Privacy & Terms

1. Data Collection & Processing

We collect and process the following personal data:

Account information

Name and email address, collected when you purchase a product or contact support. Legal basis: performance of a contract. Retention: for the duration of your license plus 5 years for accounting obligations.

Purchase records

Order details and payment references, processed to fulfil your order and activate your license. Legal basis: performance of a contract. Retention: 5 years to comply with Polish accounting law.

Support correspondence

Messages and attachments you send to our helpdesk. Legal basis: legitimate interest in providing contracted support. Retention: 5 years from ticket closure.

2. Purchase Code & Update Verification

To protect product licensing and prevent unauthorised distribution, our update verification service checks your license when your store requests a theme or module update.

During this process the following data is transmitted and logged:

• Attempt timestamp
• Masked purchase code (only partial characters are recorded)
• Active shop domain
• Server IP address

No customer names, passwords, or payment credentials are transmitted or recorded during update checks.

Legal basis: legitimate interest in protecting intellectual property. Retention: validation logs are retained for 90 days and then automatically deleted.

3. Third-Party Processors

We share data with the following sub-processors, each bound by their own data processing agreements:

Stripe

Payment processing. Data shared: billing details and transaction records. Stripe Privacy Policy

Envato

Purchase code verification for marketplace licenses. Data shared: purchase codes and domain. Envato Privacy Policy

Digital Ocean

Server infrastructure. Data shared: server logs and IP addresses.

Microsoft Clarity

Website analytics and session insights, active only if you accept analytics cookies. Data shared: anonymised usage data, device and browser information. Microsoft Privacy Statement

We do not sell customer data to advertising networks or any third parties beyond those listed above.

4. Cookies

We use three categories of cookies:

Strictly necessary cookies

Manage your active session. These are required for the site to function and do not require your consent.

Preference cookies

Save your chosen interface settings such as light or dark theme. These are set only after you make a choice and are retained for 12 months.

Analytics cookies

Microsoft Clarity collects anonymised usage data to help us improve the site. These are set only if you accept analytics via our cookie banner and are retained for up to 12 months. Legal basis: consent.

We do not run third-party advertising scripts. Analytics cookies are optional and require your consent before they are set.

5. Your Rights Under GDPR

As an EU resident you have the following rights regarding your personal data:

Access

Request a copy of the data we hold about you.

Rectification

Request correction of inaccurate data.

Erasure

Request deletion of your data where no legal retention obligation applies.

Restriction

Request that we limit processing of your data.

Portability

Request your data in a machine-readable format.

Objection

Object to processing based on legitimate interest.

To exercise any of these rights contact us at support@promokit.eu. We will respond within 30 days.

If you believe your rights have been violated you have the right to lodge a complaint with the Polish data protection authority:

6. International Data Transfers

Stripe is headquartered in the United States. Data transfers to Stripe are conducted under Standard Contractual Clauses approved by the European Commission, ensuring an adequate level of protection for your personal data.

7. Changes to This Policy

We may update this policy when our practices change or when required by law. Material changes will be communicated by updating the date at the top of this page. We encourage you to review this page periodically.