Privacy Policy

This Privacy Policy explains how I Love KURA handles personal data on this website.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

SAVELIA COMPANY Sp. z o.o.
ul. Święty Marcin 29/8
61-806 Poznań
Poland

Represented by: Katarzyna Zięciak
Email: info@ilovekura.eu
Phone: +48 660 858 878

2. General Information

Protecting your personal data matters to us. We treat it confidentially and in accordance with the GDPR and the applicable national data protection rules.

Personal data means any information relating to an identified or identifiable natural person.

3. Data collected when you visit this website

Server log files. When you access our website, technical information is recorded automatically: IP address, date and time of access, browser type and version, operating system, referrer URL, pages viewed, and the hostname of the accessing device.

This data serves technical stability, security, error analysis and the prevention of misuse.
Legal basis: Art. 6(1)(f) GDPR.
Retention: [7 / 30] days, after which the data is deleted or anonymised.

Hosting. Our website is hosted by an external service provider, [hosting provider name, address, country]. Personal data may be processed on the provider’s servers. The provider acts solely on our instructions under a data processing agreement pursuant to Art. 28 GDPR.
Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.

4. Contacting us

If you contact us by e-mail, contact form or telephone, we process your name, contact details and the content of your message in order to deal with your enquiry.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Retention: until your enquiry has been dealt with, and at most [24] months, subject to statutory retention obligations.

5. Customer Account and Orders

When you register or place an order, we process: first and last name, billing address, delivery address, telephone number, e-mail address, order data, payment status and order history.

We use this data for performance of the contract, delivery, invoicing, customer service and handling withdrawals and complaints.

Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for accounting and tax records.
Retention: for the duration of the business relationship. Accounting records are kept for the applicable statutory periods — in Poland, generally five years from the end of the relevant tax year.

6. Payment service providers

Payments are processed by external providers, depending on the method you choose: [list the providers actually used, with full company name and registered office].

Payment details are transmitted directly to the relevant provider. We do not receive complete card or bank account details. The provider’s own privacy policy applies in addition to this one.

7. Carriers

To deliver your order, we pass the necessary data to our carriers — name, delivery address and, where applicable, telephone number and e-mail address for delivery notifications. Our partners are primarily DPD and GLS, and others depending on the destination country. Only data required for delivery is transmitted.

Legal basis: Art. 6(1)(b) GDPR.

8. Cookies and Consent Management

Our website uses cookies and similar technologies. Full details of the categories, purposes and retention periods are set out in our Cookie Notice.

Cookies that are not strictly necessary are set only with your express consent.

Legal basis: Art. 6(1)(a) GDPR, together with the national rules implementing Article 5(3) of the ePrivacy Directive in your country of residence.

You can withdraw or change your consent at any time, with effect for the future, using the “Cookie settings” link in the footer.

9. Web analytics

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which allows us to analyse how visitors use the site. IP addresses are processed in truncated form.

This is used only with your consent.
Legal basis: Art. 6(1)(a) GDPR.
Retention: [14] months.

10. Advertising and remarketing

This website uses the Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, which allows us to measure advertising campaigns and to show relevant advertising to visitors. Meta and we act as joint controllers under Art. 26 GDPR for the collection and transmission of this data.

This is used only with your consent.
Legal basis: Art. 6(1)(a) GDPR.

11. Newsletter

If you subscribe to our newsletter, we use your e-mail address to send you information about products, offers and news.

Subscription uses a double opt-in procedure: after signing up you receive a confirmation e-mail, and you are added to our mailing list only once you confirm. The subscription, the confirmation and their timestamps are logged.

You can unsubscribe at any time using the link in every message or by writing to us.
Legal basis: Art. 6(1)(a) GDPR.
Provider: [name and registered office of your e-mail tool].

12. Transfers outside the European Union

Using certain services may involve transferring personal data to countries outside the European Union, in particular the United States.

Where this happens, the transfer is based on appropriate safeguards under Chapter V GDPR:

an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework), where the recipient is certified
the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR, supplemented by additional measures

A copy of these safeguards is available on request.

13. Categories of recipients

Your data may be disclosed to our hosting and IT providers, payment service providers, carriers, accountants, analytics and advertising providers (only with your consent), and to public authorities where we are legally required to do so. All processors are bound by contract under Art. 28 GDPR.

14. Retention

We keep personal data only for as long as necessary for the purposes described, or for as long as statutory retention obligations require. Commercial and tax records are retained for the applicable statutory periods and then deleted.

15. Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16. Your rights

You have the right at any time to:

access your data (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
object (Art. 21 GDPR)
withdraw consent with effect for the future (Art. 7(3) GDPR)
lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise any of these rights, simply write to info@ilovekura.eu. We respond within one month, which may be extended by a further two months for complex requests.

You may lodge a complaint with the supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement. Contact details for all EU supervisory authorities are available at edpb.europa.eu.

17. Right to object under Art. 21 GDPR

Where we process personal data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. You may object to direct marketing at any time, without giving reasons.