Thank you for visiting pattern-stitch.com. This policy explains what personal data we process, why, on what legal basis and for how long. We keep your data confidential, protect it against unauthorised access and use the security measures required by data protection law.
1. General information
1.1. Controllers. The joint controllers of your personal data are Katarzyna Dzienis Strefa Kroju i Szycia II, ul. Grunwaldzka 54, 41-800 Zabrze, Poland, NIP 6482638884, and Strefa Kroju i Szycia Dominik Dzienis, ul. Grunwaldzka 54, 41-800 Zabrze, Poland, NIP 6482613281, also acting together as the civil law partnership D. Dzienis, K. Dzienis s.c. Strefa Kroju i Szycia, ul. Grunwaldzka 54, 41-800 Zabrze. Questions about privacy: biuro@strefakrojuiszycia.pl.
1.2. Your rights under the GDPR (Regulation (EU) 2016/679): access to your data and a copy of it, rectification, erasure, restriction of processing, objection to processing based on our legitimate interest, data portability, withdrawal of consent at any time (without affecting earlier processing), and lodging a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (UODO), or the authority in your country of residence. To use your rights, write to biuro@strefakrojuiszycia.pl.
1.3. Recipients. Your data may be processed by service providers we use, only to the extent needed for their service: hosting and server providers, file storage for pattern downloads, e-mail delivery, payment providers, accounting, IT support and legal advisers. We may also disclose data to public authorities where the law requires it (e.g. tax authorities).
1.4. Transfers outside the EEA. Some tools we use may store data on servers outside the European Economic Area (e.g. in the USA). In such cases the providers ensure an adequate level of protection by mechanisms provided for in the GDPR, such as an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
1.5. We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you.
2. Purposes of processing
2.1. Contact
Data: name, e-mail address and data contained in your message (voluntary, but needed to reply). Purpose: answering your message; then archiving correspondence. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Period: until the matter is resolved, then until claims become time-barred.
2.2. Customer Account
Data: first and last name, e-mail address, billing address, phone number (optional), password (stored encrypted). An Account is required to buy. Purpose: providing the Account service – access to purchased and unlocked patterns, orders and subscriptions. Legal basis: performance of the contract (Art. 6(1)(b) GDPR); after the Account is deleted – our legitimate interest in establishing and defending claims (Art. 6(1)(f) GDPR). Period: while you use the Account, then until claims become time-barred.
2.3. Orders and payments
Data: name, billing address (including country – needed to apply the correct VAT), e-mail address, company data and tax ID if you request an invoice, order details and payment status. Card or bank details are processed by the payment provider; we do not store card numbers. Purpose: fulfilling the order, issuing receipts and invoices, accounting and VAT settlement (including EU OSS records), handling payments. Legal basis: performance of the contract (Art. 6(1)(b) GDPR), legal obligations under tax and accounting law (Art. 6(1)(c) GDPR), our legitimate interest in establishing and defending claims (Art. 6(1)(f) GDPR). Period: until claims become time-barred; accounting and tax documents for the period required by law (in Poland generally 5 years from the end of the year in which the tax obligation arose; OSS records 10 years).
2.4. Sewing Club subscription
Data: Account data, chosen Plan, subscription status and renewal dates, payment history, and the list of patterns you have unlocked in the Club with dates (needed to count your monthly downloads and give you access while your subscription is active). Purpose: providing the subscription. Legal basis: performance of the contract (Art. 6(1)(b) GDPR); afterwards our legitimate interest in establishing and defending claims (Art. 6(1)(f) GDPR). Period: while the subscription is active, then until claims become time-barred.
2.5. Complaints and withdrawal
Data: name, e-mail address, order number, address and bank account number (if needed for a refund) and other information you provide. Purpose: handling a complaint or withdrawal from the contract. Legal basis: legal obligation (Art. 6(1)(c) GDPR), then our legitimate interest in documenting the process and defending claims (Art. 6(1)(f) GDPR). Period: until claims become time-barred.
2.6. Newsletter
Data: e-mail address (voluntary). Purpose: sending news about patterns, tips and offers, and statistics about the newsletter. Legal basis: your consent (Art. 6(1)(a) GDPR) and, for statistics and proof of consent, our legitimate interest (Art. 6(1)(f) GDPR). Period: until you unsubscribe (link in every newsletter or by e-mail); proof of consent until claims become time-barred.
2.7. Reminders about unfinished orders
If this function is enabled, we may send one reminder to the e-mail address entered at checkout when an order was started but not completed. Legal basis: our legitimate interest in helping you complete the purchase (Art. 6(1)(f) GDPR). You can object at any time using the link in the reminder.
2.8. Reports of illegal content
Data: name, e-mail address and content of the report. Purpose: handling reports under the Digital Services Act. Legal basis: legal obligation (Art. 6(1)(c) GDPR), then our legitimate interest (Art. 6(1)(f) GDPR). Period: until claims become time-barred.
2.9. Social media
If you contact us or interact with our profiles on Facebook, Instagram or other social networks, we process the data visible in your profile and the content of your messages and comments to communicate with you and promote our products (legitimate interest, Art. 6(1)(f) GDPR) until you object or the purpose is achieved. The social network operators process the data under their own privacy policies.
3. Cookies and similar technologies
3.1. The Store uses cookies – small text files stored on your device. Some are deleted when you close the browser (session cookies), others remain to recognise your browser on your next visit (persistent cookies).
3.2. Necessary cookies are used for the cart, checkout, logging in, the wishlist, security and remembering your cookie choices. They do not require consent.
3.3. Consent. On your first visit, a cookie banner lets you accept all cookies, reject non-essential cookies or choose categories. You can change your choice at any time with the cookie button in the bottom corner of the page, and you can delete cookies in your browser settings.
3.4. Analytics and advertising. If we use analytics or advertising tools (for example Google Analytics, Google Ads or the Meta Pixel), they are loaded only after you have given consent for the relevant category in the cookie banner, and they work in Google Consent Mode where applicable. The current list of tools and cookies is shown in the cookie banner settings. Such tools are provided by Google Ireland Limited / Google LLC (policies.google.com/privacy) and Meta Platforms Ireland Limited (facebook.com/privacy/policy). Legal basis: your consent (Art. 6(1)(a) GDPR).
3.5. Server logs. Each visit is recorded in server logs (IP address, date and time, browser and system information). Logs are used only to administer and secure the Store and are not used to identify you.
If anything in this policy is unclear, write to us at biuro@strefakrojuiszycia.pl.
This Privacy Policy applies from 3 November 2026.