Privacy policy

Data controller and contact

Bengaku Mateusz Szczepański
Polish tax ID (NIP): 9522248519

Personal data enquiries: nihao@xiudao.eu

Purpose and legal basis

For an offer or order enquiry, we process your email address, message and information you provide as necessary to prepare an offer, agree details and perform a contract — Article 6(1)(b) GDPR. For a contact person acting for a club, school or business, our legitimate interest in communication and cooperation is the basis — Article 6(1)(f) GDPR.

For other questions, our legitimate interest is responding to your message — Article 6(1)(f) GDPR. This basis also covers website security and establishing, exercising or defending specific legal claims. If an order is placed, tax and accounting obligations are based on Article 6(1)(c) GDPR.

Providing data is voluntary, but without a reply address and information needed for your request, we may be unable to respond or fulfil an order. We do not request sensitive data. We do not make solely automated decisions producing legal effects, use profiling or operate a newsletter.

Basket

The basket stores product IDs, options and quantities in localStorage on your device. We also remember a language you manually select. These records are not automatically sent to our server. Clear the basket on its page and remove other records in your browser settings. Device storage supports the basket and chosen language; we use no analytics, advertising cookies or tracking.

Data recipients and Google services

Authorised persons may access data. As necessary, recipients may include email, hosting and IT providers and, for an order, accounting services, advisers and a carrier. Public authorities receive data only where required by law. Providers acting on our behalf should be bound by an appropriate processing agreement; other recipients may act as independent controllers.

The website currently uses no Google Forms, Google Analytics or externally hosted Google fonts. Browsing does not load those services or send them basket data. Preparing a product list does not send a message; you share it through your chosen contact channel.

If a provider transfers data outside the European Economic Area, we require a basis under Chapter V GDPR: a relevant European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses and necessary protective measures. Contact us for information on recipients, processing locations and a copy of the safeguards used.

Retention and individual rights

• General enquiries that do not lead to an order: while handling the matter and then for up to 12 months after correspondence ends, where necessary for follow-up. Unnecessary data is deleted earlier. This is our organisational retention policy, not a legal requirement to retain every message for a year.
• Orders and complaints: during fulfilment and handling of requests. Afterwards, only data needed for legal obligations or specific legal claims is retained until the applicable limitation period expires. The period depends on the type of claim, special rules and any suspension or interruption; no single period applies to every case.
• Tax records: generally until five years have passed from the end of the calendar year in which the relevant tax payment was due, with extensions where Polish law provides. Technical connection data is used as necessary to deliver the page; security incident information is retained as necessary to investigate the incident and protect relevant legal claims.
• Basket data and your saved language remain in your browser until you remove them or clear site storage. Closing the tab does not automatically erase them.

Your rights

You may request access and a copy, rectification, erasure or restriction under the conditions in the GDPR. Portability also applies where processing is automated and based on a contract or consent. Erasure may be limited by a legal obligation or the need to protect legal claims.

You may object on grounds relating to your particular situation to processing based on Article 6(1)(f) GDPR. We will stop unless we demonstrate overriding legitimate grounds or a need to protect legal claims. If future processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

Write to nihao@xiudao.eu to exercise your rights. We normally respond within one month; complex or numerous requests may require two additional months, with notice during the first month. You may also complain to the President of the Polish Personal Data Protection Office (UODO).