Privacy policy
PRIVACY POLICY
Last updated: September 2026
This Privacy Policy explains how LECH & CO collects, uses, stores and shares personal data when you visit our online store, place an order, create an account, contact us or otherwise use our services.
We process personal data in accordance with applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
1. DATA CONTROLLER
The controller responsible for the processing of your personal data is:
LECH & CO
Owner: Jakub Lech
Sole proprietorship registered in Poland
Business address:
Tadeusza Kościuszki 9, 27-400 Ostrowiec Świętokrzyski
Email:
info@lechandco.com
NIP:
PL6612396162
For questions concerning this Privacy Policy or the processing of your personal data, please contact us using the email address above.
2. PERSONAL DATA WE MAY COLLECT
Depending on how you interact with our store, we may collect and process the following categories of personal data:
• Identification and contact information, such as your name, email address, telephone number, billing address and shipping address;
• Order and transaction information, such as products ordered, order history, returns, refunds, shipping information and transaction details;
• Payment-related information necessary to process your transaction. Payments are processed through third-party payment providers and LECH & CO does not necessarily receive or store your complete payment card information;
• Account information, if customer accounts are available and you choose to create one;
• Communications you send to us, including customer-service inquiries, complaints, return requests and other correspondence;
• Technical information, such as IP address, browser type, device information and information about how you interact with our website;
• Cookie and similar technology information, subject to your choices and applicable law;
• Marketing preferences, including whether you have chosen to receive marketing communications from us.
3. HOW WE COLLECT PERSONAL DATA
We may collect personal data:
• directly from you when you place an order, create an account, contact us, request a return or otherwise provide information to us;
• automatically when you use our website, including through cookies and similar technologies where permitted;
• from service providers that help us operate our store, process payments, fulfill orders, deliver products, prevent fraud or provide technical services;
• from other third parties where permitted by applicable law.
4. PURPOSES AND LEGAL BASES FOR PROCESSING
We process personal data only where we have an appropriate legal basis.
We may process your personal data for the following purposes:
A. Processing and fulfilling orders
We process information necessary to accept orders, process payments, arrange fulfillment and shipping, provide order updates, handle returns and refunds and otherwise perform our contract with you.
Legal basis:
Article 6(1)(b) GDPR – performance of a contract or steps taken at your request before entering into a contract.
B. Customer service
We process information contained in inquiries, complaints, return requests and other communications in order to respond to you and provide customer support.
Depending on the circumstances, the legal basis may be Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
C. Legal and accounting obligations
We may process and retain information where necessary to comply with tax, accounting, consumer protection or other legal obligations.
Legal basis:
Article 6(1)(c) GDPR – compliance with a legal obligation.
D. Fraud prevention and security
We may process information where necessary to protect our store, customers, transactions and systems against fraud, misuse and security threats.
Legal basis:
Article 6(1)(f) GDPR – our legitimate interests in protecting our business and customers.
E. Marketing
Where required by applicable law, we will obtain your consent before sending electronic marketing communications.
Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent or unsubscribe from marketing communications at any time.
F. Analytics, advertising and cookies
We may use cookies and similar technologies for functionality, analytics, personalization and advertising.
Where consent is legally required for these technologies, they will be used only after the appropriate consent has been obtained.
More information about these technologies and available choices may be provided through our cookie or privacy settings.
5. SHOPIFY
Our online store is hosted and powered by Shopify.
Shopify provides the e-commerce infrastructure that enables us to operate the store and may process personal data in connection with your access to and use of the store.
Information submitted through our store may therefore be processed by Shopify in order to provide its services, maintain security, process transactions and provide relevant e-commerce functionality.
Shopify may also process certain information as an independent controller for purposes determined by Shopify, where applicable.
For more information about Shopify's processing of personal data, please refer to Shopify's own privacy information.
6. PAYMENT PROVIDERS
Payments are processed using payment providers available through our online store.
These providers may process information necessary to authorize and complete your payment, prevent fraud and comply with applicable legal obligations.
Payment providers process personal data according to their respective privacy terms and applicable law.
LECH & CO generally does not receive your complete payment card details.
7. FULFILLMENT AND SHIPPING
We may share personal data necessary to fulfill and deliver your order with fulfillment providers, shipping companies, logistics providers and other service providers involved in processing your order.
This may include:
• your name;
• delivery address;
• telephone number;
• email address;
• order details; and
• other information reasonably necessary to fulfill and deliver the order.
Our products may be fulfilled and shipped by third-party fulfillment partners acting on behalf of LECH & CO.
Such information is shared only to the extent necessary for order fulfillment, delivery and related services or where otherwise permitted by law.
8. OTHER SERVICE PROVIDERS
We may use third-party service providers to help operate our business, including providers of:
• website hosting and e-commerce infrastructure;
• payment processing;
• fulfillment and logistics;
• customer support;
• email services;
• analytics;
• advertising and marketing;
• fraud prevention;
• IT and security services;
• professional accounting, legal or compliance services.
These providers may process personal data where necessary to perform their services.
Where required by law, appropriate data-processing arrangements and safeguards are used.
9. INTERNATIONAL DATA TRANSFERS
Some of our service providers may process personal data outside Poland or outside the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA to a country that has not been recognized as providing an adequate level of data protection, appropriate safeguards will be used where required by law.
These safeguards may include European Commission Standard Contractual Clauses or another legally recognized transfer mechanism.
10. DATA RETENTION
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal obligations.
Retention periods may depend on factors including:
• the duration of our contractual relationship with you;
• applicable tax and accounting requirements;
• consumer protection obligations;
• limitation periods for legal claims;
• fraud prevention and security requirements; and
• whether you have an active customer account.
When personal data is no longer required, it will be deleted or anonymized where appropriate and legally permitted.
11. YOUR RIGHTS UNDER THE GDPR
Where the GDPR applies, you may have the right to:
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data where the legal requirements are met;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format and request its transmission where the right to data portability applies;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with a competent data protection supervisory authority.
These rights are subject to the requirements and exceptions provided by applicable law.
12. HOW TO EXERCISE YOUR RIGHTS
To exercise your data protection rights, please contact:
info@lechandco.com
Please describe your request sufficiently so that we can understand and process it.
We may need to verify your identity before fulfilling certain requests in order to protect personal data against unauthorized access.
We will respond within the time limits required by applicable law.
13. RIGHT TO LODGE A COMPLAINT
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.
For a business established in Poland, the relevant supervisory authority is:
President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych – UODO)
You may also have the right to contact another competent supervisory authority in accordance with applicable data protection law.
14. MARKETING COMMUNICATIONS
If you have agreed to receive marketing communications from LECH & CO, you may withdraw your consent or unsubscribe at any time.
Where available, you can use the unsubscribe link contained in our marketing emails or contact us directly.
Withdrawing consent for marketing does not affect transactional communications necessary to process orders, provide customer service or comply with legal obligations.
15. COOKIES AND SIMILAR TECHNOLOGIES
Our store may use cookies and similar technologies to operate the website, remember preferences, understand website usage, improve our services and, where applicable, support advertising.
Where required by applicable law, non-essential cookies and similar technologies will be used only after you have provided the appropriate consent.
You may be able to manage your preferences through the privacy or cookie controls available on our website.
Some cookies may be strictly necessary for the website and checkout to function and therefore may not require consent where permitted by applicable law.
16. SECURITY
We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or disclosure.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
17. CHILDREN
Our store is not intended for children to independently purchase products where they do not have the legal capacity to enter into the relevant transaction.
We do not knowingly collect personal data from children in violation of applicable law.
If you believe that a child has provided personal data to us unlawfully, please contact us.
18. THIRD-PARTY LINKS
Our website may contain links to websites or services operated by third parties.
LECH & CO is not responsible for the privacy practices of independent third-party websites.
We encourage you to review their privacy policies before providing personal data to them.
19. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes to our business, services, technologies or legal obligations.
The current version will be published on our website together with the date of the latest update.
Where required by applicable law, we will provide additional notice of material changes.
20. CONTACT
For questions concerning this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact:
LECH & CO
Owner: Jakub Lech
Email:
info@lechandco.com
Business address:
Tadeusza Kościuszki 9, 27-400 Ostrowiec Świętokrzyski
NIP:
PL6612396162