Privacy policy

Last updated: 2026-10-29

1. Controller

Your personal data is controlled by DAMIAN CHMIELEWSKI. SKRATCHORAMA. OSMIO WATER POLSKA., ul. Władysława Pytlasińskiego 16 lok. 13, 00-777 Warszawa, NIP 9562144950, REGON 381187078, registered in CEIDG (Poland). Contact for privacy matters: info@skratchorama.com.

2. What we collect and why

Shop orders: name, email, phone, delivery address or parcel locker code, ordered products and payment status — to fulfil and ship your order and handle returns and complaints (contract, Art. 6(1)(b) GDPR) and keep accounting records (legal obligation, Art. 6(1)(c)).
School account: email and password (stored only as a secure hash), purchases, consents and lesson progress — to give you access to the course (contract).
Transactional emails: order confirmation, shipping notice, password reset. No newsletters or ads.
Technical data: IP address and server logs — to keep the site secure and working (legitimate interest, Art. 6(1)(f)).

Providing data is voluntary, but we can't fulfil an order without it. We never see your card details.

3. Who processes your data

Heroku (Salesforce) — website hosting (EU servers).
Supabase — database and accounts (EU servers, Ireland).
Resend — sending emails (EU servers, Ireland).
Bunny.net — video streaming (EU).
Carriers (InPost, courier companies, including via the broker BLPaczka / Base Courier) — delivery; they receive your name, address or parcel locker, phone and email.
Tpay (Krajowy Integrator Płatności S.A.) and PayPal — payments; they process payment data as independent controllers under their own privacy policies.
Google (Workspace) — the mailbox that receives our correspondence with you.

Where a provider transfers data outside the European Economic Area (e.g. to the USA), this is done under the European Commission's standard contractual clauses or an adequacy decision.

4. How long we keep it

Orders and purchases — 5 years from the end of the tax year (tax law), or until a dispute ends.
Account — until you delete it (write to us).
Server logs — up to 90 days.

5. Your rights

You can ask for access to your data, correction, deletion, restriction, a copy to take elsewhere, and object to processing based on legitimate interest. Write to info@skratchorama.com. You can also complain to the Polish data protection authority (Prezes UODO, uodo.gov.pl) or the authority in your country.

6. Cookies

We only use cookies needed for the site to work: cart, chosen language, school currency and — when logged in — your session. No advertising or analytics cookies.