Privacy Policy
Version dated 27 October 2026.
1. The controller and the scope of this policy
1. The controller of the personal data of customers and users of the 1991 Store at 1991.pl is WE ARE 1991 sp. z o.o., plac Bankowy 2, 00-095 Warszawa, Poland. KRS 0001262444, NIP 5253103454, REGON 545560688; share capital: PLN 5,000. The company is entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register.
2. For matters relating to personal data and the exercise of your rights, contact hello@1991.pl or write to the controller at the address above. Telephone: +48 510 106 852.
3. This policy explains how data is processed when you use the Store, make a purchase, have an order fulfilled, make a return or complaint, use a warranty, contact us, publish a review or subscribe to messages from 1991. The principal legislation is Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act and the Polish Act of 12 July 2024, the Electronic Communications Law (PKE).
2. Data, purposes and legal bases
1. Placing and fulfilling orders: we process identification and contact details, the delivery address, product, payment and order details, and correspondence needed to enter into and perform the contract, under Article 6(1)(b) GDPR. The payment provider processes the data needed to handle your chosen payment method; do not send full payment card details in correspondence with the Store.
2. Customer accounts and forms: we process the data needed to provide your chosen service under Article 6(1)(b) GDPR. We process the contact details of business representatives and correspondence not directly related to a contract under Article 6(1)(f) GDPR; our legitimate interest is managing communication and business relationships.
3. Accounting and legal obligations: we process transaction details, invoicing details, including a tax identification number (NIP) where required, and accounting records under Article 6(1)(c) GDPR in connection with the applicable tax and accounting legislation.
4. Returns, complaints and warranties: we process purchase and contact details, information about the reported issue and the assistance required under Article 6(1)(b) GDPR and, when fulfilling statutory obligations, Article 6(1)(c) GDPR. We process data needed to establish, exercise or defend legal claims to the extent necessary under Article 6(1)(f) GDPR.
5. Email newsletters and SMS marketing: we process your email address or telephone number, consent record, preferences and communication data on the basis of your freely given consent under Article 6(1)(a) GDPR; using a particular marketing channel requires prior consent in accordance with Article 398 PKE. Messages relate exclusively to 1991. Subscribing to one channel does not constitute consent to the other.
6. Abandoned carts: we use automated reminders about unfinished purchases as part of the Store's communications, including through Klaviyo. To send a marketing reminder, we use your email address or telephone number and cart information only within the scope of the appropriate consent for that channel, under Article 6(1)(a) GDPR and Article 398 PKE. Providing your details at checkout does not, in itself, constitute consent to these messages.
7. Analytics, advertising and personalisation: we use Google, Meta and TikTok tools to analyse how the Store is used, measure advertising effectiveness, carry out remarketing and tailor 1991 advertising. Depending on the scope of your consent, the data processed may include online identifiers, your IP address, device and browser details, pages visited, products viewed, cart and purchase events, and interactions with advertising. Consent is the legal basis for optional analytics and personalised advertising under Article 6(1)(a) GDPR; Article 399 PKE also applies to storing information on, or accessing information from, your device.
8. Advertising audience lists: after obtaining consent that covers sharing data with the specified provider and matching advertising, we may share a customer's or subscriber's email address or telephone number with Meta Custom Audiences, Google Customer Match or TikTok Custom Audiences. The purpose is to match the data to user accounts, target or exclude 1991 advertising, measure its results and create similar audiences where that function is used and covered by consent. Contact details may be shared as a cryptographic hash, which does not automatically make them anonymous. The legal basis is Article 6(1)(a) GDPR. Consent to a newsletter or SMS alone does not cover this sharing unless it was expressly included in the scope of that consent.
9. Reviews: we process the content of a review, the display name chosen by its author, and the data needed to link the review to a purchase and handle reports. The legal basis for publication requested by the user is Article 6(1)(b) GDPR, and for preventing abuse and carrying out verification it is Article 6(1)(f) GDPR. We do not publish email addresses or order numbers as part of reviews. Do not include other people's personal data in a review without a legal basis.
10. Operation and security of the Store: technical data, including your IP address and information about your device, browser, events and errors, may be processed under Article 6(1)(f) GDPR to keep services running, protect against abuse and diagnose problems. This legal basis does not replace the consent required for optional advertising or analytics tracking.
11. Handling individuals' rights and documenting compliance: we process information about requests, consents and objections to fulfil our obligations under the GDPR, under Article 6(1)(c) GDPR, and to the extent necessary to defend against legal claims, under Article 6(1)(f) GDPR.
3. Where data comes from and whether you need to provide it
1. We receive data from you when you make a purchase, contact us, subscribe or post a review, and from parties involved in fulfilling a purchase, such as the payment provider and carrier, in relation to payment and delivery status. Technical data may be collected while you use the Store and, in accordance with your consent, through the tools described in this policy.
2. Providing data is voluntary, but details marked as required are needed to provide the chosen service or fulfil a legal obligation. Without delivery details, we cannot send the goods; without an email address or telephone number, we cannot provide the chosen subscription. Optional data and marketing consent are not conditions of purchase.
3. If you order a delivery for someone else, we receive from you the details about that person needed for delivery. We process those details to fulfil the delivery and make contact under Article 6(1)(f) GDPR, and provide that person with the required information in accordance with Article 14 GDPR.
4. We do not ask for special categories of personal data, such as health data. Sending us more data than we need does not automatically constitute consent to use it for any purpose. We limit the data we process to what is necessary.
4. Who we share data with
1. We share data only to the extent needed for the particular purpose. Authorised employees, collaborators and providers acting on our behalf receive access appropriate to their tasks. Where a provider acts as a processor, it is bound by a data processing agreement and our instructions.
2. Shopify, in particular Shopify International Limited: the store platform, hosting, cart, account, orders, security and platform functions. Klaviyo, Inc.: management of subscriptions, email and SMS messages, contact details, segmentation and communication automation in accordance with the consents given.
3. Google Ireland Limited: Google analytics and advertising tools, including advertising measurement, remarketing and Customer Match; Meta Platforms Ireland Limited: advertising on Meta services, measurement and Custom Audiences; TikTok Technology Limited (Ireland) and other relevant TikTok entities specified in the terms of the particular service: advertising, measurement and Custom Audiences. We share data with the relevant provider only within the scope of the appropriate consent and the function being used.
4. Advertising providers' roles depend on the tool and the stage of processing: they may act as processors, independent controllers or joint controllers for operations determined jointly, such as collecting and transmitting event data. Where we act as joint controllers, we are responsible for providing information about processing in the Store and obtaining the required consents, while the provider is responsible for its obligations relating to the tool and subsequent processing; the detailed allocation of responsibilities is set out in the terms of the particular service. You may exercise your rights against each relevant controller, including by contacting us. Provider information: Google, Meta and TikTok.
5. Fakturownia sp. z o.o. and Value Finance Books sp. z o.o.: issuing documents, billing and accounting services. DTW LOGISTICS GROUP sp. z o.o.: warehousing, preparation and handling of shipments. InPost and the carriers selected for the particular order: delivery, collection or return of shipments.
6. Payment providers available when you select a payment method, and banks: processing and settling transactions and refunds, and fulfilling legal obligations. Their details and data processing rules are presented during payment selection. They may act as independent controllers when fulfilling their own obligations.
7. Store app and integration providers, within the scope of the functions actually provided: Judge.me for reviews and their verification; withdrawal form apps, including Revoq; providers of invoicing, delivery and warehouse integrations; tools for building bundles, applying discounts and managing checkout; and translation providers. They receive the data needed for the particular function, in accordance with the access granted.
8. Email, domain, IT support and legal service providers, and bodies authorised by law, may receive data to the extent necessary. You can obtain information about the specific recipients of your data by contacting us.
9. If you contact our profile on an external social media service, we process the content of your communication and the data you share to reply and manage the profile. The service provider also processes data under its own policy. The fact that 1991 has a profile does not mean that a user has consented to their purchase data or contact lists being sent to that service.
5. Transfers outside the European Economic Area
1. Using international providers may involve processing data outside the EEA. This applies to the infrastructure and subcontractors of Shopify, Klaviyo, Google, Meta and TikTok, particularly in the United States and Canada, and in other countries specified in the relevant provider's documentation. Entering into a contract with an entity in Ireland does not, in itself, rule out onward transfers outside the EEA.
2. A transfer may be based on an applicable European Commission adequacy decision or on safeguards provided for in Article 46 GDPR, in particular the standard contractual clauses for international transfers adopted by Decision 2021/914, together with any required supplementary measures. The Shopify group also uses approved binding corporate rules. The decision concerning the EU-US Data Privacy Framework may be relied on only for a recipient and scope of transfer covered by it.
3. Information about providers' safeguards is available in Shopify's privacy policy and Klaviyo's data processing agreement. You may contact hello@1991.pl to request information or a copy of the relevant safeguards, subject to the protection of other people's rights.
6. How long we keep data
1. We keep order and accounting data for the duration of contract performance, and subsequently to the extent and for the period required by tax and accounting legislation and necessary to establish, exercise or defend legal claims. The specific period depends on the type of document, the obligation and the applicable limitation period; we do not retain all data indefinitely.
2. We keep data relating to contact, returns, complaints and warranties until the matter is resolved, and longer only to the extent necessary because of a legal obligation or potential claims. We keep account data for the duration of the account service; deleting an account does not mean deleting sales documents that we are required to retain.
3. We process data used for marketing on the basis of consent until that consent is withdrawn or the purpose ends, whichever is earlier. After you opt out, we may retain a limited record of the consent, its withdrawal or an objection for the period needed to demonstrate compliance and defend legal claims, as well as a suppression record to prevent further unwanted messages. This record is not used for further marketing.
4. We keep review data for as long as the review is published, and data relating to reports and disputes for the period needed to handle them and protect rights. We keep security logs for as long as necessary to diagnose problems, protect services and investigate incidents; we keep them longer only where a particular case or legal provision requires it.
5. Session cookies last for the session, while persistent cookies remain until they expire or are deleted. The lifetime of a particular identifier depends on its function and the tool's settings. Detailed information about Shopify cookies is available in Shopify's cookie policy; you can also check the settings and cookies stored in your browser through its settings. Withdrawing consent ends processing based on that consent going forward.
7. Your rights
1. Under the GDPR, you have the right to access your data and receive a copy, to rectification, erasure, restriction of processing and data portability where the conditions for that right are met. You may also withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
2. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time without giving a reason; once we receive your objection, we will no longer process your data for that purpose.
3. You can submit a request to hello@1991.pl or to the controller's postal address. We do not require a particular form or a justification for every request. If we have reasonable doubts, we may ask for information necessary to confirm your identity, limiting its scope to what is needed for verification.
4. We respond without undue delay, generally within one month of receiving a request. In the circumstances provided for by the GDPR, this period may be extended by a further two months; we will inform you of the extension and the reasons for it within the first month. If we cannot fulfil a request, we will explain why and describe the available remedies.
5. You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office. Information about contact methods and lodging complaints is available at uodo.gov.pl. You may also seek a judicial remedy.
8. Cookies and similar technologies
1. Cookies and similar technologies, such as browser local storage and pixels, may be used to operate the cart, maintain security, remember settings, analyse usage or personalise content. IP addresses, device identifiers and data linked to behavioural history may constitute personal data. Shortening or pseudonymising them does not always make them anonymous.
2. Necessary technologies enable transmission or a service expressly requested by the user, such as maintaining a cart, logging in, security and recording consent choices. They are used within the exception provided for in Article 399 PKE. We do not use this exception as a basis for optional advertising tracking.
3. Optional preference, analytics and marketing technologies require appropriate prior consent. You can accept or reject optional categories and change your choice in the Store's "Cookie settings" panel. Simply visiting the site, continuing to browse, scrolling or taking no action does not constitute consent.
4. Rejecting optional cookies does not prevent you from browsing the range and making a purchase in the usual way. Settings apply to the selected browser and device. Deleting cookies or using a different browser may mean that you need to make your choices again. You can also change your browser settings; blocking necessary technologies may interfere with the cart or account.
5. The Store uses Shopify and Klaviyo technologies and Google, Meta and TikTok analytics and advertising tools, including tags and pixels from the relevant providers. Where consent is required, these tools may be used only after it has been obtained. Newsletter consent does not replace consent to optional cookies, sending event data or matching contact lists, and vice versa. The scope of the consent given must cover the particular purpose and recipient. For a detailed list of the technologies and recipients relating to your use of the Store, contact hello@1991.pl.
9. Profiling and messages
1. Tailoring communications and advertising may involve assigning a user to an interest group based on their choices, purchase history or, after obtaining the required consent, their behaviour in the Store, cart and interactions with messages. Contact list matching allows the advertising provider to link the identifiers supplied to its users. This may result in different 1991 recommendations, advertising or content, or a particular campaign not being shown. You can decline optional personalisation, withdraw consent or object to marketing.
2. If you withdraw consent to list matching or object, we stop using your data for that purpose and request its removal or exclusion from the relevant advertising lists. You can contact hello@1991.pl. Withdrawing cookie consent in a particular browser applies to the technologies in that browser; you can withdraw consent to sharing contact lists separately. Any further processing by an external service on its own legal basis is governed by its policy and your rights in relation to that service.
3. We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Technical assessments of the risk of abuse or marketing segmentation do not remove your right to contact customer support and have the matter explained.
4. You can unsubscribe from the newsletter using the link in a message or by contacting hello@1991.pl. You can opt out of SMS messages using the method stated in the message or by writing to hello@1991.pl. Messages about orders, deliveries, returns and complaints relate to performance of the contract or fulfilment of a legal obligation and do not require a newsletter subscription.
10. Changes to this policy
1. We update this policy when our processes, providers, Store functions or the law change. The version date appears at the beginning. We will inform you of any material change to the purpose or rules of processing in a way appropriate to its scope; if fresh consent is needed, we will obtain it before that processing begins. Publication of this policy or use of the Store does not, in itself, constitute consent to new purposes.
