Privacy policy

La Casa de los Andes Privacy Policy

Last updated: 12 September 2026

1. Data controller

The controller of personal data processed in connection with the use of the La Casa de los Andes online store is:

Maciej Skórski - La Casa de los Andes
ul. Wolska 45/174
01-201 Warszawa
Poland

Tax identification number (NIP): 8971560214
Business registry number (REGON): 022491908

Email: biuro@lacasadelosandes.com
Telephone: +48 790 362 802

For matters concerning the processing of personal data or the exercise of data rights, you can contact us using the details above.

2. Data we process

Depending on how you use the store, we may process, in particular:

first and last name,
delivery and billing addresses,
email address,
telephone number,
information about orders, products purchased and returned, and the selected delivery method,
payment information and transaction status,
customer account information, if you use an account,
the content of correspondence and requests sent to us,
data required to issue sales documents,
IP address and information about your device, operating system and browser,
information about your use of the store, its pages and shopping cart, and your interactions with our services,
information about marketing consent and cookie preferences.

Full payment card details are generally processed by payment providers, rather than directly by La Casa de los Andes. We receive the information necessary to confirm and settle the transaction.

3. Purposes and legal bases for processing

Personal data may be processed for the following purposes:

Fulfilling orders and sales contracts
We process data to accept orders, handle payments, prepare and dispatch products, contact you about your order, handle returns and carry out other activities necessary to perform the contract.

The legal basis is Article 6(1)(b) of the GDPR — processing necessary for the performance of a contract or to take steps before entering into a contract.

Compliance with legal obligations
Data may be processed, in particular, to fulfil tax, accounting and record-keeping obligations.

The legal basis is Article 6(1)(c) of the GDPR — compliance with a legal obligation to which the controller is subject.

Customer service, complaints, and the establishment, exercise or defence of legal claims
We may process data to answer questions, preserve evidence, establish, exercise or defend legal claims, and protect the store against misuse.

The legal basis may be Article 6(1)(b), (c) or (f) of the GDPR, depending on the nature of the matter. Our legitimate interests include protecting our rights, maintaining store security and providing proper customer service.

Newsletter and direct marketing
If a customer voluntarily gives the relevant consent, their contact details may be used to send newsletters and information about products, new arrivals and promotions.

Where consent is required, the legal basis for processing is Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

Analytics, personalisation and advertising
Depending on the user's consent to cookies and similar technologies, data may be used to analyse store usage, measure advertising effectiveness, personalise the shopping experience and tailor advertising.

Where the law requires consent, processing is based on Article 6(1)(a) of the GDPR.

4. Shopify and Shopify Network Intelligence

Our store is hosted and technically supported by Shopify.

Shopify processes information about store usage and purchases to enable the store to operate, process payments, maintain security and provide other platform services.

We have enabled Shopify Network Intelligence. This allows Shopify to securely use information from users' interactions with our store, together with information from interactions with other merchants and with Shopify, to provide so-called Enhanced Services.

Enhanced Services may be used, among other things, to:

provide a more personalised shopping experience,
better tailor products and content,
improve store performance and security,
measure use of the store and advertising,
display more relevant advertisements.

In connection with these services, information about the user's activity in the store may be shared with Shopify and other technology service providers, including those located outside the user's country.

For certain Enhanced Services, Shopify may act as a separate data controller and be independently responsible for specific processing operations and for fulfilling users' rights relating to those operations.

More information is available in the Shopify Consumer Privacy Policy.

Users may also use the Shopify Privacy Portal, to learn about their rights in relation to Shopify, withdraw consent or object to certain processing activities, where they have such rights under applicable law.

Shopify Consumer Privacy Policy

Shopify Privacy Portal

5. Cookies and similar technologies

The store uses cookies and similar technologies.

Some are essential for the proper operation of the store, in particular for:

the shopping cart and checkout,
maintaining security,
remembering basic settings,
fulfilling orders.

Other cookies may be used for analytics, personalisation and marketing.

For users in Poland and other regions where this is required, non-essential tracking technologies are used in accordance with the preferences expressed by the user through the cookie banner.

Users can change or withdraw their cookie preferences using the tools available in the store.

For Shopify Network Intelligence, not consenting to non-essential cookies appropriately limits Shopify's use of device data for non-essential purposes, including advertising.

6. Who we may share data with

Personal data may be shared with providers whose services we use to run the store, only to the extent necessary for the relevant purpose.

These may include, in particular:

Shopify — store hosting, checkout, payments, security, analytics and other platform features,
payment providers, including providers of payment methods available through Shopify Payments,
InPost — for courier shipments and deliveries to parcel lockers and collection points,
Progus — in connection with integrating InPost collection point selection with the Shopify store,
email and communication service providers, including Google Workspace,
accounting, tax and legal service providers,
IT infrastructure, security, analytics and marketing service providers,
public authorities where disclosure is required by law.

We do not sell customers' personal data to other businesses as our own database.

7. Transfers outside the European Economic Area

Some service providers, in particular Shopify and other global technology providers, may also process data outside the European Economic Area.

Where data is transferred to a country for which the European Commission has issued an adequacy decision, the transfer takes place on that basis.

In other cases, appropriate mechanisms provided for by the GDPR are used, in particular standard contractual clauses approved by the European Commission or other legally permitted safeguards.

8. How long we retain data

We retain data for no longer than necessary to fulfil the purpose for which it was collected, and subsequently for the period required by applicable law or necessary to safeguard potential claims.

In particular:

we retain order and payment records for the period required by tax and accounting regulations,
we may retain data necessary for the exercise or defence of legal claims until the applicable limitation period has expired,
we retain customer account data while the account is active and, after its deletion, only to the extent required by law or necessary to protect legal claims,
we retain data processed on the basis of marketing consent until that consent is withdrawn or the relevant marketing purpose ends,
information stored through cookies is retained in accordance with the settings of each cookie and the user's preferences.

9. Is providing data mandatory?

Providing the data marked as required during checkout is necessary to enter into and perform the sales contract.

Failure to provide this data may prevent an order from being placed or fulfilled.

Providing data for newsletters or other marketing activities is voluntary and is not a condition of making a purchase.

10. Your rights

Under the conditions set out in the GDPR, users may have:

the right of access to their data,
the right to receive a copy of their data,
the right to rectification,
the right to erasure,
the right to restriction of processing,
the right to data portability,
the right to object to processing based on a legitimate interest,
the right to withdraw consent at any time where processing is based on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you can contact us at:

biuro@lacasadelosandes.com

We may request information necessary to verify the identity of the person making the request.

11. Right to lodge a complaint

If users believe their data is being processed unlawfully, they have the right to lodge a complaint with a supervisory authority.

In Poland, the competent authority is:

the President of the Personal Data Protection Office (UODO).

Exercising the right to lodge a complaint does not restrict access to other legal remedies.

12. Profiling and automated processing

The use of Shopify technologies and, with the user's consent, analytics and marketing tools may involve profiling, in particular the analysis of users' interests and activity to personalise content, recommendations and advertising.

La Casa de los Andes does not use profiling to make solely automated decisions that produce legal effects concerning users or similarly significantly affect them.

Separately, payment providers and security service providers may use their own automated systems to detect fraud and assess transaction security in accordance with their own privacy policies.

13. Data security

We apply appropriate organisational and technical measures to protect personal data against unauthorised access, loss, alteration or disclosure.

We also use the safeguards provided by Shopify and other technology service providers.

However, no IT system can guarantee absolute data security.

14. Children's data

The store is not specifically directed at children.

If we learn that a child's data has been provided to us without the required legal basis or the consent of their legal representative, we will take appropriate action in accordance with applicable law.

15. Third-party links and services

The store may contain links or integrations leading to services provided by third parties.

When you visit an external website or application, your data is processed in accordance with its operator's policies.

We recommend reading the relevant provider's privacy policy.

16. Changes to this Privacy Policy

This Privacy Policy may be updated periodically, in particular following changes in legislation, the technologies used in the store, service providers or data processing practices.

The current version of the Privacy Policy is published in the store together with the date of the latest update.