This Privacy Policy explains how PAVED™ (“we”, “us”, “our”) processes your personal data when you use our website www.paved.eu, place an order, subscribe to our newsletter, or interact with us in any other way.

Data Controller:
PAVED™
ul. Cyfrowa 6
71-441 Szczecin,
Poland
Email: support@paved.eu

‍We comply with the General Data Protection Regulation (GDPR) and other applicable EU and Polish data protection laws.

We collect and process the following types of data, depending on your interaction with our site:

• Order & Delivery Data: name, delivery and billing address, phone number, email, products purchased, payment reference, order number.
• Payment Data: transaction identifiers, payment method (Stripe, PayPal, Apple Pay, Google Pay), and related metadata. We never store full card details.
• Contact & Support Data: messages, emails, or enquiries you send us.
• Review Data: nickname and order number (used only to verify purchase).
• Newsletter & Marketing Data: name, email, and preferences when you sign up for our newsletter or promotional updates.
• Technical & Cookie Data: IP address, device information, browser type, language, referral URL, and activity on our site collected via cookies, Google Analytics, and Meta Pixel.

We process your personal data for the following purposes:

• Process and deliver your orders (including payment and shipment). Legal Basis: Performance of contract; Typical Retention: As required by tax/accounting laws (typically 5 years).
• Handle returns, complaints, or customer support. Legal Basis: Legitimate interest / contract; Typical Retention: Until the case is resolved + statutory period.
• Send order confirmations and transactional emails. Legal Basis: Performance of contract; Typical Retention: Same as above.
• Send newsletters, promotions, and product updates. Legal Basis: Consent; Typical Retention: Until withdrawal of consent.
• Improve our site, services, and marketing. Legal Basis: Legitimate interest; Typical Retention: Until you object or withdraw consent.
• Prevent fraud and maintain website security. Legal Basis: Legitimate interest; Typical Retention: As necessary for security and audit.
• Comply with legal obligations. Legal Basis: Legal obligation; Typical Retention: As required by applicable law.

All payments on our website are handled securely by third-party providers:

• Stripe Payments Europe, Ltd. (includes Apple Pay and Google Pay)
• PayPal (Europe) S.à r.l. et Cie, S.C.A.

We share only the data required to deliver your order with our trusted logistics partners, such as Poczta Polska and InPost, or other delivery services as necessary to reach your destination.

We only share your data with:

• Payment processors (Stripe, PayPal)
• Logistics and shipping partners (Poczta Polska, InPost)
• Marketing and analytics partners (Google, Meta, etc.)
• IT and hosting service providers necessary for site operation (Webflow)

Some providers (e.g. Google, Meta) may process data outside the EEA. In such cases, we ensure adequate protection under the GDPR through Standard Contractual Clauses (SCCs) or adequacy decisions.

We never sell your personal data.

We retain your personal data only for as long as necessary for the purposes described above or as required by law. After the retention period expires, your data is securely deleted or anonymised.

We apply appropriate technical and organisational measures to protect your data, including:

• Secure SSL/TLS encryption on all website traffic
• Restricted access and authentication controls
• Regular updates, backups, and monitoring
• Staff confidentiality agreements and training
• Incident response procedures in case of breach

If a data breach occurs that may affect your rights or freedoms, we will notify you and the relevant supervisory authority (UODO) as required by law.

You have the following rights concerning your personal data:

• Access: Obtain a copy of your data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”): Request deletion when legally possible.
• Restriction: Ask us to limit processing in certain cases.
• Portability: Request transfer of your data to another controller.
• Objection: Object to processing based on legitimate interest, including marketing.
• Withdraw Consent: You may withdraw your consent for marketing or analytics at any time.

To exercise your rights, contact us at support@paved.eu.You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

Our products and website are not directed to individuals under 16 years old. We do not knowingly collect data from minors. If you believe a child has provided us data, please contact us and we will delete it promptly.

We may update this Privacy Policy periodically. Updates will be published on our website with a new “Last Updated” date.
‍
If we make major changes, we’ll notify you through a website banner or email notice. Your continued use of our website after updates indicates your acceptance of the revised policy.