1. Personal Data Controller

The controller of your personal data is:

Lean Bulls sp. z o.o.
ul. Polska 7, 81-339 Gdynia
NIP: 9581731631
e-mail: lean.bulls@gmail.com

(hereinafter: Controller).

2. Scope of Processed Data

The Controller processes the following categories of Customers' personal data:

• first and last name,
• delivery address and billing address,
• e-mail address,
• phone number (if provided),
• invoice data (including NIP for entrepreneurs),
• order history,
• technical device data and cookies (see point 6).

3. Purposes and Legal Basis for Processing

Your data is processed for the following purposes and on the following bases:

• performance of the sales contract (Art. 6(1)(b) GDPR) — accepting and fulfilling Orders, delivery, handling complaints,
• fulfillment of legal obligations (Art. 6(1)(c) GDPR) — issuing invoices, maintaining accounting records, tax obligations,
• legitimate interest of the Controller (Art. 6(1)(f) GDPR) — defense against claims, marketing of own products to existing Customers,
• consent (Art. 6(1)(a) GDPR) — for newsletters and marketing cookies.

4. Data Recipients

Your data may be transferred to the following categories of recipients:

• payment operators supporting transactions in the Store,
• courier companies and postal operators performing deliveries,
• IT service providers (Shopify hosting, email system),
• accounting office supporting the Controller,
• authorized state bodies — in cases provided for by law.

5. Data Retention Period

Personal data is stored:

• for the duration of the contract and the period of limitation of claims (usually 6 years),
• for accounting documentation — for 5 years from the end of the tax year in which the tax obligation arose,
• for consent (newsletter) — until its withdrawal.

6. Cookies

The Store uses cookies for the following purposes:

• necessary cookies — for the proper functioning of the Store (cart, session),
• analytical cookies — for analyzing website traffic (e.g., Google Analytics, Shopify Analytics),
• marketing cookies — only with your consent.

You can change your cookie settings in your browser at any time.

7. Your Rights

In connection with data processing, you have the right to:

• access your data,
• rectify data,
• erase data ("right to be forgotten"),
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal),
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

To exercise the above rights, please contact the Controller at the e-mail address: lean.bulls@gmail.com.

8. Transfer of Data Outside the EEA

Due to the use of Shopify and Google services, your data may be transferred to third countries (USA). Transfers are based on standard contractual clauses approved by the European Commission and the Data Privacy Framework program.

9. Final Provisions

This Privacy Policy is effective from May 1, 2026. The Controller reserves the right to update it. Customers will be informed of significant changes via e-mail.