Privacy Policy

Last updated 8 October 2026

In brief

To sell you a file we need an email address and a record of what you bought. That's close to everything. We don't sell data, we don't build advertising profiles, we don't run tracking pixels from social networks, and your card number never reaches our servers. What follows is the full account that the GDPR requires us to give.

Who is the controller

The controller of your personal data is Invitegrid sp. z o.o., ul. Elektoralna 13 lok. 121, 00-137 Warszawa, Polska, KRS 0001232948, NIP 5253085615. Contact for all data matters: [email protected]. We have not appointed a data protection officer, as the law does not require one for processing of this scale; your message goes directly to the people responsible.

What we process and why

▸ Order data — your email, the items bought, price, currency, time of purchase and the payment reference returned by the provider. Purpose: to conclude and perform the contract, deliver files, resend links, handle complaints. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
▸ Invoice data — name, address and VAT ID if you ask for an invoice or the law requires one. Purpose: tax and accounting duties. Legal basis: legal obligation, Art. 6(1)(c) GDPR, together with the Polish VAT Act and Accounting Act.
▸ Email for the free pack and release news — only if you request the pack or sign up. Purpose: sending the pack and one email when a new release is out. Legal basis: your consent, Art. 6(1)(a) GDPR, withdrawable at any time via the link in every message.
▸ Analytics — aggregated page statistics, only if you accept analytics cookies. Legal basis: consent, Art. 6(1)(a). See Cookies.
▸ Security and support logs — IP address, time and technical details of requests, and our correspondence with you. Purpose: preventing fraud and abuse, keeping the service running, answering you. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR.
Providing your email is voluntary but necessary to buy or receive the pack; without it we cannot deliver.

Payment data

Card and payment details are entered directly with our certified payment provider, which acts as an independent controller for that data under its own privacy policy. We receive only confirmation of payment, the amount, a transaction reference and the email you gave. We do not store card numbers in any form.

Who else sees it

We use a small number of processors, each bound by a data-processing agreement under Art. 28 GDPR: our hosting and email-delivery providers (storing orders, sending links and newsletters), and an analytics tool if you consented. The payment provider is not our processor: for the payment itself it is an independent controller, as described above. Our accountants receive invoice data to meet our tax duties. Where a processor is established outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We disclose data to public authorities only when legally obliged.

How long we keep it

▸ Order and delivery records: for the duration of the licence relationship and the limitation period for claims, so that we can prove your purchase and resend files.
▸ Invoices and accounting records: 5 years counted from the end of the tax year in which the tax became due, as the Polish Tax Ordinance (Ordynacja podatkowa) requires.
▸ Newsletter email: until you withdraw consent, after which we keep only a record that you unsubscribed.
▸ Logs and support mail: no longer than 12 months unless a dispute requires otherwise.

Your rights

You may ask for access to your data and a copy of it, rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interest. Consent may be withdrawn at any time without affecting what was done before. Write to [email protected]; we answer within one month, extendable by two months for complex requests, and we may ask you to confirm your identity through the email used for the order. You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Automated decisions, children, changes

We make no automated decisions with legal effect about you and do no profiling. The shop is not aimed at children under 16 and we do not knowingly collect their data. This policy is governed by the GDPR and the Polish Personal Data Protection Act of 10 May 2018. We update it when our processing changes; the date at the top tells you which version you are reading.