Privacy Policy

The controller of your personal data is DK Sports Group Dariusz Kaszubowski, ul. Smolańska 3/202, 70-026 Szczecin, NIP (tax ID) 8522466339 (we, the Controller), running the Legit Football Shirts online shop at legitfootballshirts.com and a physical shop in Szczecin, Poland.

For matters concerning personal data write to contact@legitfootballshirts.com or by post to the registered address. We have not appointed a data protection officer because we are not obliged to; every question is answered directly by the shop owner.

We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Polish Personal Data Protection Act, the Act on providing services by electronic means and the Electronic Communications Law.

The data comes exclusively from you: from the order form, Account registration, the contact form, newsletter or team alert sign-up, e-mails, telephone calls and messages on Instagram. Technical data (IP address, browser type) is collected automatically by the server during your visit.

Providing data is voluntary, but to the extent marked in the forms as required it is necessary to conclude and perform the contract (without an address we cannot send the parcel, without an e-mail we cannot confirm the order) or to reply to a message. Consent to the newsletter, team alerts and statistical cookies is always voluntary and is not a condition of purchase.

We process your data for the following purposes:

1. Concluding and performing the sales contract: name, delivery address, e-mail, telephone, chosen Products, payment data (status, method; we have no access to your card number or bank login). Basis: Article 6(1)(b) GDPR. Period: the time of processing the order and then until the limitation periods for claims expire (as a rule 6 years from the end of the year in which the order was completed).
2. Sales documents and tax obligations: invoice details, including company name and VAT ID. Basis: Article 6(1)(c) GDPR (Polish VAT Act, Accounting Act, Tax Ordinance). Period: 5 years from the end of the tax year in which the tax obligation arose.
3. Withdrawal, complaints, authenticity guarantee: order data, the content of the claim, photos, bank account number for the refund. Basis: Article 6(1)(c) GDPR (Consumer Rights Act, Civil Code) and (f) (defence against claims). Period: until the case is closed and then until the limitation periods for claims expire.
4. Customer Account: e-mail, password (stored only as a cryptographic hash), address details, order history, alert settings. Basis: Article 6(1)(b) GDPR (contract for an electronic service). Period: until you delete the Account or we delete it after 3 years of inactivity (with prior notice), keeping order data under the rules above.
5. Newsletter: e-mail address, language, date and content of the consent given, sign-up source. Basis: Article 6(1)(a) GDPR (consent) in connection with Article 398 of the Polish Electronic Communications Law and Article 10 of the Act on providing services by electronic means. Period: until consent is withdrawn; after withdrawal we keep for 3 years only the information that consent was given and withdrawn (defence against claims).
6. Team alerts: e-mail address, chosen team, size, language, consent date, unsubscribe token. Basis and period: as for the newsletter. You can switch an alert off via the link in every message or in your Account.
7. Contact form, e-mail, telephone, Instagram: name, e-mail address or telephone number, message content. Basis: Article 6(1)(f) GDPR (our legitimate interest: replying, customer service) or (b) when the message concerns a contract. Period: 12 months from the end of the correspondence, longer only when the message concerns an order or a complaint.
8. Visit statistics (Google Analytics 4): pseudonymous identifiers in cookies, approximate location (country, city), device and browser type, pages visited, traffic source, shop events (e.g. add to cart, purchase in aggregate). Basis: Article 6(1)(a) GDPR (consent given in the cookie banner, Article 399 of the Electronic Communications Law). Period: until consent is withdrawn; data in Google Analytics is kept for 14 months. Google Analytics runs only after consent; IP addresses are not stored (Google Analytics 4 does not log full IP addresses).
9. Security and abuse prevention: IP address, session identifier, date and time of the request, page address, browser type, stored in server logs and, as a hash, to limit the number of form submissions (the attempt limit is remembered for 10 minutes). Basis: Article 6(1)(f) GDPR. Period: server logs up to 30 days.
10. Establishing, pursuing and defending claims: data from the above sets to the extent necessary. Basis: Article 6(1)(f) GDPR. Period: until the limitation periods expire.

After the indicated periods we delete or anonymise the data. Backups of the shop system are overwritten in a cycle of up to 30 days.

We do not sell data or share it for third-party marketing. We pass it only to entities necessary to run the shop, to the extent limited to the purpose:

1. Payment operator: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (the PayPal gateway handling BLIK, Przelewy24, cards and PayPal accounts). For online payments we pass the order number and amount, your e-mail, name and the delivery address needed for transaction protection. PayPal is a separate controller of the payment transaction data, processing it under the rules described in its privacy policy (paypal.com/legalhub). We do not receive your card number or your bank or PayPal login details.
2. Carriers: courier companies and parcel locker operators you choose at checkout (e.g. InPost sp. z o.o.), to the extent of the name, address, telephone and e-mail needed for delivery and shipment notifications.
3. Shop hosting: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (European Union): the servers on which the shop and its database run, backups, server logs and the CDN that speeds up page loading. The shop server is located in a data centre within the European Economic Area.
4. Domain and e-mail: home.pl S.A., ul. Zbożowa 4, 70-653 Szczecin, Poland: registrar of the domain legitfootballshirts.com, DNS servers and the shop mailbox through which we send order confirmations and correspond.
5. Accounting office: the entity keeping the Seller's books, to the extent of data from sales documents.
6. Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the provider of Google Analytics 4 (only after your consent to statistical cookies) and Google Search Console (a tool for monitoring the site's visibility in search, which does not collect data about individual visitors). The Google map on the Contact page loads from Google's servers; more in the cookies chapter.
7. Technical tool providers: the provider of the shop software (WordPress, WooCommerce) and of the plugins running on our server; they do not receive your data unless expressly stated in this policy.
8. Public authorities: courts, law enforcement, tax authorities, only where the obligation to disclose arises from the law.

If you contact us via Instagram, your data is also processed by Meta Platforms Ireland Limited under the terms and privacy policy of that service; using Instagram is not required to shop.

As a rule we process data within the European Economic Area. The exception is Google's tools: in connection with Google Analytics 4 data may be transferred to Google LLC in the United States. The basis for the transfer is the European Commission's adequacy decision of 10 July 2023 under the EU-US Data Privacy Framework (Google LLC is certified) and additionally the standard contractual clauses adopted by the European Commission. You can obtain a copy of the safeguards by writing to contact@legitfootballshirts.com.

For delivery to a country outside the EEA, address data is passed to the carrier to the extent necessary to deliver the parcel (Article 49(1)(b) GDPR).

In connection with the processing of your data you have the following rights:

1. Access: to obtain information about the data processed and a copy of it (Article 15 GDPR).
2. Rectification: to correct inaccurate data or complete incomplete data (Article 16). You can also change your address details yourself in your Account.
3. Erasure: to request deletion of data when it is no longer necessary, consent has been withdrawn or the processing is unlawful (Article 17). We cannot delete data we must keep by law (e.g. invoices).
4. Restriction of processing: in the cases set out in Article 18 GDPR.
5. Data portability: to receive data processed on the basis of a contract or consent in a structured, commonly used, machine-readable format (Article 20).
6. Objection: to processing based on our legitimate interest, on grounds relating to your particular situation (Article 21).
7. Withdrawal of consent: at any time, without affecting the lawfulness of processing before withdrawal. Newsletter and alerts: the link in the footer of every message, Account settings or e-mail. Statistical cookies: the cookie settings panel available in the site footer.
8. Complaint: to the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl), or to the supervisory authority in your EU country of residence, if you believe we process data unlawfully.

To exercise your rights write to contact@legitfootballshirts.com. We reply without undue delay, at the latest within one month; in complex cases the period may be extended by a further two months, of which we will inform you. We may ask you to confirm your identity, e.g. by replying from the e-mail address used in the order.

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. We do not differentiate prices according to the buyer. Team alerts are sent only according to the criteria you set yourself (team, size). We analyse visit statistics in aggregate.

Cookies are small text files stored by the browser on your device. We use them in three categories:

1. Necessary (always active, no consent): they make the cart, checkout, login and security work. These are WooCommerce and WordPress cookies: woocommerce_cart_hash and woocommerce_items_in_cart (cart contents, session), wp_woocommerce_session_* (cart session identifier, 2 days), wordpress_logged_in_*, wordpress_sec_* and wp-settings-* (logged-in users, up to 14 days or until logout), wordpress_test_cookie (cookie support check, session) and the cookie storing your choice in the cookie banner (12 months). Their basis is Article 399(3) of the Polish Electronic Communications Law (necessity to provide the requested service).
2. Statistical (after consent): Google Analytics 4: _ga (distinguishing users, 2 years) and _ga_* (maintaining the session, 2 years). They let us understand which pages and products are viewed, where visitors come from and how the shop performs. The data is pseudonymous and analysed in aggregate. We do not use Google's advertising features (Google Signals) or remarketing.
3. Embedded content (after consent): the Google map on the Contact page. Once loaded, Google may store its own cookies in accordance with Google's privacy policy (policies.google.com/privacy). The map loads only after your consent to statistical cookies or after you click its preview.

We do not use advertising cookies or tracking tools for advertising. The site's fonts and scripts are hosted on our server, so downloading them does not involve passing data to other entities.

Apart from cookies we use the browser's local storage (localStorage) to remember the last size chosen in the shop filters (key lfs_size). This information does not leave your device and is not sent to us.

You give consent to statistical cookies and embedded content in the banner shown on your first visit. You can change or withdraw it at any time in the cookie settings panel (link in the site footer) and through your browser settings, where you can also delete stored cookies or block them entirely. Blocking necessary cookies will make it impossible to place an order. Google also provides a browser add-on that blocks Google Analytics: tools.google.com/dlpage/gaoptout.

The connection to the shop is encrypted (TLS protocol, SSL certificate). We store passwords only as cryptographic hashes; we do not know your password and will never ask for it. Only the people handling orders have access to the shop panel, after authentication. The shop software is updated regularly and the forms are protected against abuse. Payment data is processed exclusively by the payment operator in a PCI DSS compliant environment.

The shop is intended for adults. We do not knowingly collect data of persons under 18. If you are a parent or guardian and believe a child has given us data, write to us and we will delete it.

We update the policy when the law, tools or scope of processing change. The current version is always available at this address, and the effective date and version number are in the document header. We will inform Account holders of significant changes by e-mail.