Privacy Policy

Data controller

The controller of your personal data is Aperto Spółka z ograniczoną odpowiedzialnością (brand: Maker Core), with its registered office in Warsaw (ul. Grzybowska 87, 00-844), tax ID (NIP) 5272692210, REGON 146623535, KRS 0000444048, email: hello@makercore.pl — the "Controller" or "Seller".

We define the category of data, its purpose and the legal basis at the moment of collection — as described below. We do not collect data for any other purposes than the ones described in this policy.

Purposes and legal bases

Providing data is always voluntary, but necessary for orders and accounts — without it you cannot place an order or create an account.

Categories of data collected

Payments are handled by an external payment operator — we do not keep card numbers or sensitive payment data. We only see the transaction identifier, its status and the amount.

Retention period

• Order data and sales documents — as long as required by tax and accounting law (as a rule, 5 years from the end of the calendar year in which the tax obligation arose); afterwards, data used solely for account management is deleted
• Customer account — for as long as you use the account; after account deletion (by you or on your request) we delete the account data, except for data we must retain under separate law (e.g. sales records) or to defend claims
• Newsletter — until consent is withdrawn (link in every message) or until bounce data shows the address is inactive
• Enquiries (form, email, support) — until the matter is closed, and thereafter until limitation periods for claims expire if the matter requires it
• Reviews — for as long as published in the Store; you may request removal of your review at any time
• Technical form limits (IP hash) — at most 1 hour after the last form submission
• Cookies and consent preferences — at most 12 months from consent (we ask again afterwards)

Recipients of data

Your data may be shared with the following categories of recipients:

• Payment operators — handling online payments and reporting transaction status (target: Stripe)
• Carriers and delivery operators — name, address, phone (for delivery notifications) — limited to what is necessary to deliver your order
• IT infrastructure providers — backend and database hosting, content delivery network and DNS (Cloudflare), email-sending service (order confirmations, accounts, newsletter), application error-monitoring service
• External advisers — accounting and legal support, limited to what is necessary to meet legal obligations
• Public authorities — only where provided for by law (e.g. on request of an empowered authority)

We do not sell your data and do not pass it to third parties for their own marketing.

Transfers outside the EEA

Some service providers run infrastructure outside the European Economic Area as well (including Cloudflare and Stripe — United States). Transfers take place on terms secured by those providers under the adequacy decision for the Data Privacy Framework or — for the remaining ones — on the basis of Standard Contractual Clauses approved by the European Commission, together with additional technical safeguards.

Cookies

Cookies are small text files stored by your browser. We use them in three categories:

• Necessary — required for the Store to work: session, cart contents, session identifier, security. These do not require consent and cannot be disabled without losing the ability to shop.
• Analytical — anonymous traffic and on-site behaviour statistics that help us improve the Store. Require your consent.
• Marketing — measuring campaign effectiveness and tailoring messages. Require your consent.

For all cookies beyond the necessary ones we ask in the banner at your first visit and store your decision (changeable at any time via the cookie settings in the footer). Preferences are stored for at most 12 months. Your browser also lets you delete and block cookies entirely — disabling necessary cookies will limit Store features (cart, account, checkout).

Newsletter

Signing up for the newsletter means consenting to receive information about the store launch, new products and maker content. You sign up by entering your email address (the form on the site and the landing page). You can remove a stored address:

• via the "unsubscribe" link in every message, or
• by emailing hello@makercore.pl from the subscribed address.

Mailing lists are kept solely for Maker Core's own messages — we do not pass them on for third-party campaigns.

Product reviews

A review is published after verification that it comes from a real buyer. We publish the first name or nickname, the rating, the text and — if you add them — photos. Photos are published only with your review and are not used in other materials without separate consent. You can request removal or hiding of your review at any time by writing to hello@makercore.pl.

Automated decisions and profiling

We do not make decisions based solely on automated processing that produce legal effects or similarly affect you (such as automatic refusal to fulfil an order). The product search sorts and filters results by criteria that you choose yourself.

Data security

Among other measures, we use:

• TLS encryption across the whole site;
• storing account passwords only as cryptographic hashes;
• automated database backups;
• access control over the admin panel and infrastructure (limited group of people);
• time limits and rate limiting on public forms;
• separation of secrets and keys (never stored in code or the repository).

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will inform you in line with the obligations under the GDPR.

Your rights

Under the GDPR you have the right to:

1. access — information about the data we process and a copy of it (Art. 15 GDPR);
2. rectification — correction of outdated or incorrect data (Art. 16 GDPR);
3. erasure — the "right to be forgotten" when there is no longer a basis for processing (Art. 17 GDPR);
4. restriction of processing — including when you contest the accuracy of data (Art. 18 GDPR);
5. data portability — receiving your data in a structured, commonly used machine-readable format (Art. 20 GDPR);
6. object — to processing based on legitimate interest, including direct marketing (Art. 21 GDPR);
7. withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).

We handle requests without undue delay, as a rule within one month. Exercise them by writing to hello@makercore.pl — if we need to verify your identity, we will only ask for the data necessary for that purpose.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if you believe that processing of your data infringes the GDPR.

Changes to this policy

The policy may be updated — we always publish the date of the last change. For changes material to the purpose and manner of processing we will inform you more prominently (a notice in the Store or an email to account holders). Continued use of the Store after the changes take effect means you have reviewed the current version.

Contact

For all matters concerning personal data:

• email: hello@makercore.pl
• address: Aperto Sp. z o.o., ul. Grzybowska 87, 00-844 Warsaw, Poland

You have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

This store operates under Polish law. In case of any discrepancy, the Polish version of this policy prevails.