Privacy policy

PRIVACY POLICY

This Privacy Policy explains how OPLNT! collects, uses, shares and protects personal data when you visit https://oplnt.xyz, place an order, contact us, subscribe to marketing, join a waitlist, or otherwise interact with us.

This Policy is a privacy notice. It is not a contract and does not replace our Terms and Conditions or any rights granted to you by applicable law.

1. DATA CONTROLLER AND CONTACT

The controller of your personal data is:

IBRAHIM BAAJ
trading as OPLNT! / OPLNT Studios
registered address: TYMIENIECKIEGO 32E, ŁÓDŹ
email: oplntstudios@gmail.com

The legal identity above must match the seller identified in the store’s Terms and Conditions, invoices and business registration.

We have not appointed a Data Protection Officer because we are not currently required to do so. Privacy requests can be sent to the email address above.

2. PERSONAL DATA WE COLLECT

Depending on how you use our store, we may collect:

Identity and contact data: name, billing and delivery address, email address, telephone number and social-media username where relevant.
Order and transaction data: products ordered, size, price, discounts, payment status, delivery details, returns, exchanges, complaints and communications about an order.
Payment data: payment method, payment status and transaction identifiers. Full card details are processed by the relevant payment provider and are not available to us.
Account data: login details, saved addresses, order history and account preferences, if customer accounts are enabled.
Marketing and waitlist data: email address, consent records, signup source, campaign interactions and preferences voluntarily provided by you.
Communications: messages, emails, reviews and other information you send to us.
Technical and usage data: IP address, device and browser information, operating system, time zone, cookie identifiers, pages viewed, referring page, interactions with the store and security logs.
Social-media and advertising data: information supplied when you interact with our profiles or submit a form hosted by a platform such as Meta, and campaign or conversion data received from advertising platforms where permitted.

We do not intentionally collect special-category data such as health, biometric, religious or political information. Please do not send such data to us unless it is strictly necessary for a specific request.

3. HOW WE OBTAIN PERSONAL DATA

We obtain data:

directly from you, including at checkout, through forms, customer support, returns and marketing signups;
automatically from your browser or device through essential technologies and, with your consent, analytics or advertising technologies;
from service providers involved in payments, delivery, fraud prevention, store hosting and marketing;
from social-media and advertising platforms when you interact with us or submit a lead form; and
from publicly available sources where necessary to protect our rights or prevent fraud.

4. PURPOSES AND LEGAL BASES

We process personal data only when we have a valid legal basis under the General Data Protection Regulation (“GDPR”).

Purpose	Data typically used	Legal basis
To operate the website, provide essential functions, keep the store secure and prevent abuse	Technical, usage and security data	Our legitimate interests in operating and securing the store — Article 6(1)(f) GDPR
To create and manage a customer account	Identity, contact and account data	Performance of a contract or steps requested before entering a contract — Article 6(1)(b) GDPR
To process orders, payments, delivery, returns, exchanges, complaints and customer service	Identity, contact, order, payment-status and communication data	Performance of a contract — Article 6(1)(b) GDPR
To issue invoices, maintain accounting records and comply with tax, consumer-protection or other legal duties	Identity, contact, order and transaction data	Compliance with a legal obligation — Article 6(1)(c) GDPR
To answer general enquiries and manage our relationship with customers	Contact and communication data	Steps requested before entering a contract and/or our legitimate interest in responding and managing customer relationships — Articles 6(1)(b) and 6(1)(f) GDPR
To establish, exercise or defend legal claims and maintain evidence of transactions and consents	Relevant order, transaction, consent and communication data	Our legitimate interests in protecting our legal rights — Article 6(1)(f) GDPR
To send newsletters, launch reminders, waitlist updates and promotional messages	Email address, consent record and marketing interactions	Your consent — Article 6(1)(a) GDPR and applicable electronic-communications law
To measure store use, personalise content or advertising, and run remarketing campaigns using non-essential cookies or similar technologies	Technical, usage, device, cookie and campaign data	Your consent — Article 6(1)(a) GDPR and applicable electronic-communications law
To detect and prevent fraudulent or unlawful transactions	Identity, transaction, technical and security data	Our legitimate interests in preventing fraud and protecting customers and the business — Article 6(1)(f) GDPR; where applicable, compliance with a legal obligation — Article 6(1)(c) GDPR

Where processing is based on our legitimate interests, we consider whether those interests are overridden by your rights and freedoms. You may object as explained in Section 11.

5. ORDERS, PAYMENTS AND DELIVERY

We use the information provided at checkout to process and fulfil your order, accept payment, provide order updates, arrange delivery, handle returns or complaints and meet our legal obligations.

Payments are processed by the payment method selected at checkout. The payment provider may process your data as an independent controller under its own privacy notice. We do not receive or store your complete payment-card number or security code.

Delivery information is shared with the selected carrier or fulfilment provider only to the extent necessary to deliver and manage your shipment.

6. MARKETING, WAITLISTS AND META LEAD FORMS

We send promotional emails, launch reminders or other electronic marketing only where you have provided the required consent. Joining a waitlist or marketing list is voluntary and is not required to place an order.

If you submit a waitlist or lead form hosted by Facebook or Instagram, Meta collects the information on its platform and sends the submitted data to us. We may transfer that information to Shopify and our email service so that we can maintain our subscriber list and send the messages described at signup. Meta also processes data under its own privacy policy.

You may withdraw marketing consent at any time by:

clicking the unsubscribe link in a marketing email; or
emailing oplntstudios@gmail.com.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We may retain a minimal suppression record so that we do not contact you again without a new consent.

Transactional messages about an order, payment, delivery, return, account security or a response to your request are not marketing and may still be sent where necessary.

We do not currently send SMS marketing. If we introduce it, we will obtain any legally required consent and update this Policy before doing so.

7. COOKIES AND SIMILAR TECHNOLOGIES

The store uses cookies and similar technologies.

Strictly necessary technologies are used to provide functions requested by you, such as security, checkout, cart contents, authentication, load balancing and saving privacy choices. They do not require consent where the law provides an exemption.
Analytics, personalisation and advertising technologies are used only after you provide consent through the cookie banner or privacy settings, where consent is required.

You can accept, reject or change your choices through the cookie banner or the Cookie/Privacy Settings link available on the website. Rejecting non-essential technologies will not prevent you from purchasing, although some optional features may work differently.

Cookie names, providers and durations may change when Shopify, installed applications or our settings change. The current details should therefore be displayed in the store’s cookie-preference tool rather than in a static list in this Policy.

Browser settings can also block or delete cookies, but browser controls do not replace the consent choices offered by the store.

8. SERVICE PROVIDERS AND OTHER RECIPIENTS

We disclose personal data only when necessary and only to appropriate recipients, which may include:

Shopify International Limited and its affiliates and subprocessors, which provide the e-commerce platform, hosting, security and related services;
payment processors, banks and fraud-prevention providers;
delivery, courier, warehouse and fulfilment providers;
email, customer-support, form-sync and marketing service providers;
analytics and advertising platforms, such as Meta, but only in accordance with your consent where required;
IT, cloud, security, website-development and professional service providers;
accountants, legal advisers, insurers and auditors;
public authorities, courts, law-enforcement bodies or regulators where disclosure is required by law or necessary to protect legal rights; and
a buyer, investor or successor in connection with a genuine sale, restructuring or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.

Some recipients, such as payment providers, carriers and advertising platforms, may act as independent controllers and provide their own privacy notices.

We do not sell personal data.

9. INTERNATIONAL DATA TRANSFERS

Some service providers process data outside the European Economic Area (“EEA”). In particular, Shopify states that EEA customer data is initially processed by Shopify International Limited in Ireland, while Shopify affiliates and subprocessors may process data in other countries.

Where personal data is transferred outside the EEA, we rely on a lawful transfer mechanism, such as:

an adequacy decision adopted by the European Commission;
the European Commission’s Standard Contractual Clauses; or
another safeguard permitted by Chapter V GDPR.

Additional information about relevant safeguards may be requested by emailing oplntstudios@gmail.com.

10. DATA RETENTION

We keep personal data only for as long as necessary for the purpose for which it was collected, including:

order, invoice, payment-status and accounting data for the period required by tax and accounting law;
order, complaint, return and correspondence data until relevant claims have expired and for any longer period required in active proceedings;
account data until the account is deleted, unless retention is required for another lawful purpose;
enquiry data until the matter is closed and for a reasonable period needed to demonstrate how it was handled;
marketing data until consent is withdrawn or the marketing purpose ends, with a minimal suppression record retained where necessary to respect an opt-out;
consent records for as long as needed to demonstrate compliance;
cookie and analytics data for the periods shown in the cookie-preference tool; and
security logs for a period proportionate to security, fraud-prevention and incident-response needs.

When data is no longer required, we delete or anonymise it, unless continued retention is required or permitted by law.

11. YOUR GDPR RIGHTS

Subject to the conditions and exceptions in applicable law, you have the right to:

access your personal data and obtain a copy;
correct inaccurate or incomplete data;
request deletion of your data;
request restriction of processing;
receive data you provided in a structured, commonly used and machine-readable format, and transmit it to another controller where the right to portability applies;
object to processing based on legitimate interests;
object at any time to processing for direct marketing;
withdraw consent at any time, without affecting earlier lawful processing; and
lodge a complaint with a supervisory authority.

To exercise a right, email oplntstudios@gmail.com. We may ask for information reasonably necessary to verify your identity. We normally respond within one month, subject to any lawful extension.

In Poland, the supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
Urząd Ochrony Danych Osobowych
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland
https://uodo.gov.pl/

You also retain the right to seek a judicial remedy. Nothing in this Policy limits that right.

12. REQUIRED AND OPTIONAL DATA

Data marked as required at checkout is necessary to enter into and perform the purchase contract or meet legal requirements. If you do not provide it, we may be unable to process the order or provide the requested service.

Providing data for newsletters, waitlists, analytics, advertising or other optional purposes is voluntary. Refusing or withdrawing consent does not affect the lawfulness of an order or your ability to use essential store functions.

13. AUTOMATED PROCESSING

We may use tools that flag potentially fraudulent transactions or help select and measure advertising. We do not use solely automated decision-making that produces legal effects concerning you, or similarly significantly affects you, unless permitted by law and accompanied by the required safeguards.

Independent payment, fraud-prevention or advertising providers may carry out their own automated processing under their privacy notices.

14. SECURITY

We use reasonable technical and organisational measures appropriate to the risk to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

No method of transmission or storage is completely secure. If a personal-data breach creates a risk requiring notification under applicable law, we will notify the competent authority and affected individuals where required.

15. CHILDREN

Our store is not designed to knowingly collect marketing consent from children under 16 without the authorisation required by law. If you believe that a child has provided personal data unlawfully, contact us at oplntstudios@gmail.com.

This section does not change any rules of applicable law concerning a minor’s ability to enter into a purchase contract.

16. THIRD-PARTY LINKS

The website may contain links to third-party websites or services. Those parties are responsible for their own processing practices. We recommend reading their privacy notices before providing personal data.

17. PRIVACY COMPLAINTS AND AMICABLE RESOLUTION

If you have a concern about how we process personal data, please contact us first at oplntstudios@gmail.com so that we can investigate and try to resolve it promptly.

This invitation to resolve a matter amicably is voluntary. It does not prevent you from contacting the President of the Personal Data Protection Office, another competent authority or a court, and it does not waive or restrict any statutory consumer or data-protection right.

18. CHANGES TO THIS POLICY

We may update this Policy when our processing activities, service providers or legal obligations change. The current version will be posted on this page with a new “Last updated” date.

If a change materially affects processing based on consent, we will request new consent where required. We will not retroactively rely on a new purpose that is incompatible with the purpose for which data was originally collected.

19. CONTACT

Questions, requests and complaints concerning privacy can be sent to:

Email: oplntstudios@gmail.com
Postal address: TYMIENIECKIEGO 32E, ŁÓDŹ