Privacy policy
Dial-House Privacy Policy
Last updated: 29 September 2026
§ 1. General provisions
This Privacy Policy sets out the rules for the processing of personal data of users of the Dial-House online store, available at:
The data controller is:
Karol Góral
conducting sales as an unregistered business activity
address: Stary Szlak 46E, 70-870 Szczecin, Poland
e-mail: kontakt@dial-house.com
telephone: 504 132 589
The Controller conducts sales as an unregistered business activity pursuant to Article 5(1) of the Polish Act of 6 March 2018 – Entrepreneurs’ Law.
If the Controller begins conducting a registered business activity, this Privacy Policy will be updated to include the relevant registration details.
The Dial-House store operates using the Shopify platform, which enables the operation of the online store, shopping cart, orders, payments, customer accounts, customer communication and other functions related to online sales.
Dial-House conducts sales in Poland, to selected countries of the European Economic Area and to the United Kingdom, to the extent that the relevant market and delivery method are available in the Store.
Using the Store, placing orders, contacting the Store, using forms, subscribing to the newsletter or contacting the Store regarding the purchase, exchange, finding or sourcing of a watch may involve the processing of personal data.
Personal data is processed in accordance with applicable law, in particular:
a) Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the GDPR,
b) applicable Polish personal data protection laws,
c) to the extent applicable to the offering of goods or services to persons in the United Kingdom – the United Kingdom General Data Protection Regulation, hereinafter referred to as the UK GDPR, and the Data Protection Act 2018, as amended,
d) other mandatory laws concerning privacy, electronic communications and data protection applicable to the relevant user.
§ 2. What personal data we may process
Depending on how the Store is used, we may process the following personal data:
a) identification data – first name, surname, company name if provided,
b) contact details – e-mail address, telephone number, correspondence address, delivery address and billing address,
c) order data – order number, order history, selected products, price, currency, delivery method, delivery country and order status,
d) payment data – information about the payment method, payment status, transaction identifiers, payment confirmations and other information necessary to process payments; full payment card details are processed by payment providers and are not stored directly by Dial-House,
e) customer account data – if the customer creates an account or uses a Shopify customer account,
f) data provided through forms – in particular information about the watch being sought, customer preferences, budget, brand, model, reference, watch condition, preferred contact method, consent to contact and message content,
g) data concerning watch purchase or exchange – information about the submitted watch, photographs, description of condition, completeness of the set, documents relating to the watch, information about its origin and contact details of the person submitting it,
h) communication data – the content of e-mails, forms, conversations, enquiries, complaints, returns and other correspondence with the Store,
i) technical data – IP address, device information, browser type, operating system, cookie identifiers, information about use of the website and other similar technical data,
j) marketing data – e-mail address, marketing preferences, consent history and information about subscribing to or unsubscribing from the newsletter,
k) data related to international delivery and customs clearance – delivery country, recipient details, address, telephone number, e-mail address, description and value of the shipment and other information required by the carrier, logistics operator, customs representative or competent authorities for the purpose of delivery or customs clearance,
l) other data voluntarily provided by the user where necessary to handle the user’s enquiry, order, complaint, return or other matter related to the Store.
We do not require special category data such as information about health, political opinions, religion, sexual orientation or ethnic origin.
Please do not provide such data in forms or messages.
Providing data is voluntary, but in some cases necessary to process an order, respond to an enquiry, handle a form, delivery, payment, customs clearance, complaint or return.
§ 3. Sources of personal data
We may receive personal data:
a) directly from the customer – when placing an order, completing a form, contacting us by e-mail or telephone, subscribing to the newsletter or creating an account,
b) automatically – while using the website, through cookies and similar technologies,
c) from service providers – in particular Shopify, payment providers, courier companies, logistics operators, form tools, analytics tools or e-mail service providers,
d) from carriers, courier intermediaries, customs representatives or entities involved in customs clearance – where necessary to complete international delivery,
e) from technical and marketing partners – where such services are used and where this is compliant with applicable law and the user’s consent settings,
f) from competent public authorities where the transfer of data takes place in accordance with law.
§ 4. Purposes and legal bases for processing
We process personal data for the following purposes:
a) handling orders and sales of products – on the basis of Article 6(1)(b) GDPR or the corresponding legal basis under the UK GDPR where applicable,
b) payment processing – on the basis of Article 6(1)(b) GDPR and Article 6(1)(c) GDPR where processing results from legal obligations,
c) delivery of products – on the basis of Article 6(1)(b) GDPR or the corresponding legal basis under the UK GDPR,
d) international delivery and customs clearance – on the basis of performance of a contract, the Controller’s legal obligations and, where appropriate, the Controller’s legitimate interest in ensuring proper delivery,
e) handling the “Find a Watch”, “Source a Watch”, “Sell / Exchange” and other contact forms – on the basis of Article 6(1)(b) GDPR where the enquiry is aimed at entering into a contract, or Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in handling enquiries and communicating with customers,
f) customer contact and correspondence handling – on the basis of Article 6(1)(f) GDPR,
g) handling complaints, returns and claims – on the basis of Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f) GDPR,
h) compliance with tax, accounting, customs and other legal obligations – on the basis of Article 6(1)(c) GDPR,
i) Store security and the prevention of abuse, fraud and unauthorised transactions – on the basis of Article 6(1)(f) GDPR,
j) newsletter distribution and direct marketing by electronic means – on the basis of the user’s consent or another legal basis expressly permitted by applicable law,
k) website analytics, statistics and service improvement – on the basis of Article 6(1)(f) GDPR or consent where required for the relevant technology,
l) establishment, exercise or defence of legal claims – on the basis of Article 6(1)(f) GDPR,
m) compliance with obligations arising under the UK GDPR, the Data Protection Act 2018 or other applicable UK laws – where those laws apply to the relevant processing.
Where the UK GDPR applies, the relevant legal bases for processing are interpreted in accordance with the UK GDPR.
For electronic marketing, the legal basis is generally the user’s consent.
A legitimate interest may only be relied upon where permitted by applicable specific laws.
The Controller’s legitimate interests include in particular:
a) handling customer enquiries,
b) ensuring Store security,
c) protection against abuse and fraud,
d) establishment and defence of legal claims,
e) improving service quality,
f) analysing Store performance,
g) communication with customers regarding orders, forms, complaints and returns,
h) ensuring the proper performance, tracking and security of shipments.
§ 5. “Find a Watch”, “Source a Watch” and “Sell / Exchange” forms
Data provided through forms is used to handle the customer’s enquiry, prepare a response, present watch proposals, an individual offer, sourcing possibilities, verify the submitted watch or contact the customer regarding a sale or exchange.
Submitting a form does not constitute the conclusion of a sales agreement or an obligation to purchase a product.
Detailed rules for using the forms are set out in the relevant service terms or the Dial-House Store Terms and Conditions, where applicable.
Through the forms, we may process data such as:
a) first name and surname,
b) e-mail address,
c) telephone number,
d) preferred contact method,
e) information about the watch being sought,
f) budget,
g) brand, model, reference,
h) preferred condition and completeness,
i) message content,
j) photographs or information about a watch submitted for sale or exchange.
Data from forms is processed for the time necessary to handle the enquiry and subsequently for the period necessary to secure possible claims, demonstrate the course of communication or comply with legal obligations.
§ 6. Newsletter and marketing
If the user subscribes to the newsletter or consents to receiving marketing communications, the user’s data may be processed for the purpose of sending information about products, services, new arrivals, offers, promotions or content related to the Dial-House Store.
Newsletter subscription is voluntary.
Marketing communications by e-mail, SMS, telephone or other similar electronic channels are carried out only where there is an appropriate legal basis required by the laws applicable to the relevant user.
For persons located in the United Kingdom, UK privacy and electronic communications laws, including the Privacy and Electronic Communications Regulations, may also apply to the relevant communication.
The user may withdraw consent to receive the newsletter or marketing communications at any time by using the unsubscribe link in an e-mail or by contacting the Store at:
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Refusal of marketing consent does not affect the ability to use the Store or place orders.
Messages concerning order fulfilment, payment, delivery, customs clearance, complaints, returns or responses to customer enquiries are not newsletters and may be sent for customer service purposes.
§ 7. Cookies and similar technologies
The Store uses cookies and similar technologies.
Cookies may be used in particular to:
a) ensure the proper functioning of the Store,
b) remember the contents of the shopping cart,
c) support login and customer account functionality,
d) ensure security,
e) analyse website traffic,
f) adapt Store content, language, country, market and currency,
g) conduct marketing activities where the user has provided the appropriate consent.
Some cookies and similar technologies are necessary for the proper operation of the Store and may be used without consent to the extent permitted by applicable law.
Analytics, marketing or other technologies requiring consent are used in accordance with the user’s consent settings and applicable law.
This also applies to users located in the United Kingdom to the extent that the UK GDPR and UK privacy and electronic communications laws apply.
The user may change cookie settings in the browser.
Where the Store provides a cookie banner or consent management panel, the user may also manage preferences using that tool.
Restricting or disabling certain cookies may affect the operation of the Store, in particular the shopping cart, login, market, language, currency selection or saved preferences.
§ 8. Who we may share personal data with
Personal data may be shared with entities supporting us in operating the Store and serving customers, in particular:
a) Shopify – as the provider of the e-commerce platform,
b) payment providers, including Shopify Payments, PayPal and other payment methods available in the Store,
c) courier companies, delivery operators, logistics operators, courier intermediaries, shipment protection providers and insurers – to the extent necessary to perform, secure or insure delivery,
d) customs representatives, customs agencies, brokers, customs clearance operators and other entities involved in international shipment transport – to the extent necessary for delivery or customs clearance,
e) competent customs, tax or other public authorities, including authorities competent for the United Kingdom, where disclosure is required by law or necessary for customs clearance,
f) e-mail and communication service providers,
g) contact form service providers where a form is operated using such a tool,
h) IT, hosting, security and website maintenance providers,
i) analytics and marketing tool providers where used by the Store and in accordance with the user’s consent settings,
j) accounting offices, accountants, legal or tax advisers where such services are used,
k) public authorities, courts, offices or other authorised entities where the obligation to disclose data results from applicable law.
Data is shared only to the extent necessary for the relevant purpose.
Entities processing data on our behalf should process it under appropriate agreements and in accordance with applicable data protection law.
§ 9. Shopify and data processing by Shopify
The Dial-House Store is operated using the Shopify platform.
Shopify may process users’ personal data in connection with the operation of the Store, orders, payments, customer accounts, security, fraud prevention, analytics, shopping features and other Shopify services.
To the extent Shopify processes data on behalf of Dial-House, Shopify may act as a processor.
In certain situations, Shopify may process data as an independent controller, in particular in relation to its own services, platform security, platform development, Shopify features and Shopify’s legal obligations.
More information about Shopify’s processing practices is available in Shopify’s privacy policies.
Users may use Shopify privacy tools where available for their country or type of processing.
§ 10. Payments
Payments in the Store may be processed by external payment providers, in particular Shopify Payments, PayPal or other methods available in the Store.
For electronic payments, payment data is processed by the relevant payment provider.
Dial-House does not store customers’ full payment card details.
Payment providers may process data in accordance with their own terms and privacy policies.
For cross-border payments, data may be processed in different countries in accordance with the infrastructure and policies of the relevant payment provider and applicable rules governing data transfers.
§ 11. Delivery and customs clearance
For the purpose of delivery within Poland, to selected countries of the European Economic Area and to the United Kingdom, customer data may be provided to the selected carrier, logistics operator, courier intermediary or entity providing shipment protection or insurance.
For international shipments outside the customs territory of the European Union, data may also be provided to a customs representative, broker, customs clearance operator and the competent customs or tax authorities.
Data disclosed in connection with delivery may include in particular:
a) first name and surname,
b) full delivery address including country, postal code and city,
c) telephone number,
d) e-mail address,
e) shipment number,
f) order information necessary to perform transport,
g) information about the value, type and description of the goods where required for customs clearance,
h) other information required by the carrier or competent authority where disclosure is necessary to lawfully complete delivery.
If the customer chooses delivery to a parcel locker or another delivery method requiring a telephone number or e-mail address, those details may be necessary to complete delivery.
For high-value shipments, data necessary to obtain shipment protection may be disclosed to the carrier, insurer or an external provider of protection services for valuable shipments.
For deliveries to the United Kingdom, the recipient may be asked by the carrier, customs representative or competent authority to provide additional information required for customs clearance.
Dial-House discloses data only to the extent necessary to prepare, dispatch, track, deliver, secure, insure and, where relevant, handle claims or customs procedures relating to the shipment.
§ 12. Transfers of data outside the European Economic Area and the United Kingdom
In connection with the use of Shopify, payment providers, IT services, analytics tools, forms, e-mail services or other technology providers, personal data may be processed or transferred outside the European Economic Area.
For persons located in the United Kingdom, data may also be transferred outside the United Kingdom.
Where personal data is transferred outside the European Economic Area, the transfer is made using a mechanism permitted by the GDPR, including in particular:
a) a European Commission adequacy decision,
b) standard contractual clauses,
c) binding corporate rules,
d) an applicable statutory derogation,
e) another legally permitted transfer mechanism.
Where the UK GDPR applies, transfers of data outside the United Kingdom take place using appropriate mechanisms provided for by the UK GDPR and applicable UK law.
Where an adequacy decision between the European Economic Area and the United Kingdom is in force, data may be transferred within the scope of that decision without an additional transfer mechanism.
The Controller takes measures aimed at using providers that ensure an appropriate level of personal data protection.
§ 13. Data retention period
We retain personal data for as long as necessary to fulfil the purpose for which it was collected.
Data relating to orders, payments, sales documentation, tax documentation, customs documentation and accounting obligations may be retained for the period required by applicable law.
Data relating to complaints, returns, order correspondence and potential claims may be retained for the limitation period applicable under relevant law.
Data processed on the basis of consent, in particular newsletter and marketing data, is processed until consent is withdrawn and subsequently for the period necessary to demonstrate that consent was given or withdrawn or to defend against potential claims.
Data provided through contact forms, “Find a Watch”, “Source a Watch” and “Sell / Exchange” forms is retained for the time necessary to handle the enquiry and thereafter generally for no longer than 2 years from the last contact, unless:
a) a contract has been concluded,
b) a complaint has been submitted,
c) a dispute has arisen,
d) it is necessary to establish, exercise or defend legal claims,
e) a legal obligation requires longer retention.
Technical data and cookie-related data is retained for the period resulting from the settings of the relevant cookie, tool, system or browser.
§ 14. User rights
A person whose data is processed has the rights provided for under the GDPR and, where the UK GDPR applies, the rights provided for under the UK GDPR.
Depending on the legal basis and nature of processing, these may include in particular:
a) the right of access,
b) the right to obtain a copy of personal data,
c) the right to rectification,
d) the right to erasure,
e) the right to restriction of processing,
f) the right to data portability,
g) the right to object to processing,
h) the right to withdraw consent at any time where processing is based on consent,
i) the right to lodge a complaint with the competent supervisory authority.
To exercise these rights, the user may contact the Controller at:
The Controller may request additional information to verify the identity of the person making the request where necessary to protect personal data.
A response to the request will be provided within the period required by applicable law.
The rights to erasure, restriction, objection or portability may be subject to conditions or exceptions under applicable law, in particular where continued processing is necessary to comply with legal obligations, perform a contract, complete customs clearance, handle a complaint or establish, exercise or defend legal claims.
§ 15. Complaint to a supervisory authority
A person whose data is processed has the right to lodge a complaint with the competent supervisory authority if the person believes that the processing of personal data infringes applicable data protection law.
The supervisory authority competent for the Controller in Poland is:
President of the Personal Data Protection Office.
Information about the Polish Personal Data Protection Office is available on the authority’s official website.
A person residing in another country of the European Economic Area may also contact the competent data protection supervisory authority in the country of residence, place of work or place of the alleged infringement where applicable law provides such a right.
Where the UK GDPR applies to the processing of a person located in the United Kingdom, that person may also have the right to lodge a complaint with:
Information Commissioner’s Office (ICO)
in accordance with UK law.
§ 16. Users located in the United Kingdom
Dial-House offers the possibility of purchasing and delivering selected products to the United Kingdom.
To the extent that the Controller offers goods or services to persons located in the United Kingdom and the processing of their personal data is subject to the UK GDPR, the Controller applies the UK GDPR and the Data Protection Act 2018 to the extent required by law.
Data of persons located in the United Kingdom may be processed in particular for the purpose of:
a) accepting and fulfilling an order,
b) processing payment,
c) arranging international shipment,
d) completing customs clearance formalities,
e) contacting the customer,
f) handling returns or complaints,
g) ensuring transaction security,
h) complying with the Controller’s legal obligations.
The Controller does not require customers to provide data beyond the scope justified by the transaction, delivery or legal obligation.
If an obligation arises under the UK GDPR to appoint a representative of the Controller in the United Kingdom, the information required by applicable law will be made available to users in the manner required by law.
§ 17. Data security
The Controller applies appropriate organisational and technical measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.
The scope of security measures is adapted to the nature of the data processed, available technology and the risks associated with processing.
No method of transmitting data over the internet or storing data electronically can guarantee complete security.
We recommend that users do not send through forms or messages:
a) passwords,
b) full payment card details,
c) particularly sensitive data,
d) identity documents unless specifically requested in circumstances where there is a lawful or justified need to provide them,
e) other information that is not necessary to handle the enquiry or order.
§ 18. Children’s data
The Dial-House Store is not intended for children.
We do not knowingly collect children’s personal data.
If a parent or legal guardian believes that a child has provided personal data to us, the parent or guardian may contact us at:
to submit an appropriate request, subject to situations in which continued processing is required by law.
§ 19. Links to external websites
The Store may contain links to external websites, payment services, service providers, social media or other platforms.
After visiting an external website, the user should review its privacy policy and security practices.
The Controller is not responsible for the privacy practices, security or content of websites that are not operated by the Controller.
§ 20. Changes to this Privacy Policy
The Controller may update this Privacy Policy in particular in the event of:
a) changes in applicable law,
b) changes in the way the Store operates,
c) expansion into new countries or markets,
d) changes in service providers,
e) changes in technical tools,
f) commencement of a registered business activity,
g) changes relating to Shopify, payments, delivery, customs procedures or data handling,
h) the need to clarify data processing rules.
The current version of this Privacy Policy is published on the Store website.
Changes to this Privacy Policy take effect from the date indicated in the updated version unless applicable law requires a different method of implementation.
In the event of material changes, users may be informed in a manner appropriate to the nature of the change where required by applicable law.
§ 21. Contact
For matters concerning privacy, personal data, the exercise of rights under the GDPR or UK GDPR, cookies, the newsletter or this Privacy Policy, please contact the Controller:
Karol Góral
Dial-House
Stary Szlak 46E
70-870 Szczecin
Poland
e-mail: kontakt@dial-house.com
telephone: 504 132 589
The Controller has not appointed a Data Protection Officer.
For all matters concerning personal data, please contact the Controller directly at: