Privacy Policy

ITHUTIR is the brand / trading identity of Vitaliy Panasiuk, a natural person operating under Polish działalność nierejestrowana (unregistered activity). CEIDG, KRS and REGON: not applicable.

Effective date: 10 October 2026.

Controller and contact

Vitaliy Panasiuk is the controller of personal data processed to operate ITHUTIR under Polish działalność nierejestrowana. Use the contact details below for privacy requests. ITHutir does not require a public customer-account system. Direct checkout is available for active ITHutir products; optional analytics is consent-gated.

Data, purposes and legal bases

• Contact and support. When you contact us, we process the contact details, message and attachments you choose to send to answer the enquiry and manage correspondence, relying on legitimate interests (GDPR Article 6(1)(f)) or steps requested before or during a contract (Article 6(1)(b)).
• Email updates. When you submit the email-updates form, we process your email address and evidence of consent, including consent version, form source and locale, to send the requested updates and demonstrate consent under Article 6(1)(a).
• Direct orders. We process the minimum contact, order, payment-status, delivery or pickup information needed to perform Digital and DIY direct-sale contracts under Article 6(1)(b), and records required by tax, accounting, consumer-protection or other legal obligations under Article 6(1)(c). ITHutir does not store full payment-card details.
• Protected digital delivery and transactional messages. Order identifiers, recipient details and delivery status may be processed to provide protected files, receipts, order messages and support under Article 6(1)(b) and applicable legal duties.
• Complaints and legal claims. Compliance records and complaint handling rely on Article 6(1)(c), and records needed to establish, exercise or defend claims may rely on Article 6(1)(f).
• Optional analytics. Google Analytics 4 is used only after an explicit analytics-consent choice where consent is required. The analytics implementation is designed not to send names, email addresses, payment details or other prohibited direct identifiers in ITHutir event parameters.

Providing information is voluntary except where it is necessary to conclude or perform a requested transaction or meet a legal requirement. Without necessary order or delivery details, we may be unable to complete the requested transaction.

Browser storage and analytics consent

The ITHutir frontend uses localStorage for theme preference, cart state, analytics-consent state and bounded first/last-touch attribution data used to understand acquisition and commercial performance. Before analytics consent is granted, the GA4 library is not loaded by the ITHutir analytics runtime and analytics events are suppressed. If you grant analytics consent, Google Analytics may use cookies or similar browser identifiers according to Google's service configuration and policies. Clearing site data removes locally stored ITHutir preferences and consent state; you can then make a new analytics choice.

Recipients and service providers

Netlify hosts the website and commerce backend and may process technical request, security, function and database data needed to operate the service. Stripe and PayPal may process payment and anti-fraud information when their payment method is selected. Google Drive may be used for protected digital delivery, and Brevo may process transactional or consented email communications. Cloudflare Email Routing and Google may process support-email traffic. A selected shipping carrier may receive delivery information needed for a direct physical order. Google Analytics receives analytics data only after the applicable consent gate is satisfied.

When you follow an external POD, affiliate or referral link, the destination merchant or provider receives the request and processes data under its own privacy notice. ITHutir may record a bounded attribution event containing items such as channel, campaign, landing path, merchant/component identifiers and a click identifier; this event is not designed to contain payment-card data or direct contact identifiers. We do not sell personal data.

Retention

We retain personal data only for as long as needed for the stated purpose and applicable legal obligations. Correspondence and complaint records are retained while needed to resolve the matter and, where relevant, for applicable claim periods. Order, payment-status and accounting records are retained for periods required by applicable tax, accounting and consumer law. Email-marketing consent data is retained while updates remain requested and as needed to demonstrate or act on consent and withdrawal. Analytics retention follows the configured Google Analytics property settings and applicable consent choices. Browser-local values remain until removed by the user, replaced by the application flow or cleared through browser controls.

Your rights

Subject to the GDPR conditions, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your situation and to direct marketing at any time. Where processing relies on consent, you may withdraw consent at any time without affecting earlier lawful processing. Contact us to exercise your rights. We normally respond within one month, subject to legally permitted extensions. You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), or another competent supervisory authority, including in your habitual residence, workplace or the place of an alleged infringement. See UODO.

International transfers and security

Some service providers may process data outside the European Economic Area depending on their service location and corporate structure. Where an international transfer requires safeguards, the relevant provider/controller arrangement must rely on an applicable transfer mechanism such as an adequacy decision or Standard Contractual Clauses, with supplementary measures where required. We limit access, protect credentials and use provider security controls; no transmission or storage method is risk-free.

Automated decisions

ITHutir does not make automated decisions that produce legal or similarly significant effects on customers and does not use the optional analytics system for such decisions.

Seller / contact: Vitaliy Panasiuk
al. Marszałka Edwarda Śmigłego-Rydza 29/6, 93-281 Łódź, Poland
Country: Poland
Email: support@ithutir.com
Phone: +48 668 311 169