Privacy policy
Version 1.2 · in force from 4 September 2026 (1.1 — from 12 August 2026; 1.0 — from 4 August 2026)
Change in version 1.2: launch of the chat assistant on the website.
Governing language. This policy is a translation of the Polish original. In the event of any discrepancy between the language versions, the Polish version prevails.
1. Who is the controller of your data
Merchel Stolarka Arkadiusz Merchel
ul. Chmieleńska 21A, 83-300 Łapalice, Poland
VAT ID PL5891129866 · REGON 220966420
Data enquiries: kontakt@merchelstolarka.pl, phone +48 604 605 976
The controller has not appointed a data protection officer — there is no such obligation at this scale of activity.
2. Where your data comes from
From you alone: the contact form, a shop order, a conversation with the assistant on the website, or correspondence you send us. We do not buy databases and we do not obtain data from other sources.
3. What we process, why, and on what basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form / quote enquiry | name, email, phone (if given), message | replying to the enquiry, preparing a quote | art. 6(1)(b) GDPR — steps prior to entering a contract |
| Shop order (online payment, form or email) | name, delivery address, email, phone, invoice details | performance of the sale contract and shipping | art. 6(1)(b) GDPR |
| Invoice and accounting | buyer's details, VAT ID | tax obligation | art. 6(1)(c) GDPR |
| Complaint or return | order data, description of the case, bank account for the refund | handling the case | art. 6(1)(b) and (c) GDPR |
| Conversation with the assistant on the website | the content of your messages — only for as long as it takes to answer | answering your question about the workshop's offer | art. 6(1)(f) GDPR — legitimate interest: handling questions outside working hours |
| Sending the conversation to the owner ("Send this conversation" button) | name, email or phone, conversation transcript | getting back to you about your enquiry | art. 6(1)(b) GDPR — steps prior to entering a contract |
| Website visit statistics | anonymised traffic data — no identifiers, no cookies | assessing which content is read | art. 6(1)(f) GDPR — legitimate interest |
| Defence against claims | data from the above | pursuing or defending claims | art. 6(1)(f) GDPR |
We do not profile and we do not take automated decisions concerning you.
4. How long we keep data
- Enquiry without an order — up to 12 months from the last contact, then deleted.
- Order — for the warranty and statutory warranty period, no less than 2 years from delivery.
- Accounting records — 5 years from the end of the tax year, under the Polish Tax Ordinance.
- Conversation with the assistant — we do not store it. It is gone when you close the chat window.
- Conversation sent with the button — same as an enquiry: up to 12 months from the last contact.
- Disputed cases — until the case is finally closed and limitation periods expire.
5. Who we share data with
Only with entities without which the service cannot be delivered:
| Recipient | Role | Where processed |
|---|---|---|
| Vercel Inc. | website hosting, routing requests to the language model, and bot protection | EU / USA, standard contractual clauses |
| Stripe Payments Europe, Ltd. | online payment operator — receives order data (name, delivery address, e-mail, phone) and the payment details you provide directly to it | EU (Ireland) |
| Formspree Inc. | form handling — passes the enquiry, and a conversation sent with the button, to the mailbox | USA, standard contractual clauses |
| Anthropic PBC | provider of the language model that composes the assistant's answers — receives the content of your messages for the time needed to generate a reply | USA, standard contractual clauses, zero data retention agreement |
| Proton AG | Switzerland — Commission adequacy decision | |
| courier company | parcel delivery | Poland |
| Meta Platforms Ireland Ltd. | WhatsApp communication — only when you contact us on that channel | EU / USA, standard contractual clauses |
| accounting office | bookkeeping | Poland |
We do not sell data and do not share it for marketing purposes.
Payment card details are provided only to the payment operator Stripe on its payment page — they never pass through our website and we have no access to them. For orders placed through the form or by e-mail, payment is made by bank transfer to the Seller's account.
6. Your rights
You have the right to: access your data, its rectification, erasure, restriction of processing, portability, and objection to processing based on legitimate interest.
Send requests to kontakt@merchelstolarka.pl. We reply within one month.
If you consider that we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
7. Is providing data mandatory
There is no obligation, but without some data we cannot deliver the service: without an address we cannot ship, without an email address we cannot confirm an order.
8. Visit statistics
The website uses Vercel Web Analytics. The tool does not write cookies, does not create a visitor identifier and does not allow you to be recognised on a later visit. It collects aggregated data only: page views, page address, country, device type.
For this reason we do not ask for consent to statistics — there is nothing to store on your device.
Details on cookies: Cookie policy.
9. The assistant on the website
A chat assistant runs in the bottom right corner. It answers questions about the workshop, bespoke furniture and sauna accessories, based on a description of the offer that we prepared.
The answers are composed by a language model, not by a person — the assistant says so when asked. This is not a conversation with an employee and it does not replace talking to the owner: the assistant does not set prices for bespoke furniture, delivery dates or contract terms.
What happens to what you write:
- Your message goes to the model provider that composes the answer, and is not retained there — we use a zero data retention mode.
- We do not store the conversation on our side. When you close the chat window, it is gone.
- The chat stores nothing on your device — no cookies, no other identifiers. This is why we do not ask for consent.
- If you want us to get back to you, you click "Send this conversation" and leave your details. Only then does the conversation reach our mailbox — by the same route as the contact form. Without that click, nothing reaches us.
Do not share sensitive data in the chat — national ID numbers, card numbers, health information. The assistant does not ask for them and asks you not to provide them.
10. Security
The website works over encrypted HTTPS only. Access to the mailbox and the panel is held by the owner and by the entity providing technical maintenance of the website, under a data processing agreement.
11. Changes to this policy
We announce changes on this page. The date of the last update is at the top of the document. If we add any tool that stores data on your device, the change will appear here before it is switched on, not after.