Privacy Policy

The data controller is Coal Art spółka z ograniczoną odpowiedzialnością (Coal Art sp. z o.o.), ul. Aleje Jerozolimskie 81, lok. 7.10, 02-001 Warsaw, Poland. KRS 0001221488 · NIP 7011297562. For anything in this policy, write to we@coal.art — a founder reads it.

Only what an order or a signup actually needs: your name, email address, shipping address and the contents of your order. If you join the keeper list we store your email and, optionally, your tee size. Our host and analytics also record standard technical data — IP address, browser, pages visited — used in aggregate to keep the site working.

From you — forms on this site, emails you send us, orders you place. If you back COALLY on Kickstarter, we receive your reward and delivery details from Kickstarter in order to fulfil the pledge. We do not buy contact lists and we do not scrape social profiles.

To process and ship your order, to answer your messages, to send drop announcements you asked for, and to keep the site secure and working. Order handling rests on performance of a contract; announcements rest on your consent; security and basic analytics rest on our legitimate interest in running the shop.

We only email people who asked us to. Every message carries an unsubscribe link and it works immediately. Email you give us at checkout is used for that order unless you separately opted into the list.

Only the services that make the shop run: Webflow (hosting), Stripe (payments), our email provider, and the carriers who deliver your parcel. They act on our instructions under data-processing agreements. We may also disclose data where the law requires it. We do not sell, rent or trade personal data — to anyone, for any price.

Order records are kept as long as Polish tax and accounting law requires. Mailing-list data is kept until you unsubscribe. Anything we no longer need is deleted or anonymised.

Card payments are processed by Stripe over an encrypted connection. Card numbers never touch our systems and are never stored by us. The site runs over HTTPS and access to order data is limited to the founders. No system is perfect — if something ever goes wrong, we will tell you and the supervisory authority within the legal deadline.

Some of our providers are based outside the European Economic Area. Where that happens, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

We use a small number of cookies to keep the site functioning and to understand, in aggregate, which pages people read. We never put anything that identifies you personally inside a cookie. Your browser can block or delete them at any time — some parts of the site may then behave oddly.

If you are in the EEA you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Write to we@coal.art and we answer within one month. You also have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

Under the CCPA and CalOPPA you may request the categories and specific pieces of personal information we hold about you, ask us to delete it, and be free from discrimination for exercising those rights. We do not sell the personal information of our users. Requests go to we@coal.art and are answered within one month.

COAL is not aimed at children and we do not knowingly collect data from anyone under 16. If you are a parent or guardian and believe your child has given us personal data, write to us and we will remove it.

This policy covers coal.art only; once you follow a link elsewhere, that site’s rules apply. If we change the policy we update the date at the top and, where the change is material, we tell you before it takes effect. This policy is governed by Polish law. Questions, requests, complaints: we@coal.art.