Privacy policy — OhSauco

Data controller

The controller of your personal data is Aleksandra Billi (OhSauco), ul. Pomorska 27, unit 3, 50-216 Wrocław, Poland, NIP 7492052181. For any privacy matter write to [email protected] or to the business address. We have not appointed a data protection officer, as we are not required to.

What data we process

Contact and order data — name or company name, email, phone number, pickup and delivery address, preferred time, list and description of items (e.g. stains, damage) and correspondence with us.
Billing data — details for the bill or invoice (e.g. company tax ID), amount, currency and date of payment.
Online payment data — if you pay via Stripe: name, email, amount, card brand and last 4 digits, payment status. The full card number and CVC are processed only by Stripe — we never receive them.
Technical data — IP address and browser information, processed by the server and the Cloudflare network to deliver and protect the website.

Purposes and legal bases

Taking your order, collecting and pricing items — steps prior to a contract at your request (Art. 6(1)(b) GDPR) and your consent given in the form (Art. 6(1)(a) GDPR).
Performing the contract, including delivery, taking payment and making refunds (Art. 6(1)(b) GDPR).
Issuing bills and keeping tax records (Art. 6(1)(c) GDPR).
Handling complaints, withdrawals and payment disputes, and establishing, pursuing or defending claims (Art. 6(1)(b), (c) and (f) GDPR).
Website security and preventing abuse (Art. 6(1)(f) GDPR).

Providing data is voluntary, but without it we cannot collect your items or perform the service. We do not make automated decisions or profile you. The website uses no analytics or marketing tools.

Recipients

We do pickups and deliveries ourselves — your address is not passed to courier companies. We share data only where necessary:

Stripe — Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: online payment processor. Stripe processes payment data to carry out payments and refunds and, as a separate controller, to prevent fraud and meet legal obligations (stripe.com/privacy).
Hosting and email provider — OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France — website and email server.
Cloudflare — Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — domain name service (DNS), content delivery and website protection.
Our accounting office — for data on bills and invoices, under a data processing agreement.
Our bank — for bank-transfer payments and refunds.
Public authorities — only where required by law.

We do not sell data or share it for marketing.

Transfers outside the EEA

Stripe and Cloudflare may transfer data to the United States. The basis is their participation in the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and standard contractual clauses. We will provide a copy of the safeguards on request.

Retention

Enquiries that did not lead to an order — up to 12 months from the last contact.
Order, billing and payment data — 5 years from the end of the calendar year in which the tax payment deadline passed.
Data needed for complaints and claims — until the claims become time-barred.

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on our legitimate interests. You can withdraw consent at any time without affecting earlier processing. Write to [email protected]; we reply within one month.

Right to complain

You may lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in your country of residence.

Changes

We update this policy when the law or our providers change. Cookies are described in the Cookie policy.