I Controller
The controller of your personal data is COMPLEX MONTAGE spółka z ograniczoną odpowiedzialnością, ul. Leśna 22, 77-400 Złotów, Poland. For anything about your data, write to kontakt@complexmontage.pl.
II What data we process and why
When you buy
At checkout we ask for your name, email address, country, street address, postal code and city, and optionally your company name, VAT ID and phone number. We use them to conclude and perform the contract: to take you to the payment page, issue the licence file in your name, send the download links to your email address and deal with any complaint.
For each order we keep an order record on our server: the items and amounts, the time of the order, its reference and stage, and your name, email address, company, country and VAT ID. The record powers your personal order page and is part of our accounting records.
Giving checkout details is voluntary, but without them we cannot conclude the contract, issue the licence or deliver the files.
When you write in the chat
Your chat conversation (the messages and their times, and the address of the page you wrote from) and your email address, if you leave one, are stored on the shop’s server so we can answer you: in the chat window, and by email if you left an address. A random identifier in a cookie links your browser to the conversation. Leaving an email address is optional.
When you email us
We use your email address and the content of your message to answer you. When the message concerns an order, it is kept with that order’s records.
When you visit the website
Our hosting provider in the EU/EEA records technical logs of requests to the website (IP address, time, requested address, browser information), which are used to keep the service secure and to diagnose errors. If you add something to the cart, a session cookie keeps the cart; if you ask us to, a cookie remembers your checkout details. The Cookies page lists every cookie.
III Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Concluding and performing the contract: checkout, payment, licence file, delivery of download links, order page, complaints | Art. 6(1)(b) — performance of a contract and steps taken at your request before concluding it |
| Keeping order and accounting records required by tax and accounting law | Art. 6(1)(c) — legal obligation |
| Replying to chat messages and emails; keeping the website and server secure (technical logs, form protection) | Art. 6(1)(f) — our legitimate interest in answering questions and securing the service |
Remembering your checkout details in the cm_buyer cookie | Art. 6(1)(a) — consent, given by ticking the box at checkout and withdrawn at any time with “Forget” |
IV How long we keep data
| Data | Kept for |
|---|---|
| Order records and accounting documents | 5 years from the end of the tax year in which the payment was made |
| Chat conversation and the email address left in the chat | 12 months after the last message |
Remembered checkout details (cm_buyer cookie) | 180 days, or until you click “Forget” on the checkout page |
Chat identifier (supchat_v cookie) | 1 year |
Cart session (PHPSESSID cookie) | Until you close the browser |
| Technical logs | Rotated by our hosting provider; used only for security and error diagnosis |
V Recipients
We do not sell personal data. It is disclosed only to the following categories of recipients:
- Payment provider. Your checkout details are passed to our payment provider to create a customer record and process the payment. It acts as merchant of record for the payment, emails you the receipt and processes payment data as a separate controller under its own privacy policy, shown on its payment page. Card details are entered only on that page and never reach our server.
- Hosting provider. Our hosting provider in the EU/EEA stores the website, the order records and the chat conversations on our behalf.
- Email provider. The service that sends our emails, including the download links, processes your email address and the messages on our behalf.
- Public authorities, such as tax authorities, when the law requires us to disclose data.
VI External requests
Some parts of each page are loaded from external services. When your browser requests them, the service sees your IP address and browser information, as with any web request. We do not send them any other data.
| Service | Address | What it loads |
|---|---|---|
| Google Fonts | fonts.googleapis.com, fonts.gstatic.com | The typefaces of the website |
| jsDelivr | cdn.jsdelivr.net | Payment method icons |
| Pexels | images.pexels.com | Photographs, including the chat operator’s photo |
VII Transfers outside the EEA
Our payment provider may process data outside the European Economic Area. Where it does, the transfer is based on an adequacy decision of the European Commission or on Standard Contractual Clauses. The external services listed in section 6 run global networks, so a request from your browser may be answered by a server outside the EEA. We do not otherwise transfer personal data outside the EEA.
VIII Your rights
You have the right to:
- access your data and receive a copy of it;
- have inaccurate data rectified;
- have your data erased, unless we must keep it, for example in accounting records;
- restrict processing;
- receive the data you gave us in a portable format;
- object to processing based on our legitimate interest;
- withdraw consent at any time, without affecting processing carried out before the withdrawal.
Write to kontakt@complexmontage.pl; we reply within one month. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, or with the data protection authority of the EU country where you live or work.
IX No profiling, analytics or advertising trackers
We do not profile visitors or buyers and make no automated decisions about you. The website has no analytics, no advertising trackers, no pixels and no social media plugins.
X Changes to this document
When the way we process data changes, we update this page and its effective date at the top of the page.