Privacy policy

Effective from 28 July 2026

This Privacy Policy explains how we process personal data in connection with the use of the INKY online store available at www.inkycosmetics.com, in particular when users browse the website, place and receive orders, use a customer account, contact the Store or subscribe to the newsletter.

In this document, GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council concerning the protection of individuals with regard to the processing of personal data.

1. Data Controller

The controller of personal data is Maximus Solaria Sp. z o.o., KRS number: 0000945663, Tax Identification Number: 5842636178, REGON number: 220531780.

The contact address for matters relating to the Store and the protection of personal data is ul. Kwiatowa 3, 84-207 Bojano, Poland. You can also contact us by email at shop@inkycosmetics.com.

2. Personal Data We Process

The scope of personal data we process depends on how the Store is used.

When an order is placed and fulfilled, we may process the customer's first and last name, email address, telephone number, delivery address, billing address and information relating to the products ordered, selected delivery and payment methods, order value and status, as well as any subsequent return, cancellation or complaint.

Where a purchase is made in connection with a business activity, we may also process the company name, company address, the company's Polish tax identification number (NIP) or, where applicable, another tax identification number, and the details of the person placing the order on behalf of the company.

In connection with payments, we process information necessary to confirm and settle the transaction, including the selected payment method, transaction status and transaction identifier. Detailed payment instrument information, such as a full payment card number, is generally processed by the payment service provider rather than directly by Maximus Solaria.

Where a user voluntarily creates a customer account, we may process profile details, saved addresses, order history and status, and account settings. Creating an account is not required to make a purchase.

Where a user contacts the Store, we process the data and information included in the correspondence, including information required to respond, manage an order, return or complaint, or handle another matter raised by the user.

When the website is used, certain technical data may also be collected automatically, including the IP address, information about the device, operating system and browser, date and time of the visit, technical logs, cookie identifiers and information about how the Store, shopping cart and checkout process are used.

3. Sources of Personal Data

We receive personal data primarily directly from users when they place an order, create an account, subscribe to the newsletter, contact us or use forms available in the Store.

Certain data is collected automatically when the website is used through cookies, logs and similar technologies.

We may also receive personal data from Shopify, payment service providers, courier companies and other service providers involved in operating the Store and fulfilling orders.

4. Purposes and Legal Bases for Processing

We process the data provided when an order is placed in order to take steps at the user's request before entering into a contract, accept and fulfil the order, process payment, prepare and deliver the products, communicate about the order and manage returns and complaints.

The legal basis for this processing is Article 6(1)(b) GDPR, as the processing is necessary to enter into and perform a contract.

We process data relating to invoices, accounting, taxation and obligations arising from consumer protection laws to the extent necessary to comply with legal obligations applicable to the Controller. The legal basis is Article 6(1)(c) GDPR.

Personal data may also be processed to ensure the security of the Store and payments, prevent fraud and misuse, diagnose technical problems, manage internal administration, preserve evidence and establish, pursue or defend legal claims. The legal basis is the legitimate interests of the Controller under Article 6(1)(f) GDPR.

Where a user creates a customer account, we process personal data to maintain that account, provide access to order history and allow the user to use account features. The legal basis is Article 6(1)(b) GDPR, as the processing is necessary to perform the customer account agreement.

5. Requirement to Provide Personal Data

Providing the information marked as required when placing an order is necessary to enter into and perform the contract, including processing payment, preparing sales documents and delivering the order. Failure to provide the required information will prevent the order from being placed or fulfilled.

Providing information required to create a customer account is voluntary. An order may be placed without creating an account.

Subscribing to the newsletter and consenting to optional cookies and similar technologies are voluntary. Refusing consent does not affect the ability to make a purchase.

6. Newsletter and Marketing Communications

Subscribing to the newsletter is voluntary. We primarily process the email address provided during subscription in order to send the newsletter.

The newsletter may contain information about products, collections, promotions, events and the activities of the INKY brand.

Where a user consents to marketing communications, we may also send reminders concerning products left in the shopping cart or an incomplete checkout process.

The legal basis for processing personal data for newsletters and other marketing communications is the user's consent under Article 6(1)(a) GDPR and the applicable laws governing electronic communications.

Consent may be withdrawn at any time by using the unsubscribe link included in a marketing message or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Unsubscribing from marketing communications does not affect the receipt of messages required to fulfil an order, process payment, arrange delivery, manage a customer account, return or complaint.

7. Analytics, Personalisation and Advertising

The Store may use optional analytics, personalisation and advertising tools. These tools may be used to measure traffic, analyse how the website is used, evaluate the effectiveness of campaigns and tailor content and advertisements to users' potential interests.

Depending on the current configuration of the Store, these tools may be provided by search engine operators, social media platforms, advertising platforms and analytics service providers.

Optional tools are activated in accordance with the choice made by the user through the cookie banner or the "Privacy Settings" panel.

Users may accept all optional technologies, reject them or select individual categories. Their choice may subsequently be changed through the privacy settings available in the Store.

Where a user accepts marketing technologies, information about their activity may be used to create audience groups and tailor content or advertisements. This may constitute marketing profiling.

We do not make decisions concerning users based solely on automated processing where those decisions would produce legal effects or similarly significantly affect them.

8. Cookies and Similar Technologies

The Store uses cookies and similar technologies.

Necessary cookies enable the Store to operate correctly and securely, including maintaining the shopping cart, remembering the selected country or language, logging into a customer account, processing payments and protecting the Store against misuse. Technologies required to provide a service requested by the user may operate without additional consent.

Optional cookies may be used for analytics, personalisation and marketing. They are activated in accordance with the choice made by the user through the cookie banner.

Users may change their choice at any time through the "Privacy Settings" link available in the Store. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

The currently available technology categories and the options for managing them are presented in the cookie banner and privacy settings panel.

9. Recipients of Personal Data

Personal data may be disclosed to entities that help us operate the Store and fulfil orders, to the extent related to the services they provide.

These entities may include providers of e-commerce platforms and hosting services, payment service providers, banks, courier companies and pickup point operators, providers of sales, warehouse, CRM, ERP and invoicing systems, newsletter, analytics and advertising service providers, IT and technical support providers, and entities providing accounting, tax, audit or legal services.

Personal data may also be disclosed to public authorities where such disclosure is required by law.

Entities processing personal data on our behalf may use it only within the scope resulting from the relevant agreements, our instructions and applicable laws.

10. Shopify

The Store is operated using the Shopify platform, which provides the technical infrastructure required to run the website, manage orders, payments and customer accounts, maintain security and provide privacy-related features.

Personal data submitted through the Store is processed by Shopify and its subcontractors to the extent necessary to provide services to Maximus Solaria.

Depending on the Shopify features currently enabled, Shopify may also process certain personal data as an independent controller and determine the purposes and methods of such processing independently, particularly in connection with Shopify's own or enhanced services.

Further information about Shopify's processing of personal data and the exercise of rights in relation to Shopify is available in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

11. Transfers Outside the European Economic Area

Certain providers of technology, cloud, payment, marketing, analytics or advertising services may process personal data in countries outside the European Economic Area.

Where personal data is transferred outside the EEA, the transfer is carried out using mechanisms provided for by law, including an adequacy decision issued by the European Commission, standard contractual clauses approved by the European Commission or other legally recognised safeguards.

Information about the safeguards applied may be obtained by contacting the Controller.

12. Retention of Personal Data

We retain personal data for as long as necessary to fulfil the purpose for which it was collected and subsequently for any period required by law or necessary to protect against legal claims.

Data relating to orders, payments and sales documents is retained for the period required under tax, accounting and consumer protection laws.

Customer account data is retained until the account is closed and subsequently to the extent required by law or necessary to protect against legal claims.

Data relating to returns, complaints and correspondence is retained until the relevant matter has been resolved and subsequently until the expiry of the applicable limitation period for potential claims.

Data used to send newsletters is processed until consent is withdrawn or the user unsubscribes. After a user unsubscribes, we may retain limited information concerning the withdrawal of consent in order to demonstrate that it was properly handled and prevent further communications.

Technical data, security logs and information stored through cookies are retained for periods determined by their purpose, technical configuration and the choices made by the user.

13. User Rights

To the extent provided for by the GDPR, individuals whose personal data is processed have the right to access their personal data and receive a copy of it, rectify their personal data, request its erasure, restrict its processing, receive and transfer their data, object to processing based on legitimate interests and withdraw consent.

The scope of each right depends on the legal basis and circumstances of the processing. Certain rights may be restricted under applicable law, particularly where further retention of data is legally required or necessary to establish, pursue or defend legal claims.

To exercise these rights, please contact us at shop@inkycosmetics.com. We may request additional information necessary to confirm the identity of the person making the request.

14. Right to Lodge a Complaint

A person who believes that their personal data is being processed unlawfully has the right to lodge a complaint with the competent data protection authority.

A complaint may be lodged in particular with the supervisory authority in the European Union or European Economic Area country where the person has their habitual residence or place of work, or where the alleged infringement occurred.

In Poland, the competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

A customer who lives or works in another EU or EEA country may contact the data protection authority operating in that country.

15. Data Security

We apply technical and organisational measures appropriate to the type of personal data processed, the manner in which it is used and the associated risks.

Access to personal data is limited to persons and entities that require it to perform their duties.

No method of transmitting or storing personal data can guarantee complete security. Users should not send information by ordinary email where it is not necessary for us to handle their matter.

16. Links to External Websites

The Store may contain links to websites, social media platforms or services operated by other entities.

After following a link to an external service, the privacy rules established by the operator of that service apply. Maximus Solaria is not responsible for how personal data is processed by independent operators of external websites.

17. Changes to This Privacy Policy

This Privacy Policy may be updated where there are changes to applicable laws, the operation of the Store, technologies or services used, processing purposes or categories of data recipients.

The current version of the Privacy Policy will be published in the Store together with its effective date.

Where a change materially affects users' rights or the way in which their personal data is used, we will provide notice in the manner required by applicable law.

18. Contact

Questions concerning this Privacy Policy, the processing of personal data or the exercise of individual rights may be sent by email to shop@inkycosmetics.com or by post to Maximus Solaria Sp. z o.o., ul. Kwiatowa 3, 84-207 Bojano, Poland.