Privacy Policy
Effective from 9 October 2026. This policy explains what personal data we collect in the zasepa.com store, why, how long we keep it and what rights you have.
1. Who we are
The controller of your personal data is Hubert Zasępa, running a business as Hubert Zasępa Studio, ul. Paderewskiego 52, 42-202 Częstochowa, Poland, VAT ID PL5732306480 (“we”, “us”, “Zasępa Studio”).
For anything related to your data, email us at info@zasepa.com. We have not appointed a Data Protection Officer as we are not required to.
2. Where we get your data from
You give it to us directly when you place an order, create an account, email us or use the website (technical data recorded automatically). Payment providers send us only what we need to confirm that an order has been paid.
3. Purposes, legal bases and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Concluding and performing the contract – selling font licences, delivering downloadable files, handling your order | name, email, billing address, company name and VAT ID (if provided), order details, chosen licence | Art. 6(1)(b) – performance of a contract | until claims under the contract become time-barred (generally 6 years; 3 years for business-related claims), counted from the end of the year in which the contract was performed |
| Your request for immediate delivery and acknowledgement that you lose the right of withdrawal | the statement, date and time | Art. 6(1)(c) – obligation under consumer law; Art. 6(1)(f) – defence of claims | as above |
| Invoicing, accounting and taxes, including VAT on electronically supplied services to EU consumers (One-Stop-Shop) | invoice data, billing address, country, IP address at the time of purchase, country of the card or bank account | Art. 6(1)(c) – tax and accounting obligations | 5 years from the end of the year in which the tax became due; evidence of the customer’s location for OSS – 10 years from the end of the year of the transaction |
| Customer account (order history, re-downloading files) | email, password (encrypted), order data | Art. 6(1)(b) | until you delete the account; order data as above |
| Complaints and withdrawals | complaint details and correspondence | Art. 6(1)(c) and (b) | until claims become time-barred |
| Answering your emails | email address, name, message | Art. 6(1)(f) – our legitimate interest in communicating with you | until the matter is closed, then up to 1 year in case of follow-up questions |
| Establishing, exercising or defending legal claims | data needed to show how a transaction took place | Art. 6(1)(f) | until claims become time-barred |
| Security of the website and store (protection against attacks, abuse and payment fraud) | IP address, browser information, server logs, login attempts | Art. 6(1)(f) | for the short period needed to keep the site secure |
| Visitor statistics (Google Analytics 4) | cookie identifiers, approximate location, device and on-site behaviour data | Art. 6(1)(a) – your consent | until you withdraw consent; Google Analytics data is kept for up to 14 months |
| Where you came from before buying (WooCommerce order attribution) | traffic source, campaign, number of page views before purchase | Art. 6(1)(a) – your consent to marketing cookies | until you withdraw consent, or as order data |
Providing the data needed to place an order is voluntary, but without it we cannot conclude the contract or issue an invoice. Consent to statistics and marketing is entirely optional – you can use the store without it.
4. Who we share data with
We share data with external parties the store cannot run without: our hosting company, payment providers, the analytics provider (only with your consent), the website security provider, the invoicing and accounting software provider, and public authorities where the law requires it. You can request the current list of these parties at info@zasepa.com.
5. Transfers outside the European Economic Area
Some of these parties (payment providers, the analytics provider and the security provider) may process data in the United States. Transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses. You can request a copy of the safeguards at info@zasepa.com.
6. Your rights
You have the right to:
- access your data and receive a copy,
- have it corrected,
- have it erased (“right to be forgotten”),
- restrict processing,
- data portability for data processed on the basis of a contract or consent,
- object to processing based on our legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; you can change your cookie choices in the Cookie Policy,
- lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in your country of residence.
To exercise your rights, email info@zasepa.com. We will reply within one month. Some data cannot be erased before the periods required by tax law expire.
7. Automated decisions and profiling
We do not make decisions about you based solely on automated processing. Payment providers may assess the risk of payment fraud automatically – see their privacy policies. Google Analytics builds aggregated statistics of on-site behaviour only if you consent.
8. Cookies
We use cookies and similar technologies. Details and how to change your consent are in our Cookie Policy.
9. Security
The connection to the website is encrypted (HTTPS). We do not store payment card data – payment providers handle it. Customer account passwords are stored encrypted.
10. Changes
We may update this policy, for example when the services we use or the law change. The current version is always on this page; we will announce significant changes on the website or by email.