returns partner in Poland and parcel carriers) to pick, pack and deliver orders, and handle returns;
- IT/communications providers (email delivery, cloud services);
- Security/anti‑fraud providers (where used);
- Professional advisors (legal/accounting) where necessary;
- Authorities or other third parties where required by law, to protect rights, or in connection with a business transaction.
We do not sell or rent your personal information.
5. Relationship with Shopify
Because the Services are hosted by Shopify, Shopify collects and processes personal information about your use of the Services to provide and improve them. In some cases (e.g., certain analytics or network‑level features across merchants), Shopify acts as an independent controller and is responsible for those processing activities and for responding to rights requests related to them. See Shopify Consumer Privacy Policy (https://www.shopify.com/legal/privacy) and Shopify Privacy Portal (https://privacy.shopify.com) for details.
6. International transfers
We may transfer personal information to countries outside your country of residence (e.g., to the EU/EEA, UK, US, Canada). When transferring from the EEA/UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or UK‑approved equivalents, plus supplementary measures where appropriate.
7. Cookies and similar technologies
We use essential cookies to make the site work (e.g., to keep your cart). In the EU/UK, we obtain your consent for any non‑essential cookies/trackers (e.g., analytics/advertising). You can manage or withdraw your choices at any time via our cookie banner or settings. The banner offers “Accept all”, “Decline all” and “Save my choices” controls.
Cookie categories we use:
|
Category |
Purpose |
Status / notes |
|
Required (Essential) |
Core site functions (security, cart, checkout). |
Always on; necessary for the Services. |
|
Personalization (non‑essential) |
Remember choices and tailor your experience on a future visit. |
Used only where permitted; in the EU/UK requires consent. |
|
Marketing (non‑essential) |
Personalize or measure ads across sites. |
Not used at launch. If enabled later, will load only with consent in the EU/UK; you can opt out any time. |
|
Analytics (non‑essential) |
Understand and improve how the Services are used. |
Used only where permitted; in the EU/UK requires consent. |
8. Retention
We retain personal information only as long as necessary for the purposes above and to comply with legal obligations. Indicative periods:
- Orders & invoices: retained for up to 5 years (tax/accounting laws) from the end of the relevant fiscal year;
- Customer service and defect/claim communications: up to 6 years (limitation periods) where necessary;
- Accounts (if available): until you delete the account, then minimized/archived as required by law;
- Security logs/basic analytics: typically 12–24 months;
- Marketing data (if enabled): until you withdraw consent or opt out; suppression lists kept to honour opt‑outs.
9. Your rights
Your rights depend on your location and applicable law. Where available, you may have the right to access, correct, delete, restrict or object to processing, withdraw consent (where processing is based on consent), and data portability. You also have the right to object at any time to direct marketing.
- EU/UK: You can exercise these rights by emailing shop@agataserge.com. You also have the right to lodge a complaint with your data protection authority. A list of EU supervisory authorities is available from the European Data Protection Board (https://edpb.europa.eu/about-edpb/about-edpb/members_en).
- US (state privacy laws): We do not "sell" or "share" personal information as defined by applicable US state laws, nor use it for targeted advertising at launch. Where required by law, we honour the Global Privacy Control (GPC) signal as an opt‑out for the browser/device on which it is set. Requests can be sent to shop@agataserge.com.
We may need to verify your identity before acting on a request. You may designate an authorized agent to submit certain requests, subject to verification.
10. Children’s data
The Services are not intended for, and we do not knowingly collect personal information from, children under 16 in the EU/UK or under 13 in the US. If you believe a child has provided personal information to us, please contact shop@agataserge.com so we can delete it.
11. Security
We use appropriate technical and organizational measures designed to protect personal information. However, no security controls are perfect and we cannot guarantee absolute security. Please use unique, strong passwords and keep your account details confidential.
12. Changes to this Policy
We may update this Policy from time to time to reflect changes to our practices or for legal/operational reasons. We will post the revised Policy here, update the "Last updated" date, and provide additional notice where required by law.
13. Contact
Questions, requests or complaints about privacy: shop@agataserge.com
For certain processing where Shopify acts as an independent controller, please refer to Shopify’s privacy materials noted above.