Privacy policy
Last updated: 28 August 2026
1. Who we are (data controller)
Varch Sp. z o.o., operating under the brand Kahaus, ul. Pociągów Pancernych 1D, 32-005 Niepołomice, Poland, KRS 0000685918, NIP 6793152735, is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact: support@kahaus.com. We have not appointed a Data Protection Officer; privacy requests are handled directly by the company.
This store is hosted by Shopify. This policy describes how we collect, use, disclose and retain your personal data when you visit kahaus.com, place an order, or contact us.
2. What data we collect and why
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Processing and shipping your order (3D-printed products made to order) | name, company, delivery and billing address, phone, e-mail, order contents, order and account identifiers, pickup point | (b) performance of a contract |
| Invoicing, VAT/OSS and accounting | name/company, address, tax ID, invoice details, e-mail used to deliver the invoice | (c) legal obligation (Polish VAT and accounting law) |
| Customer service, warranty claims, returns, disputes | contact details, content of your messages, order number, product photos, refund details | (b) contract; (c) legal obligation (consumer law); (f) legitimate interest — defence of claims |
| Store account, payments, site analytics | account data, purchase history, payment confirmation (card data stays with the payment provider), device/usage data and cookies | (b) contract; (f) legitimate interest; (a) consent for non-essential cookies and newsletter |
| Backups and IT security | copies of the data above | (f) legitimate interest — business continuity; (c) retention of accounting records |
3. Who receives your data
- Shopify International Ltd. — store hosting and checkout (processor; data may be transferred to Canada/USA under adequacy decisions and Standard Contractual Clauses).
- Payment providers (Shopify Payments, PayPal) — independent controllers for payment processing.
- Carriers and shipping brokers (e.g. DPD Polska, BaseLinker/Base Courier — being phased out) — to deliver your parcel.
- Google Workspace — e-mail and document storage (processor, EU Data Processing Addendum).
- Backblaze Inc. — encrypted off-site backups stored in the EU (Amsterdam); Backblaze cannot read the data.
- Cloudflare — network security in front of our systems (connection metadata only).
- Our accounting office and the Polish tax authorities (KSeF) — invoices and accounting records, as required by law.
We do not sell your personal data and we do not use it for automated decision-making or profiling. Customer data is not processed by cloud AI services.
4. How long we keep your data
- Order, delivery and contact data (name, address, phone, e-mail, shipping labels): 90 days after the order is completed, delivered, cancelled or returned — this covers marketplace dispute windows. After that the data is anonymised; only non-personal data (country, first 3 characters of the postcode, products, amounts, dates) is kept for statistics.
- Invoices and accounting records: 5 years from the end of the tax year in which the invoice was issued, as required by Polish law.
- Customer-service correspondence: 2 years after the case is closed (statutory warranty period).
- Backups: encrypted backups rotate automatically; anonymised data leaves daily/weekly/monthly backups within 12 months and yearly backups within 3 years.
- Store account: until you delete it or ask us to; newsletter: until you unsubscribe.
5. Your rights
You have the right to access, rectify, erase or restrict your personal data, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. To exercise these rights write to support@kahaus.com from the e-mail address used for your order (or quote your order number). We respond within 30 days. Please note that invoices and accounting records cannot be erased before the statutory retention period ends. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or the authority in your country of residence.
6. Cookies
The store uses cookies necessary for the checkout to work and, with your consent, analytics and marketing cookies managed through the Shopify cookie banner. You can change your choice at any time in your browser or via the banner. See also Shopify's cookie policy.
7. Security
Our order-processing systems run on hardware in the EU, are accessible only over encrypted, key-based connections, and are backed up in encrypted form. Access to customer data is limited to staff who need it to fulfil your order.
8. Changes
We may update this policy; the date at the top shows the latest version. Material changes will be announced in the store.