Data controller and contact

The controller of personal data in the moebel-koma.de shop is Marek Kołodziejczyk, trading as KOMA Marek Kołodziejczyk, Sidzina 670, 34-236 Sidzina, Poland. Additional contact address: Rauschwalder Straße 48b, 02826 Görlitz, Germany. For privacy enquiries, contact info@koma-shop.eu or +49 3581 7925486 (Monday–Friday, 8:00–17:00).

Data and purposes

We process information provided when you shop, create an account or contact us: your name, delivery address and invoicing details, contact details, product, order and payment information, and correspondence. Information required for an order is necessary to enter into and perform the contract; without it, we cannot fulfil your order. Account information is needed to provide the account service. When contacting us, provide the information needed for a reply and avoid sending sensitive data unless necessary.

We handle orders, payments, deliveries, accounts and contract-related enquiries under Article 6(1)(b) GDPR. Tax and accounting obligations are handled under Article 6(1)(c). Other correspondence, shop security and the establishment, exercise or defence of legal claims are based on Article 6(1)(f). Our legitimate interests are responding to enquiries, keeping the website secure and protecting our rights.

We do not send newsletters or promotional emails. We send order-related messages and respond to customer enquiries.

Payments, deliveries and recipients

We offer ordinary bank transfer and PayPal. Banks involved in a transfer process the transaction data. If you choose PayPal, the data needed to process the payment is transmitted. PayPal also processes data for its own purposes, such as security and fraud prevention, under its privacy statement.

The carrier handling the particular shipment receives the data needed for delivery or returns: GLS, DPD, DHL, Raben or SUUS. This does not mean that data is automatically shared with every listed carrier.

AttHost and home.pl provide hosting and email services. Authorised personnel, technical support and accounting providers, and legally authorised authorities may have access where necessary. Their roles and scope of access depend on the service provided.

PayPal may process data outside the European Economic Area. Its privacy statement describes, as applicable, adequacy decisions, standard contractual clauses and binding corporate rules. Details of these safeguards are available in PayPal's statement. You can also contact us about recipients of data relating to your order.

Retention

Order data is needed for fulfilment and after-sales service. Further retention depends on tax and accounting obligations and applicable limitation periods for claims. Depending on the document type, German section 147 AO generally provides for eight years for accounting vouchers, ten years for books and specified financial records, and six years for other records listed in that provision. The starting point follows section 147(4) AO, and statutory extensions may apply. Records subject to Polish tax obligations are kept until the applicable limitation period expires, taking account of any suspension or interruption. Not every period applies to every document or to all customer data.

Account data is used to provide the account service. After the service ends, further retention of relevant data may only be based on separate legal obligations or the protection of legal claims. Correspondence is needed to resolve the enquiry; where it documents a contract, legal obligation or claim, the relevant retention criteria apply. Dispute-related data may be needed until proceedings are finally resolved and the decision is implemented.

Technical logs and backups support security, diagnosis and recovery. There is currently no uniform automatic deletion of all logs and backups after 30 days. Retention differs between application logs, server archives and provider backups. Backups may contain data already deleted from the active shop. Arrangements for clearing older archives are being reviewed. Please contact us about specific data and deletion requests.

Cookies and technical data

The shop uses technical cookies for sessions, the basket and user preferences. The customer session cookie lifetime is set to 480 hours (20 days). This is not the retention period for orders or all third-party cookies. The server may record connection and error data needed to operate the website. The shop checks the IP address associated with the cookie to protect the session.

Where strictly necessary to provide a service explicitly requested by the user, section 25(2)(2) TDDDG applies. Processing personal data also requires an appropriate GDPR legal basis. You can delete or block cookies in your browser settings, which may affect login and basket functionality. This does not replace consent where it is required for optional technologies.

The Facebook link leads to an external service. PayPal's own information also applies when you use that service. Integrations and optional technologies are undergoing additional checks; we do not state that all external services process the same data or retain it for the same period.

Your rights

Subject to the GDPR's conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

You can complain to a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement; in Poland, to the President of UODO. Send requests to info@koma-shop.eu. If there are reasonable doubts about your identity, we may request information necessary to confirm it.

Updated: 8 September 2026. Information on archive retention and integrations will be supplemented once the checks are complete.