Privacy policy
Privacy Policy
Last updated: June 25, 2026
This Privacy Policy explains what personal data we collect, for what purpose we process it, on what legal basis, how long we store it, and what rights you have in connection with this processing.
1. Data Controller
The controller of your personal data is:
LEAN BULLS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ul. Polska 7, 81-339 Gdynia, Poland NIP: 9581731631 • REGON: 524523420 • KRS: 0001019797 E-mail: lean.bulls@gmail.com
(hereinafter: "we," "Lean Bulls Labs," or the "Controller")
For all matters concerning the protection of your personal data, you can contact us at the e-mail address above.
2. What Data We Process and for What Purpose
| Purpose of processing | What data | Legal basis |
|---|---|---|
| Order fulfillment (conclusion and performance of the sales contract) | first name, last name, delivery address, e-mail address, phone number, order details | Art. 6(1)(b) GDPR — performance of a contract |
| Payment for the order | transaction data transferred to the payment operator (Stripe / Shopify Payments) | Art. 6(1)(b) GDPR — performance of a contract |
| Order shipping | first name, last name, delivery address, phone number — transferred to the carrier (courier, InPost) | Art. 6(1)(b) GDPR — performance of a contract |
| Handling returns and complaints | order details, contact details, bank account number (for refunds) | Art. 6(1)(b) and (c) GDPR — performance of a contract and legal obligation |
| Sending newsletters and marketing messages (e-mail) | e-mail address, first name, purchase history and on-site behavior (for offer personalization) | Art. 6(1)(a) GDPR — your consent |
| Website traffic analysis and statistics | data on website usage (Google Analytics) | Art. 6(1)(a) GDPR — your consent (analytics cookies) |
| Online advertising (Meta/Facebook Ads) | data on website activity and ad interactions | Art. 6(1)(a) GDPR — your consent (marketing cookies) |
| Handling complaints and inquiries | contact details, content of correspondence | Art. 6(1)(b) and (f) GDPR — performance of a contract and legitimate interest |
| Issuing invoices and accounting documents | data required by tax regulations | Art. 6(1)(c) GDPR — legal obligation |
| Defending against and establishing claims | order and correspondence data | Art. 6(1)(f) GDPR — legitimate interest |
3. Who We Share Your Data With
Your personal data may be shared with the following categories of recipients, to the extent necessary to achieve the purposes listed above:
- Shopify — provider of the platform on which our store operates (storage of order and customer account data)
- Stripe / Shopify Payments — payment operator, processing transaction data
- Klaviyo — provider of the newsletter and e-mail marketing automation system
- Courier companies and InPost — to the extent necessary to deliver the order
- Google (Google Analytics) — for the purpose of analyzing website visit statistics
- Meta Platforms (Facebook/Instagram Ads) — for the purpose of running advertising campaigns
- Accounting office — to the extent necessary for tax settlements
- Public authorities, where required by applicable law
Some of the above providers (e.g., Google, Meta) may process data on servers located outside the European Economic Area (e.g., in the USA). In such cases, they rely on mechanisms ensuring an adequate level of data protection, such as standard contractual clauses approved by the European Commission.
4. How Long We Store Your Data
| Data category | Retention period |
|---|---|
| Customer account data | until the account is deleted at your request or due to a period of account inactivity |
| Order data | for the period required by tax and accounting regulations (standard: 5 years from the end of the year in which the order was placed) |
| Marketing consent (newsletter) | until consent is withdrawn (unsubscribing from the newsletter) |
| Data processed on the basis of cookie consent | as indicated in the cookie settings — see Section 6 |
| Complaint correspondence and inquiries | for the period necessary to handle the inquiry and the statute-of-limitations period for claims (standard: up to 6 years) |
5. Your Rights
In connection with the processing of your personal data, you have the following rights:
- Right of access — you may ask what data we process about you.
- Right to rectification — you may request correction of inaccurate or outdated data.
- Right to erasure ("right to be forgotten") — you may request deletion of your data if there is no legal basis for its continued processing.
- Right to restriction of processing — you may request a temporary restriction of data processing in certain situations.
- Right to data portability — you may receive your data in a structured, commonly used format and transfer it to another controller.
- Right to object — you may object at any time to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent — where processing is based on consent (e.g., newsletter, marketing cookies), you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- Right to lodge a complaint — you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your data violates applicable regulations.
To exercise the above rights, write to us at lean.bulls@gmail.com. We will respond no later than one month from receiving your request.
How to Unsubscribe from the Newsletter
You can withdraw your consent to receive marketing messages at any time by clicking the "unsubscribe" link at the bottom of each e-mail, or by writing to us at lean.bulls@gmail.com.
6. Cookies
Our website uses cookies — small text files saved in your browser.
Types of Cookies We Use
| Type of cookies | Purpose | Consent required? |
|---|---|---|
| Necessary | Ensuring basic website functionality (cart, login, security) | No — necessary for the store to function |
| Analytics (Google Analytics) | Analyzing traffic and website usage to improve it | Yes |
| Marketing (Meta/Facebook, Klaviyo) | Personalizing ads and measuring the effectiveness of advertising and e-mail campaigns | Yes |
Managing Cookie Consent
On your first visit to our website, we display a banner allowing you to consent to specific categories of cookies. You can change your preferences at any time through the cookie settings available on the website or through your web browser's settings.
Disabling necessary cookies may affect the proper functioning of the store (e.g., the cart feature).
7. Data Security
We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or disclosure, including encrypted connections (SSL/TLS) and the use of reputable service providers (Shopify, Stripe, Klaviyo, Google) that meet the security standards required by the GDPR.
8. Children's Data
Our products and store are intended for adults. We do not knowingly collect personal data from individuals under 16 years of age. If we learn that we have collected personal data from a minor without the consent of their legal guardian, we will take steps to delete it.
9. Changes to This Privacy Policy
We may periodically update this Privacy Policy, in particular in connection with changes to legal regulations or the introduction of new features in the store. We will inform you of significant changes through a clear notice on the website or by e-mail (if you are subscribed to the newsletter).
10. Contact
For matters concerning the protection of personal data, you can contact us at:
Lean Bulls Labs sp. z o.o. ul. Polska 7, 81-339 Gdynia, Poland E-mail: lean.bulls@gmail.com
This Privacy Policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.
