Effective from 26 October 2026.
This policy explains how we process personal data of visitors and customers of the addonspresta.com store, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), and which cookies the store uses.
1. Controller
The controller of your personal data is Codestorm Ireneusz Kierkowski, ul. Kazimierza Morawskiego 5 lok. 127, 30-102 Kraków, Poland, NIP 5521609516 ("we"). In all matters relating to personal data you can contact us at mail@addonspresta.com or by post at the address above. We have not appointed a data protection officer.
2. What data we process and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Creating and running your account | name, e-mail address, password (stored only as a hash), title (optional) | performance of the contract for the account service — Art. 6(1)(b) GDPR | until you delete the account |
| Processing orders, delivering modules, updates and support | name, e-mail address, billing address, company name and VAT number (for business customers), order and payment data (for a bank transfer: the payer's name, account number, amount, date and reference), content of support requests | performance of the contract — Art. 6(1)(b) GDPR | for the duration of the licence and support, then as for claims |
| Voluntary support of the free modules (payment through Stripe after downloading a module) | e-mail address and the data entered in the Stripe form, amount, date, module identifier, payment status | our legitimate interest in accepting the payment and handling refunds — Art. 6(1)(f) GDPR; accounting — legal obligation, Art. 6(1)(c) GDPR | as for invoicing and accounting |
| Invoicing, accounting and VAT, including checking EU VAT numbers in VIES and evidence of the customer's country for VAT purposes (billing address, country determined from the IP address) | data on invoices and in accounting records, VAT number, billing country, IP address at the time of the order | legal obligation — Art. 6(1)(c) GDPR (tax and accounting law) | 5 years from the end of the year in which the tax payment deadline expired; VAT OSS records — 10 years from the end of the year of the sale |
| Handling complaints, withdrawals and returns | data given in the request, order data | legal obligation — Art. 6(1)(c) GDPR (consumer law) | until the matter is closed, then as for claims |
| Establishing, pursuing or defending claims | data needed to prove the course of the contract | our legitimate interest — Art. 6(1)(f) GDPR | until the limitation period for claims expires (generally 6 years, or 3 years for claims related to business activity, ending on the last day of a calendar year) |
| Newsletter and welcome discount code | e-mail address, language, date and IP address of the subscription | your consent — Art. 6(1)(a) GDPR | until you withdraw consent (unsubscribe), then for proof of consent as for claims |
| Answering messages from the contact form or e-mail | e-mail address, content of the message, attachments | our legitimate interest in answering — Art. 6(1)(f) GDPR | up to 12 months after the matter is closed |
| Publishing reviews of modules | name shown with the review (first name and first letter of the surname), content and rating | our legitimate interest in presenting opinions — Art. 6(1)(f) GDPR | until the review or account is deleted |
| Security of the store and preventing abuse | IP address, browser data, server logs | our legitimate interest — Art. 6(1)(f) GDPR | up to 30 days |
| Showing prices in a suitable currency and limiting sales to supported countries | IP address (determining the country) | our legitimate interest — Art. 6(1)(f) GDPR | not stored — the country is determined locally on our server for each visit using the DB-IP database, without sending the IP address to third parties; you can always change the currency yourself |
Providing data is voluntary, but the data needed to conclude the contract and issue an invoice is required to place an order. We do not make decisions based solely on automated processing, including profiling, that would have legal effects for you. Downloading a free module requires no personal data — you do not create an account, and the server keeps only its standard logs, listed above under store security.
3. Recipients of data
We share data only to the extent necessary and only with:
- our hosting and IT service providers (servers, e-mail, backups),
- Stripe Payments Europe, Limited (Dublin, Ireland), which processes card, BLIK and other online payments, including voluntary support of the free modules, as an independent controller under its own privacy policy — we receive only the payment status and basic card details (brand, last four digits), never the full card number,
- banks, including ING Bank Śląski S.A. (Katowice, Poland), which holds our account — for bank transfer payments, refunds and our own payments,
- accounting and legal service providers,
- public authorities, when required by law.
Service providers process data on our behalf under data processing agreements (Art. 28 GDPR). We do not sell personal data.
When you give us access to your shop as part of technical support or a service, we may see the personal data of your customers. In that case we act as your processor, process the data only to provide support and, on request, conclude a data processing agreement with you.
4. Transfers outside the European Economic Area
We do not transfer personal data outside the European Economic Area ourselves. Stripe may process payment data in other countries, including the United States, on the basis of the EU–US Data Privacy Framework and standard contractual clauses approved by the European Commission. If we ever transfer data outside the EEA ourselves (for example because of a change of service provider), we will do so only on the basis of an adequacy decision of the European Commission or standard contractual clauses, and we will update this policy.
5. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify your data (most of it you can change yourself in My account),
- erase your data,
- restrict processing,
- data portability — for data processed on the basis of consent or a contract,
- object to processing based on our legitimate interest, and at any time to processing for direct marketing,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, write to mail@addonspresta.com. We will reply within one month. You also have the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl — or with the authority in the EU country where you live or work.
6. Cookies and similar technologies
6.1. Cookies are small text files stored by the browser on your device. The store uses only cookies that are strictly necessary for it to work. They do not require consent, but we inform you about them here.
| Cookie | Purpose | Duration |
|---|---|---|
PrestaShop-… |
session of the store: cart, logged-in account, selected language and currency, security token | 20 days |
PHPSESSID |
technical session of the server (used, for example, by forms) | 20 days |
__stripe_mid, __stripe_sid |
set by Stripe on the payment step to prevent fraud and process the payment securely | 1 year and 30 minutes |
6.2. Your choice in the cookie notice is saved in the browser's local storage (cookie_consent), so that the notice is not shown again.
6.3. We currently do not use analytics, advertising or social media cookies. If we start using them, we will do so only after obtaining your consent through the cookie notice and we will update this list.
6.4. You can delete or block cookies in your browser settings. Blocking necessary cookies may prevent you from placing an order or logging in.
7. Security
We protect personal data with appropriate technical and organisational measures, in particular an encrypted connection (HTTPS), hashed passwords, access control and regular backups.
8. Changes to this policy
We may update this policy, for example when the law, our services or our service providers change. The current version is always published on this page with its effective date.