Privacy policy – PNKLab

Effective from: 3 November 2026

In short

1. Controller

The controller of your personal data is PNKLab sp. z o.o., registered office: ul. Orląt Lwowskich 1, 87-100 Toruń, Poland, KRS 0001246975, VAT/NIP 9562412623. Contact: hello@pnklab.com, phone +48 509 065 873.

2. What we process, why and for how long

  1. Site visits: IP address, date and time, page address, browser information (server logs) – to display the site and keep it secure; legitimate interest (Art. 6(1)(f) GDPR); processed by Cloudflare, Inc. as our processor; kept for up to 30 days.
  2. Purchases from Poland: Stripe (Stripe Payments Europe, Limited, Ireland) collects payment data as an independent controller (https://stripe.com/privacy). We receive order data (name, email, country, billing address, VAT number if provided, product, amount, date, status) and issue a VAT invoice in inFakt (inFakt sp. z o.o., Kraków – our processor); the invoice is also submitted to the Polish National e-Invoicing System (KSeF). Purchases from outside Poland: the seller is Stripe Managed Payments – a Stripe group company operating under the Link brand (Sold through Link, LLC (a Stripe group company, USA)) – which collects your checkout data and processes it as an independent controller for that transaction (https://link.com/privacy-center, https://stripe.com/privacy); we receive the order data needed to deliver the file and handle complaints. Legal bases: contract (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), defence of claims (Art. 6(1)(f)). Kept for the limitation period and as long as tax law requires.
  3. Emails: your address, name (if given) and message – to reply; legitimate interest (Art. 6(1)(f)) or steps before a contract (Art. 6(1)(b)); kept up to 2 years after the matter is closed; email provider: Resend (Resend, Inc., USA).
  4. Your browser only: the site remembers your chosen language (PL/EN) in localStorage. It is never sent to us.

3. Recipients and transfers

We never sell your data. Recipients: Cloudflare, Inc. (hosting and server – processor), Stripe (payments – independent controller), Stripe Managed Payments / Link (sales outside Poland – independent controller for its transactions), inFakt sp. z o.o. (invoicing – processor), our email provider Resend (Resend, Inc., USA), with your consent Google (Google Analytics) and Meta (Meta Pixel) – section 5, our accountant, and public authorities where the law requires. Cloudflare, Stripe (including Link), Resend, Google and Meta may process data in the USA under the EU-US Data Privacy Framework or standard contractual clauses.

4. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to lodge a complaint with a supervisory authority (in Poland: UODO, https://uodo.gov.pl, or the authority in your country). Write to hello@pnklab.com – we reply within one month.

5. Cookies and similar technologies

  1. Necessary (always on): browser storage (localStorage) needed for the site to work and to remember your choice in the cookie window (`pnk_zgody`, 12 months). No consent is required (Art. 5(3) ePrivacy Directive; in Poland Art. 399(3) of the Electronic Communications Law).
  2. Analytics – only with your consent: Google Analytics 4 (Google Ireland Limited, Ireland; Google LLC, USA). Purpose: to know how many people visit, where they come from (e.g. Instagram, search, a specific campaign) and which pages and features are used. Cookies `_ga` and `_ga_*` (up to 2 years). With the same consent we store the source of your first visit in your browser (`pnk_zrodlo`, e.g. "instagram|social|campaign name" or the referring domain) and attach it to your Stripe order, so we know which channel brings sales. Google's policy: https://policies.google.com/privacy
  3. Marketing – only with your consent: Meta Pixel (Meta Platforms Ireland Limited, Ireland; Meta Platforms, Inc., USA). Purpose: to measure our Facebook and Instagram ads and show them to people who visited our site. Cookie `_fbp` (up to 3 months). We are joint controllers with Meta for collecting and transmitting this data (Meta Controller Addendum); further processing is governed by Meta's policy: https://www.facebook.com/privacy/policy
  4. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules). Consent is voluntary – you can use the site fully without it. You can change or withdraw it at any time via "Cookie settings" in the footer; withdrawal does not affect processing before it. After withdrawal we delete the Google Analytics and Meta cookies from your browser.
  5. Analytics and advertising tools start only after you consent (Google Consent Mode). Until then nothing is sent to Google or Meta.
  6. The Stripe and Link (Stripe Managed Payments) checkouts use their own cookies necessary for payment and fraud prevention, as described by Stripe and Link.
  7. You can also block and delete cookies in your browser settings.
  8. If you accept marketing cookies, Meta may tailor the ads you see (marketing profiling) – this has no legal effect on you.