Privacy policy

1. Data controller

The controller of your personal data is Evgeniia Karuzina, running a sole proprietorship at ul. Pasteura 20/12, 31-221 Kraków, Poland, NIP (tax ID) 9452242031, REGON 388155199 (the "Controller").

For any matters regarding personal data, write to sklep@karuzina.info or by post to the address above.

This policy covers the online store karuzina.info and provides the information required by Art. 13 of Regulation (EU) 2016/679 (GDPR).

2. What data, for what purpose and on what legal basis

  1. Placing and delivering an order – e-mail address, name and, if you want an invoice, tax ID (NIP), company name and address. We send the order confirmation, the PDF files and a download link to the e-mail you provide. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

  2. Free sheet music – the e-mail address we send the download link to. Legal basis: performance of a contract for the supply of digital content (Art. 6(1)(b) GDPR).

  3. Accounting and taxes – order and invoice data. Legal basis: legal obligation (Art. 6(1)(c) GDPR together with tax and accounting laws).

  4. Proof of consent and handling complaints – the date and wording of consents given at checkout (acceptance of the Terms, consent to the supply of digital content before the end of the withdrawal period) and the file download history. Legal basis: the Controller's legitimate interest in establishing, pursuing and defending claims (Art. 6(1)(f) GDPR).

  5. Store security – protecting forms against bots (Cloudflare Turnstile) and download links against abuse. Your IP address is not stored in plain form – we keep only a one-way hash of it and the country. Legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR).

  6. Correspondence – data from messages you send us (e.g. ordering printed sheet music from abroad, questions about an order). Legal basis: the Controller's legitimate interest in replying (Art. 6(1)(f) GDPR).

  7. Visitor statistics – aggregated, anonymous statistics (Cloudflare Web Analytics), without cookies and without identifying anyone. Legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR).

Providing data is voluntary, but without an e-mail address we cannot accept an order or send the sheet music, and without company details we cannot issue an invoice. We do not make automated decisions or profile customers. We do not send newsletters or advertising.

3. Payments

Payments are handled by Stripe Payments Europe, Limited (Dublin, Ireland). You enter your card or other payment details (BLIK, PayPal etc.) directly in the Stripe payment window – the store neither receives nor stores them. Stripe processes payment data as an independent controller under its own privacy policy: stripe.com/privacy. If you choose PayPal, the payment is also handled by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) as an independent controller: paypal.com/pl/legalhub/privacy-full. We only receive the result of the payment from Stripe.

4. Who receives the data

We share data only with providers that help us run the store, under data processing agreements and only to the extent necessary:

  • Cloudflare, Inc. (USA) – website hosting, order database, file storage, sending order e-mails, bot protection, statistics;
  • Resend (Plus Five Five, Inc., USA) – backup sending of order e-mails (when an e-mail has large attachments or sending through Cloudflare is unavailable);
  • Google (Google Ireland Ltd. / Google LLC) – the mailbox that receives correspondence;
  • wFirma sp. z o.o. (Wrocław, Poland) – accounting and invoicing system;
  • the accounting office that keeps the Controller's books.

We may also disclose data to public authorities (e.g. the tax office, courts) where the law requires it.

Printed sheet music is sold through Allegro – when you buy there, your contract is concluded on Allegro and your data is processed by Allegro.pl sp. z o.o. under its own rules.

5. Transfers outside the European Economic Area

Some of the providers listed are based in the USA or use servers outside the EEA. In that case data is transferred on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to the address in section 1.

6. How long we keep data

  • orders and invoices – for 5 years from the end of the calendar year in which the tax payment deadline passed (tax law), and in the event of a dispute until it is resolved;
  • consent and download records – as long as the order they relate to;
  • download links – active for 30 days after purchase, after which they stop working;
  • correspondence – up to 3 years after it ends;
  • visitor statistics – contain no personal data.

7. Your rights

You have the right to:

  • access your data and receive a copy,
  • rectify (correct) your data,
  • erasure – unless we are required to keep the data by law (e.g. tax law),
  • restriction of processing,
  • data portability – for data processed on the basis of a contract,
  • object to processing based on legitimate interest.

To exercise these rights, write to sklep@karuzina.info. We will reply without undue delay and at the latest within one month.

You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl).

8. Cookies and browser storage

  1. The store does not use advertising, marketing or analytics cookies and does not track you across websites.

  2. Your cart is saved in your browser's storage (localStorage) – it does not reach our server until you place an order. You can remove it by clearing the site data in your browser.

  3. Cloudflare may set technical cookies necessary to protect the site against bots and attacks (e.g. during Turnstile verification on forms). They are strictly necessary for the store to work and do not require consent.

  4. YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com) and load only after you click "play". From that moment Google may process your data (including your IP address) under the Google privacy policy.

  5. Links to Instagram, Spotify, Apple Music or Allegro lead to external services with their own privacy policies.

  6. You can block or delete cookies in your browser settings at any time; this may, however, prevent you from submitting forms protected against bots.

9. Security

The connection to the store is encrypted (HTTPS). Only the Controller has access to order data, after signing in with additional verification. Sheet music files are kept in private storage and released only via the individual link from the order.

10. Changes to this policy

We may update this policy, e.g. when providers or laws change. The current version is always available on this page.

Last updated: 21 October 2026.

Something not working?

Describe what is wrong on this page. We will include the page address automatically.