Privacy policy

Last updated: 1 September 2026

This Privacy Policy describes how Ligas Kraków Sp. z o.o. (“we”, “us” or “our”) collects, uses and discloses your personal data when you visit, use our services or make a purchase on ligaskrakow.com (the “Site”) or otherwise communicate with us (collectively, the “Services”). For the purposes of this Privacy Policy, “you” and “your” mean you as the user of the Services, whether you are a customer, a website visitor, or another individual whose data we have collected in accordance with this Privacy Policy.

Please read this Privacy Policy carefully. We process personal data solely on the legal bases provided for in the GDPR, described below — merely using the Site does not constitute consent to the processing of your data, and wherever processing is based on consent, we collect that consent separately (e.g. in the consent banner or when you sign up for the newsletter).

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal or regulatory reasons. We will publish the updated Privacy Policy on the Site, update the “Last updated” date and take any other steps required by applicable law.

How we collect and use your personal data

To provide the Services, we collect personal data about you from a variety of sources, as set out below. The information we collect and use varies depending on how you interact with us.

In addition to the specific uses set out below, we may use the information we collect about you to communicate with you, provide the Services, comply with any applicable legal requirements, enforce any applicable terms of service, and protect or defend the Services, our rights, and the rights of our users or other persons.

What personal data we collect

The types of personal data we obtain about you depend on how you interact with our Site and use our Services. When we use the term “personal data”, we are referring to information that identifies, relates to, describes or can be associated with you.

Information we collect directly from you

Information that you provide to us directly through our Services may include:

Basic contact details: including your name, address, phone number, email.
Order information: including your name, billing address, shipping address, payment confirmation, email address, phone number.
Account information: including your username, password, security questions.
Shopping information: including the items you view, the contents of your cart or wishlist.
Customer support information: including the information you choose to include in communications with us, for example when sending a message through the Services or talking to the chat assistant.

Some features of the Services may require you to provide us with certain information about yourself directly. You may choose not to provide this information, but this may prevent you from using or accessing these features.

Information collected through cookies

We also automatically collect certain information about your interaction with the Services (“Usage Data”). To do this, we may use cookies, pixels and similar technologies (“Cookies”). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.

Information obtained from third parties

We may also receive information about you from third parties, including vendors and service providers who may collect information on our behalf, such as:

Companies that support our Site and Services, such as Shopify.
Our payment processors, who collect payment information (e.g. bank account, credit or debit card information, billing address) to process your payment, fulfil your orders and deliver the products or services you have ordered, in performance of our contract with you.
When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we or third parties we work with may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries and cookies.

Any information we receive from third parties will be processed in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for the policies or practices of third parties. For more information, see the section below, “Third-party websites and links”.

How we use your personal data and on what legal bases

Providing Products and Services: We use your personal data to provide the Services, including to process payments, fulfil orders, and send notifications related to your account, purchases, returns and other transactions. Legal basis: art. 6 ust. 1 lit. b RODO (Article 6(1)(b) GDPR — necessity for the performance of a contract or to take steps prior to entering into one) and art. 6 ust. 1 lit. c RODO (Article 6(1)(c) GDPR — legal obligations, in particular tax and accounting obligations).
Marketing and Advertising: We use your personal data for marketing and promotional purposes, such as sending marketing, advertising and promotional communications by email, SMS or postal mail. Legal basis: art. 6 ust. 1 lit. a RODO (Article 6(1)(a) GDPR — consent: newsletter, SMS, marketing Cookies) and art. 6 ust. 1 lit. f RODO (Article 6(1)(f) GDPR — legitimate interest: direct marketing of our products to our customers).
Security and Fraud Prevention: We use your personal data to detect, investigate or take action regarding possible fraudulent or illegal activity. Legal basis: art. 6 ust. 1 lit. f RODO (Article 6(1)(f) GDPR — legitimate interest in keeping the Services secure).
Communicating with You: We use your personal data to provide customer support (including via the chat assistant) and to improve our Services. Legal basis: art. 6 ust. 1 lit. b RODO (Article 6(1)(b) GDPR) where the communication concerns a contract, and otherwise art. 6 ust. 1 lit. f RODO (Article 6(1)(f) GDPR — legitimate interest in handling enquiries and improving the Services).
Establishing, pursuing or defending legal claims: Legal basis: art. 6 ust. 1 lit. f RODO (Article 6(1)(f) GDPR — legitimate interest).

Cookies

Like many websites, we use Cookies on our Site. For specific information about the Cookies we use in connection with running our store on Shopify, see https://www.shopify.com/legal/cookies. We use Cookies to power and improve our Site and our Services (including to remember your actions and preferences) and to run analytics and better understand user interaction with the Services. Cookies other than those necessary for the operation of the Site are used solely on the basis of your consent, which you can withdraw at any time in the consent banner. We may also permit third parties and service providers to use Cookies on our Site to better tailor services, products and advertising on our Site and other websites.

Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser settings. Please note that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available.

How we disclose personal data

In certain circumstances, we may disclose your personal data to third parties for legitimate purposes, in accordance with this Privacy Policy. Such circumstances may include:

Working with vendors or other third parties who provide services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, order fulfilment and shipping).
Working with business and marketing partners, including Shopify, to provide services and display advertising. We use Shopify to support personalised advertising in third-party services. Our business and marketing partners will use your information in accordance with their own privacy policies.
When you direct, request or otherwise consent to our disclosure of certain information to third parties, for example in order to ship products to you, or through your use of social media widgets or login integrations.
With our affiliates or otherwise within our corporate group, in our legitimate interest of running an effective business.
In connection with a business transaction such as a merger or bankruptcy, to comply with applicable legal obligations (including responding to subpoenas, search warrants and similar requests), to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or other persons.

We do not sell personal data. The recipients of personal data are solely the entities listed in the section “Data recipients — tools we use” below, other entities processing data on our instructions under data processing agreements compliant with art. 28 RODO (Article 28 GDPR), and entities authorised to receive the data under applicable law. Data used by advertising partners in connection with marketing Cookies is processed solely with your consent, which you can withdraw at any time in the consent banner.

We do not process special categories of personal data (sensitive data), nor do we use personal data to infer such characteristics.

User-generated content

The Services may enable you to post product reviews and other user-generated content. If you choose to post user-generated content in any public area of the Services, that content will be public and accessible to anyone.

We do not control who will have access to the information that you choose to make available to others, and cannot guarantee that parties who have access to such information will respect your privacy or keep it secure. We are not responsible for the privacy or security of any information that you make publicly available, or for the accuracy, use or misuse of any information that you disclose or receive from third parties.

Third-party websites and links

Our Site may contain links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated with or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness or reliability of information found on them. Information you provide in public or semi-public venues, including information you share on third-party social networking platforms, may be viewable by other users of the Services and/or users of those third-party platforms, without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed in the Services.

Children's data

The Services are intended solely for persons who are 18 years of age or older. We do not knowingly collect any personal data from persons under the age of 18. If you are the parent or guardian of a child who has provided us with their personal data, you may contact us using the contact details set out below to request that it be deleted.

Security and retention of your information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee “perfect security”. In addition, any information you send to us may not be secure while in transit. We recommend that you do not use insecure channels to communicate sensitive or confidential information to us.

We retain personal data for the following periods:

order data and accounting documents — for 5 years from the end of the tax year in which the tax obligation arose (tax and accounting obligations);
data necessary to establish, pursue or defend legal claims — until the expiry of the limitation periods provided by law (as a rule, 6 years);
customer account data — until the account is deleted;
data processed for marketing purposes — until consent is withdrawn or an objection is raised;
records of conversations with the chat assistant — for 14 days;
data collected through Cookies — in accordance with the periods indicated in the consent banner.

Your rights

In connection with the processing of your personal data, you have the following rights under the GDPR:

Right of access (art. 15 RODO / Article 15 GDPR) — you may request information about the data we process and a copy of it.
Right to rectification (art. 16 RODO / Article 16 GDPR) — you may request that inaccurate data be corrected or incomplete data be completed.
Right to erasure (art. 17 RODO / Article 17 GDPR).
Right to restriction of processing (art. 18 RODO / Article 18 GDPR).
Right to data portability (art. 20 RODO / Article 20 GDPR) — you may receive the data you have provided to us in a structured, commonly used, machine-readable format and request that it be transmitted to another controller.
Right to object (art. 21 RODO / Article 21 GDPR) — you may object at any time to processing based on our legitimate interest, including at any time to the processing of data for direct marketing purposes; once you object to direct marketing, we will no longer process your data for that purpose.
Right to withdraw consent — where we process data on the basis of consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

You can exercise the above rights by contacting us using the contact details set out below or in the places indicated on the Site (e.g. the consent banner, unsubscribe links in emails). Before fulfilling your request, we may ask for information necessary to confirm your identity (e.g. the email address associated with your account or order). We respond to requests without undue delay, no later than within one month (this period may be extended by a further two months for complex or numerous requests — in which case we will inform you). Exercising your rights will not result in any negative consequences on our part.

Managing communication preferences: We may send you promotional messages, which you can opt out of at any time using the unsubscribe option displayed in our emails. If you opt out, we may still send you non-promotional messages, such as information about your account or orders you have placed.

We use Shopify's advertising services, such as Shopify Audiences, to help personalise the advertising you see on third-party websites. To restrict Shopify merchants that use these advertising services from using your personal data for such services, please visit https://privacy.shopify.com/en.

Complaints

If you have a complaint about how we process your personal data, please contact us using the contact details set out below — we will try to resolve the matter. Regardless of this, you have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Polish Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl, and if you reside in another EU Member State — with your competent local data protection authority.

International users

Please note that we may transfer, store and process your personal data outside your country of residence, including in the United States. Your personal data is also processed by staff and third-party service providers and partners in these countries.

If we transfer your personal data outside of Europe, we will rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the United Kingdom, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at contact@ligaskrakow.com or contact us at:

Ligas Krakow Sp. z o.o.,
ul. Lipowa 3D, 30-702 Kraków, Poland.
KRS: 0001061403,
REGON: 526544342,
NIP: 6793278212
VAT: PL6793278212

For the purposes of applicable data protection laws, we are the controller of your personal data.

Data recipients — tools we use

In operating the Site we use the services of the following providers, to whom we entrust the processing of personal data in accordance with the GDPR: Shopify (store platform and payment handling), Klaviyo (newsletter and email marketing), Microsoft Clarity (analysis of Site usage, including anonymised session recordings), Triple Whale (marketing analytics), Okendo (product reviews), payment operators (including Shopify Payments, Klarna), courier companies carrying out deliveries (InPost, DPD/GLS, UPS, FedEx, DHL — to the extent of the address and contact data necessary for delivery), ElevenLabs, Inc. (on-site chat assistant — conversation content; sub-processor: Google for the language model), xAI (monitoring of inventory levels and sales — read-only access to order data).

Cookie files

The Site uses cookies: those necessary for the operation of the store (session, cart, market and language preferences), analytics cookies (Microsoft Clarity, Triple Whale) and marketing cookies (Klaviyo). You can manage your consent to cookies other than the necessary ones in the consent banner and in your browser settings.