Privacy Policy

Privacy Policy

Last updated: 3 November 2026

1. Introduction and Scope

This Privacy Policy explains how ORKATEK POLAND sp. z o.o. (“ORKATEK POLAND”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data in connection with the D’S Damat online store, customer accounts, purchases, deliveries, returns, customer support and related services.

ORKATEK POLAND is a company established in Poland and operates the D’S Damat online store at dsdamat.eu, including country-specific domains and storefronts operated by ORKATEK POLAND where this Privacy Policy is displayed.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection laws.

Where mandatory local data protection requirements apply, we comply with those requirements in addition to this Privacy Policy.

2. Data Controller and Contact Information

The data controller responsible for the processing of personal data covered by this Privacy Policy is:

ORKATEK POLAND sp. z o.o.

Registered address: ul. Młynarska 42, lok. 115, 01-171 Warsaw, Poland

For privacy-related questions, data protection requests or concerns about the processing of your personal data, please contact support@dsdamat.eu.

Where other group companies or service providers participate in our operations, their data protection responsibilities are determined according to their actual roles and applicable law.

3. Personal Data We Collect

Depending on how you interact with our online store, we may collect and process the following categories of personal data.

Identity and contact information

  • First name and surname

  • Email address

  • Telephone number

  • Billing and delivery addresses

Order and transaction information

  • Products purchased

  • Order numbers and purchase history

  • Payment status and transaction references

  • Billing and invoicing information

  • Shipping, delivery and tracking information

  • Returns, refunds and complaints

Customer account information

  • Account identification and profile information

  • Saved addresses and preferences

  • Account activity and order history

Customer service information

  • Emails and other communications

  • Customer enquiries and complaints

  • Return requests and related correspondence

Technical and website usage information

  • IP address and device information

  • Browser type and operating system

  • Website interaction and usage information

  • Cookie identifiers and similar technologies

  • Advertising and analytics identifiers, where permitted

Marketing information

  • Marketing communication preferences

  • Newsletter subscriptions

  • Consent records

  • Advertising interactions and campaign attribution information

We do not intentionally collect special categories of personal data unless such processing is necessary and permitted by applicable law.

4. Purposes and Legal Bases for Processing

We process personal data only where we have a valid legal basis under Article 6 of the GDPR.

Purpose Legal basis
Processing purchases, payments, deliveries and returns Article 6(1)(b) – Performance of a contract
Creating and managing customer accounts Article 6(1)(b) – Performance of a contract
Responding to customer service requests relating to purchases Article 6(1)(b) – Performance of a contract
Issuing invoices and complying with tax, accounting and legal obligations Article 6(1)(c) – Legal obligation
Preventing fraud and protecting website security Article 6(1)(f) – Legitimate interests
Handling legal claims and protecting legal rights Article 6(1)(f) – Legitimate interests
Sending marketing communications Article 6(1)(a) – Consent, or another applicable legal basis where permitted by law
Using non-essential analytics and advertising technologies Article 6(1)(a) – Consent, where required
Improving website performance and customer experience Article 6(1)(f) – Legitimate interests, where applicable, or consent where required

Our legitimate interests may include maintaining secure and reliable services, preventing fraud, improving operational efficiency, responding to enquiries and protecting our legal rights.

Where processing requires consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Sources of Personal Data

We primarily collect personal data directly from you when you:

  • Visit our website

  • Create or use a customer account

  • Place an order

  • Request a return or refund

  • Contact customer support

  • Subscribe to marketing communications

  • Interact with our website or advertisements

We may also receive personal data from payment service providers, logistics partners, technology providers and other service providers involved in fulfilling your order or providing our services.

Where customer information has been transferred to ORKATEK POLAND from a previous operator of a D’S Damat online store, we process such information only for lawful and specified purposes, subject to applicable data protection requirements.

Where Article 14 of the GDPR applies, we provide the required information about the source, categories and purposes of processing within the applicable legal timeframe, unless a lawful exception applies.

6. Sharing Personal Data

We may share personal data with trusted third parties where necessary to operate our online store, fulfil orders, provide customer services or comply with legal obligations.

These recipients may include:

E-commerce and technology providers

We use Shopify as part of our e-commerce infrastructure to support online store operations, customer accounts, orders and related services.

Other technology providers may support website hosting, integrations, analytics, security and operational processes.

Payment service providers

Payment information may be processed by authorised payment service providers to complete transactions, manage payment security and process refunds.

We do not require customers to provide complete payment card details directly to our customer service team.

Logistics and fulfilment providers

Customer names, delivery addresses, telephone numbers and order-related information may be shared with shipping companies, fulfilment providers, customs intermediaries and other logistics partners where necessary to deliver orders or process returns.

Group companies and operational partners

Relevant personal data may be shared with authorised group companies and operational partners where necessary for order fulfilment, customer service, logistics, technology support or other legitimate business operations.

Such sharing is subject to applicable data protection requirements and appropriate contractual and organisational safeguards.

Marketing and analytics providers

Subject to applicable consent requirements and your privacy preferences, we may use:

  • Meta Platforms Ireland Limited: Meta Pixel, Meta Ads, conversion measurement and advertising.

  • Google Ireland Limited: Google Ads, conversion tracking, remarketing and advertising measurement.

Depending on the specific processing activity, these providers may act as independent controllers, joint controllers or processors.

Professional advisers and public authorities

We may disclose personal data to accountants, auditors, legal advisers, tax advisers and competent authorities where required or permitted by law.

We require processors acting on our behalf to provide appropriate contractual, technical and organisational safeguards.

We do not sell personal data to third parties for monetary consideration.

7. International Data Transfers

ORKATEK POLAND is established in Poland, within the European Economic Area (“EEA”).

In connection with our international e-commerce operations, personal data may be accessed or processed by authorised service providers, group companies or business partners located outside the EEA.

Such activities may include international shipping, order fulfilment, customer support, technology services, website administration and advertising services.

For example, where orders are fulfilled through operational partners in Türkiye, the personal data necessary for preparing, dispatching and delivering orders may be made available to the relevant authorised recipients.

Certain technology, advertising and cloud service providers may also process or access personal data outside the EEA, including in the United States.

Where an international transfer is subject to Chapter V of the GDPR, we use a valid transfer mechanism, as applicable, such as:

  • An adequacy decision adopted by the European Commission;

  • The European Commission's Standard Contractual Clauses, together with supplementary safeguards where required;

  • Another legally recognised transfer mechanism under the GDPR.

We assess relevant transfer arrangements and apply appropriate safeguards to protect personal data.

You may contact support@dsdamat.eu for further information about applicable international transfers and how to obtain information about the relevant safeguards.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or to comply with applicable legal obligations.

Retention periods depend on the type of information, the purpose of processing and applicable legal requirements.

Orders, invoices and accounting records

These records are retained for the periods required by applicable Polish and other relevant tax, accounting and legal obligations.

Customer account information

Account information is generally retained while the customer account remains active. Following account closure, relevant information may be retained where necessary to comply with legal obligations, resolve disputes or establish, exercise or defend legal claims.

Customer service communications

Customer service correspondence is retained for as long as necessary to resolve enquiries and complaints and, where applicable, for relevant legal limitation periods.

Marketing information

Marketing preferences and consent records are retained as necessary to manage communication preferences, demonstrate compliance and respect consent withdrawals or objections.

Technical and security information

Technical records are retained for periods proportionate to their operational and security purposes.

Cookies and similar technologies

Specific cookie durations and related information are described in our Cookie Policy or cookie preference management tool.

Once personal data is no longer required, we delete or anonymise it, unless continued retention is required or permitted by law.

9. Cookies, Analytics and Advertising

Our website uses cookies and similar technologies to support essential website functionality, security, performance measurement and, where permitted, personalised advertising.

These technologies may include:

  • Strictly necessary cookies

  • Functional cookies

  • Analytics and performance cookies

  • Advertising and marketing cookies

Strictly necessary cookies support essential website functions and may operate without consent where permitted by applicable law.

Non-essential cookies and similar tracking technologies are used only where the required consent or other lawful authorisation has been obtained.

Subject to your preferences, we may use technologies provided by Google and Meta to measure advertising performance, understand website interactions and display relevant advertisements.

You can manage or withdraw your cookie preferences through our website's cookie preference management tool.

Further information is available in the Cookie Policy accessible through our website.

10. Marketing Communications and Profiling

We may send newsletters, promotional offers, product announcements and other marketing communications where permitted by applicable law.

Where consent is required, marketing communications are sent only after valid consent has been obtained.

You may unsubscribe from promotional emails at any time by using the unsubscribe link in the communication or contacting support@dsdamat.eu.

We may use customer preferences, purchase history and website interactions to understand customer interests and, where legally permitted, personalise marketing communications or advertising.

Where personalised advertising relies on cookies or similar technologies requiring consent, we respect your cookie preferences.

We do not use solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning individuals within the meaning of Article 22 of the GDPR.

Operational communications relating to orders, payments, deliveries, returns, security or customer service are not considered promotional communications and may be sent where necessary and lawful.

11. Your Data Protection Rights

Subject to applicable legal conditions and limitations, you have the right to:

  • Access: Request information about personal data we process concerning you.

  • Rectification: Request correction of inaccurate or incomplete personal data.

  • Erasure: Request deletion of your personal data where applicable.

  • Restriction: Request restriction of processing in certain circumstances.

  • Data portability: Receive certain personal data in a structured, commonly used and machine-readable format and request its transfer where applicable.

  • Objection: Object to processing based on legitimate interests in certain circumstances.

  • Direct marketing objection: Object at any time to processing for direct marketing purposes, including related profiling.

  • Withdrawal of consent: Withdraw consent at any time where processing is based on consent.

  • Complaint: Lodge a complaint with a competent data protection supervisory authority.

To exercise these rights, please contact:

support@dsdamat.eu

We may request reasonable information to verify your identity before responding to a request.

We normally respond within one month of receiving a valid request. Where permitted by the GDPR, this period may be extended by up to two additional months depending on the complexity and number of requests. We will inform you of any extension and the reasons for it within the initial one-month period.

12. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or unlawful disclosure.

These measures may include access controls, authentication procedures, secure communications, service provider assessments and other security practices appropriate to the nature of the processing and associated risks.

Access to personal data is restricted to authorised personnel and service providers who require access for legitimate business purposes.

Although we take reasonable measures to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.

13. Supervisory Authorities

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed in violation of applicable data protection law.

The data protection supervisory authority in Poland is:

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Website: https://uodo.gov.pl/

Depending on the circumstances, you may also lodge a complaint with the supervisory authority in the EU or EEA Member State of your habitual residence, place of work or the place of the alleged infringement.

Information about national data protection supervisory authorities is available from the European Data Protection Board:

https://www.edpb.europa.eu/contact/contact-dpas_en

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, legal requirements or data processing activities.

The most recent version will be made available on our website with an updated revision date.

Where required by applicable law, we will provide additional notice or obtain consent before implementing relevant changes to our processing activities.

15. Contact

For any questions regarding this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact:

ORKATEK POLAND sp. z o.o.

ul. Młynarska 42, lok. 115
01-171 Warsaw, Poland

Email: support@dsdamat.eu
Website: https://dsdamat.eu

Last updated: 3 November 2026