Privacy Policy

1. General Provisions

This Privacy Policy sets out the rules for the processing of personal data of persons using Dybem and DBM Platform & Shopping, including persons using features related to the purchase and payment for Digital Products.

This Policy applies in particular to persons browsing the Service, placing Orders, making purchases, making payments, downloading Digital Products and contacting the Seller.

The Controller applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

2. Data Controller

The Controller of personal data is Arthur Malinowski, conducting business under the name Design by Malina.

The Controller can be contacted via e-mail at kontakt[at]dbm.org.pl or through the contact form.

The Controller has not appointed a Data Protection Officer, as the obligation to appoint one does not apply to the business conducted by the Controller.

3. Scope of Processed Data

Depending on how the Service is used, the Controller may process in particular:

  • first and last name,
  • e-mail address,
  • address details or country, where required to process an Order,
  • business details, if the Customer makes a purchase as a business,
  • Order details and information about purchased Digital Products,
  • transaction and payment identifiers,
  • information about payment status and refunds,
  • information concerning the country of payment or billing country, where provided by the payment provider,
  • IP address and information concerning the location derived from the IP address, to the extent necessary for specific purposes,
  • technical information concerning the device, browser and use of the Service,
  • the content of correspondence and messages sent to the Controller,
  • information stored in cookies and similar technologies,
  • data necessary to fulfil tax, accounting or anti-fraud obligations.

The Controller does not store full payment card details where such details are entered directly into the payment provider's system and processed by that provider.

4. Purposes and Legal Bases for Processing

Personal data is processed depending on the specific purpose on the basis of one or more legal grounds set out in Article 6 of the GDPR.

4.1. Conclusion and Performance of the Contract

Data is processed for the purpose of handling Orders, concluding and performing the Contract, delivering the Digital Product, processing payments, communicating regarding the Order and handling complaints.

The legal basis is Article 6(1)(b) of the GDPR.

4.2. Legal Obligations

Data may be processed for the purpose of fulfilling obligations arising from tax, accounting, consumer protection and other laws applicable to the Controller's business.

The legal basis is Article 6(1)(c) of the GDPR.

4.3. Legitimate Interests of the Controller

Data may be processed for the purpose of ensuring the security of the Service, preventing abuse and fraud, establishing, pursuing or defending against claims, maintaining documentation and ensuring the proper functioning of the technical infrastructure.

The legal basis is Article 6(1)(f) of the GDPR. The legitimate interests of the Controller include protecting the Controller's business, systems, customers, rights and interests.

4.4. Consent

Where processing requires consent, the legal basis is Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

5. Data Related to Orders and Payments

Data provided when placing an Order is processed for the purpose of properly performing the Contract, delivering the Digital Product, processing payments, issuing required documents and handling complaints, refunds and other matters related to the Order.

In connection with payment processing, the Controller may process a payment identifier, transaction identifier, payment status, amount, currency, Customer data provided to the payment provider and other information necessary to confirm the proper execution of the transaction.

The Controller may also process information concerning the country assigned to a transaction, including the country derived from the IP address, billing or settlement country and the country provided by the payment provider, where such information is available and necessary for the proper fulfilment of legal or tax obligations, transaction security or Order processing.

6. Determination of the Transaction Country and Tax Purposes

In connection with the sale of Digital Products, the Controller may process information concerning the Customer's country and the transaction country for the purpose of correctly determining the applicable tax treatment and fulfilling obligations arising from tax regulations.

Depending on the available information, the following may be taken into account in particular:

  • the country derived from the IP address,
  • the country indicated by the Customer as the billing or settlement country,
  • the payment country or other information provided by the payment provider,
  • the tax country determined on the basis of available evidence and applicable laws,
  • information concerning the source or type of evidence used.

Such data may be stored together with the Order documentation to the extent necessary to demonstrate the correctness of the applied tax treatment and to fulfil tax obligations.

7. Payment Providers

For payment processing, the Controller uses the services of external payment providers, in particular Stripe and Przelewy24, depending on the available payment method, country and currency of the transaction.

A payment provider may receive data necessary to process and verify a payment, including identification data, contact details, Order information and technical or transaction-related information.

A payment provider may also process data independently as a separate data controller, in accordance with its own privacy policy and applicable laws.

The Controller does not store payment card data that would enable an independent subsequent transaction where such data is processed directly by the payment provider.

8. Delivery of Digital Products

The e-mail address provided when placing an Order may be used to send an Order confirmation, payment-related information, information required by law and data enabling access to the purchased Digital Product.

Data relating to the delivery of the Product is processed for the period necessary to properly perform the Contract and handle complaints, refunds and claims.

9. Contact Form and Correspondence

Data provided through the contact form or by e-mail is processed for the purpose of handling the enquiry, conducting correspondence and providing a response.

The legal basis may be Article 6(1)(b) of the GDPR where the contact concerns the performance of a Contract, or Article 6(1)(f) of the GDPR where the contact concerns another matter and processing is necessary to handle the correspondence or protect the Controller's rights.

10. Newsletter and Commercial Information

If the user consents to receiving a newsletter or commercial information, their e-mail address may be used to send information concerning Digital Products, services, news and the activities of Dybem.

Consent is voluntary and is not a condition for concluding or performing a Contract.

The legal basis for processing is the user's consent where such consent is required by applicable law.

Consent may be withdrawn at any time by using the unsubscribe function available in the message received or by contacting the Controller. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

11. Cookies and Similar Technologies

The Service uses cookies and similar technologies to the extent necessary for the proper operation of the Service, maintaining sessions, carrying out the purchasing process, ensuring security and remembering user settings.

Technologies that are not necessary for the provision of the service or the operation of a function requested by the user may be used in accordance with applicable laws after obtaining the required consent.

The user may manage cookie consents using the cookie settings mechanism available on the Service, where provided, as well as through their web browser settings.

Restricting or disabling certain cookies may affect the operation of selected Service functions, in particular functions related to logging in, the shopping cart or the purchasing process.

12. Technical Data and Logs

In connection with the use of the Service, technical data may be processed automatically, such as the IP address, date and time of connection, information concerning the browser, operating system, device, requested resources and error information.

Such data is processed in particular to ensure security, the proper functioning of the Service, detection of abuse, protection against unauthorised access and technical diagnostics.

The legal basis is Article 6(1)(f) of the GDPR, and the legitimate interest of the Controller is to ensure the security and proper functioning of the Service.

13. Recipients of Personal Data

Personal data may be disclosed to entities supporting the Controller in conducting business and operating the Service, in particular:

  • hosting and server infrastructure providers,
  • e-mail service providers,
  • payment providers,
  • IT and technical service providers,
  • providers of tools used to ensure security,
  • entities providing accounting or legal services,
  • public authorities where disclosure of data is required by law.

Processors acting on behalf of the Controller receive access to data only to the extent necessary to provide specific services and on the basis of appropriate agreements or other legal grounds.

14. Transfers of Data Outside the European Economic Area

In connection with the use of certain technology providers or payment providers, personal data may be transferred outside the European Economic Area.

Where such a transfer takes place, the Controller applies an appropriate mechanism provided for by the GDPR, in particular an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses, where applicable.

For example, Stripe identifies mechanisms for data transfers such as the EU-U.S. Data Privacy Framework and Standard Contractual Clauses in its documentation concerning data transfers.

15. Data Retention Period

Personal data is retained for no longer than necessary for the purpose for which it was collected, taking into account the legal obligations applicable to the Controller.

  • Order and Contract data - for the period necessary to perform them and handle complaints and claims;
  • accounting and tax documentation - for the period required by law;
  • data related to pursuing or defending against claims - until the applicable limitation periods expire or the proceedings are concluded;
  • data processed on the basis of consent - until consent is withdrawn, unless further retention is justified by another legal basis;
  • technical data and logs - for the period necessary to ensure the security and technical diagnostics of the Service.

After the applicable retention period expires, data is deleted or anonymised unless its further retention is required or permitted by applicable law.

16. Rights of Data Subjects

To the extent provided for by the GDPR, data subjects have in particular the right to:

  • access their personal data,
  • rectification of data,
  • erasure of data,
  • restriction of processing,
  • data portability,
  • object to processing,
  • withdraw consent where processing is based on consent.

The exercise of individual rights may be subject to limitations arising from the GDPR or other applicable laws, in particular where the Controller is required to retain certain data.

17. Right to Object

Where data is processed on the basis of Article 6(1)(f) of the GDPR, the data subject may, for reasons relating to their particular situation, object to such processing in accordance with the GDPR.

18. Provision of Data

Providing data required to conclude and perform a Contract is voluntary; however, failure to provide such data may make it impossible to place an Order, make a payment, deliver a Digital Product or fulfil other obligations related to the Contract.

Providing data required by law, in particular tax or accounting regulations, may be mandatory. Providing data used exclusively on the basis of consent is voluntary.

19. Automated Decision-Making and Profiling

The Controller does not make decisions concerning users that produce legal effects or similarly significantly affect the user solely by automated means, including profiling, unless the user is separately informed about such processing and its legal basis in accordance with applicable law.

20. Right to Lodge a Complaint

A data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the provisions of the GDPR.

21. Data Security

The Controller applies appropriate technical and organisational measures proportionate to the risks associated with the processing of personal data.

Access to data is restricted to persons and entities that require it to perform specific tasks, taking into account security and confidentiality principles.

22. Changes to the Privacy Policy

The Privacy Policy may be updated in the event of changes to applicable laws, the operation of the Service, technologies used, the scope of data processing or the use of new services and providers.