Last updated: 15 October 2026

Leonarto.studio (the "Store") is operated by Bargen Invest Krystian Będkowski (hereinafter “Bargen Invest”). This Privacy Policy describes how we collect, use and disclose your personal information when you visit the Store, place an order, create an account, leave a review or otherwise communicate with us. Read it together with our Terms of Service, Returns & Refunds Policy and Shipping Policy. Where there is a conflict between the Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to the collection, use and disclosure of your personal information.

By using the Store, you confirm that you have read this Privacy Policy and understand how we handle your information as described here.

1. Who is responsible for your personal information

The controller of your personal information — the entity that decides why and how it is processed — is:

Bargen Invest
Henryka Barona 18/17
82-300 Elbląg, Poland
VAT ID: PL5783137952
Email: contact@leonarto.studio

Person responsible for the protection of personal information. The person in charge of the protection of personal information at Leonarto is Krystian Będkowski, the owner of the business. You can reach them at contact@leonarto.studio with "Privacy" in the subject line, or by post at the address above. This person handles questions, requests and complaints about personal information.

We have not appointed a Data Protection Officer, because we are not required to do so; the contact above is the route for all privacy matters.

2. Scope and our relationship with Shopify

Our Store is hosted on Shopify. Shopify provides the online store, checkout and payment infrastructure; for merchants outside North America, such as us, this service is provided by Shopify International Limited (Ireland). When Shopify processes your information to run our Store, it acts as our processor, under a data processing agreement. For some purposes — for example Shop Pay, fraud prevention and features that use data across Shopify merchants — Shopify decides itself how the data is used and is responsible for it. Read the Shopify Consumer Privacy Policy; to exercise your rights with Shopify, use the Shopify privacy portal.

Shop Pay. If you choose Shop Pay, you save your details (such as email, phone number, delivery address and payment card) with Shopify so that you can use them at other stores. Shopify processes that information under its own Consumer Privacy Policy, not under ours. We receive the order details needed to fulfil your order; we never receive your full card number.

Information you submit through the Store is transmitted to and processed by Shopify and by other providers, some of which may be located outside the country you live in.

3. Personal information we collect

"Personal information" means information that identifies you or can reasonably be linked to you. It does not include anonymised or aggregated information that can no longer be linked to you. Depending on how you interact with the Store and where you live, we may collect:

• Contact and identification details — your name, email address, phone number, billing address and delivery address, and, where you ask for an invoice with your tax details, your VAT identification number.
• Order and transaction details — what you ordered, when, at what price, the payment method used, delivery details, and information about returns, refunds and complaints.
• Payment information — payment method, payment confirmation and transaction identifiers. Full card numbers are handled by our payment providers; we do not store them.
• Account information — your email address, your password in encrypted form, your preferences and settings, and your order history.
• Your communications with us — the content of messages you send to us, including support enquiries and complaints, and, where you send them, photographs.
• Reviews and other content — reviews, ratings, images and other content you submit through our review platform, together with your display name and the fact that you bought from us where that is verified.
• Device and technical information — your device type, browser and operating system, your IP address, unique identifiers, and the settings that allow the Store to work on your device.
• Usage information — how and when you interact with the Store, the pages and products you view, what you add to your cart or wishlist, and where you came from.
• Marketing preferences — whether you have consented to marketing, and your interactions with our emails.

We do not intentionally collect sensitive personal information, such as information about health, religion, ethnic origin, political opinions or biometric data, and we do not use personal information to infer such characteristics.

4. Where we get your personal information from

• From you — when you place an order, create an account, subscribe to our newsletter, submit a review, send us a message or file a complaint.
• Automatically — from your device and browser when you use the Store, including through cookies and similar technologies.
• From our service providers — for example our platform, payment, review, hosting, email and marketing providers, which process information on our behalf.
• From carriers and production partners — delivery and tracking information relating to your order.
• From publicly available sources and social platforms — where you interact with us through social media, or where you provide information to a platform through which you reach us.

5. Why we use your personal information, and on what legal basis

We use your personal information only where we have a legal basis to do so. Under the GDPR and the UK GDPR those bases are set out below.

• To perform our contract with you (Article 6(1)(b) GDPR) — to process your order and payment, arrange production and delivery, handle returns, refunds and complaints, maintain your account, and publish reviews you submit.
• To comply with legal obligations (Article 6(1)(c) GDPR) — to issue invoices, keep accounting and tax records, handle consumer complaints within statutory time limits, respond to product safety obligations and to comply with requests from authorities.
• For our legitimate interests (Article 6(1)(f) GDPR) — to prevent and detect fraud and abuse, to keep the Store secure, to establish, exercise and defend legal claims, to improve our products, pricing and the Store, to measure how our Store and our marketing perform, to send marketing to our existing customers about similar products, and to administer our business.
• With your consent (Article 6(1)(a) GDPR) — to send you marketing emails or messages where you are not an existing customer, to use non-essential cookies and similar technologies, and for advertising and analytics tools that require consent. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

In the United States and Canada we process personal information for the same purposes, on the basis of your consent or of the lawful purposes permitted by the applicable federal, state and provincial law.

6. Marketing and advertising

We send marketing only where we are allowed to do so. If you are not our customer, we rely on your consent. If you are our customer, we may send you information about similar products on the basis of our legitimate interest, and you may opt out at any time.

• You can unsubscribe from marketing at any time using the link in any marketing email, or by writing to us. We act on opt-out requests promptly and, for recipients in Canada, within 10 business days.
• If you are in Canada, we comply with Canada's Anti-Spam Legislation: we rely on your express consent or on an applicable existing business relationship, every commercial message identifies us and includes a working unsubscribe mechanism, and the contact details in our messages remain valid for at least 60 days.
• If you opt out of marketing, we may still contact you about your orders, your account, a complaint, a recall or another matter that requires it.

Advertising and analytics tools. We use advertising and analytics tools provided by third parties to show you advertising about products you have viewed or bought, on our Store and on other websites, and to measure how our advertising performs. These tools may act as joint or independent controllers of the data they process for their own purposes. The providers we use are:

• TikTok — TikTok Pixel, TikTok Events API and TikTok Ads;
• Google — Google Ads, Google Analytics and Google Merchant Center, as well as YouTube for embedded video content;
• Pinterest — Pinterest Tag and Pinterest Ads;
• Meta — the Meta Pixel and Conversions API, covering Facebook and Instagram.

These tools may receive your device and usage information, your IP address, cookie and other online identifiers, and information about what you viewed, added to your cart or bought. Where the tool supports it, we may also share a hashed identifier, such as a hashed email address, which the provider can match to you if you have an account with it.

Customer lists. We also use audience features that work with lists rather than cookies — in particular Google Customer Match, and equivalent features offered by the other providers listed above. For these we upload a list built only from our own first-party customer records, containing a hashed form of your email address and, where relevant, your phone number. The provider matches that list against its own user accounts and uses it to show our advertising to the matched users or to exclude them from campaigns. Hashed data of this kind is personal information, and we share it only where we have a lawful basis to do so: for customers in the European Economic Area, Switzerland and the United Kingdom, only where you have given the consents required for the advertising use of your data and for ad personalisation. We never upload lists we did not collect ourselves, we do not upload information about anyone we know to be a minor, and we do not use these lists to infer sensitive interests about you. You can opt out of this and of targeted advertising as described in sections 8 and 14: if you withdraw consent, object, or ask us to delete or correct your data, we remove you from the customer lists we have uploaded and use the provider's deletion controls for the copy it holds. Uploaded lists also expire automatically if they are not refreshed.

In the European Economic Area, Switzerland and the United Kingdom these tools are used only with your consent, which you give through the cookie preference centre and can withdraw at any time. If you are in the United States, you can opt out of targeted advertising and of what the applicable state law calls "sale" or "sharing" as described in sections 8 and 14. You can also limit personalised advertising directly in the settings of your TikTok, Google, Pinterest and Meta accounts.

7. Who we share your personal information with

We do not sell your personal information for money. We share it only with the recipients below, and only to the extent needed for the purpose at hand. Where a recipient acts as an independent controller rather than as our processor, it decides for itself how it uses the data and its own privacy policy applies to that processing.

• Shopify — Shopify Inc. and its group companies, including Shopify International Limited (Ireland). Platform hosting, checkout, payments and Store infrastructure. Shopify acts as our processor and, for certain enhanced features that combine data across merchants, as an independent controller.
• Payment providers — the providers behind the payment methods shown at checkout: Shopify Payments (provided by Shopify International Limited, which uses payment processors such as Stripe Payments Europe, Limited and Adyen N.V.), PayPal (Europe) S.à r.l. et Cie, S.C.A., and the operators of the local methods. They process payment data and act as independent controllers for some purposes, such as fraud prevention and their own legal obligations.
• Judge.me Ltd, London, United Kingdom (company number 12157706) — our review platform, which collects, stores and displays reviews. Judge.me acts as our processor under a data processing agreement.
• Our production and logistics partners — the print-on-demand provider and the partner network of printing facilities that produce our posters. Your delivery details are shared with the production facility closest to your address and with the carrier handling the parcel. Production partners act as our processors; carriers act as independent controllers for the delivery and for their own legal obligations.
• Advertising and analytics providers — Google Ireland Limited and Google LLC (Google Ads, Google Analytics, Google Merchant Center, Google Customer Match and YouTube); Meta Platforms Ireland Limited and Meta Platforms, Inc. (the Meta Pixel and Conversions API, covering Facebook and Instagram); Pinterest Europe Ltd and Pinterest, Inc. (Pinterest Tag and Pinterest Ads); and TikTok Technology Limited (Ireland) together with TikTok Information Technologies UK Limited (TikTok Pixel, TikTok Events API and TikTok Ads).
• Email and messaging providers — Shopify Email, provided by Shopify Inc. and its group companies, including Shopify International Limited (Ireland), used to send store emails, order and delivery notifications and newsletters; and Klaviyo, Inc. (United States), used for email marketing and marketing automation, which acts as our processor under its Data Processing Agreement and, where it processes personal information subject to the privacy law of a US state, as our service provider.
• Professional advisers — our accountant, bookkeeper, lawyer, insurer and auditor, where necessary.
• Authorities and courts — where we are required by law, or where it is necessary to establish, exercise or defend legal claims.
• A buyer or successor of our business — if our business or assets are sold or transferred, personal information may be disclosed to the buyer as part of the transaction, subject to this Privacy Policy.

How the roles are split. For list-based audience features, in particular Google Customer Match, we are the controller and the provider processes the uploaded list as our processor under its data processing terms. For cookie and pixel-based advertising, measurement and analytics, the providers act as independent or joint controllers for the purposes they pursue themselves, and their own privacy policies apply to that processing.

Where you ask us to, or where you clearly consent to it, we may also share information with other third parties — for example where a carrier needs your phone number to arrange delivery, or where you use a social login or a social widget on the Store.

Pinterest API integration. We use the Pinterest API to publish images of our own products to our own Pinterest boards and to keep their titles, descriptions and links up to date. This integration operates only on Leonarto's own Pinterest business account. It does not collect, access or store personal information of our customers or of other Pinterest users. The only credential it keeps is the access token for our own account, held in access-restricted storage and never shared.

8. Cookies and similar technologies

We use cookies and similar technologies to operate the Store, to remember your preferences, to keep your cart and session working, to measure how the Store is used and, with your consent where required, to support advertising.

• Strictly necessary cookies — needed for the Store to work: cart, checkout, security, load balancing, and Shopify's own consent and fraud-prevention functions. These cannot be switched off.
• Functional cookies — remember your choices, such as language, currency and region.
• Analytics cookies — set through Google Analytics and similar tools, to help us understand how the Store is used so we can improve it.
• Marketing and advertising cookies — set through Google Ads, the Meta Pixel and Conversions API, the Pinterest Tag, the TikTok Pixel and the web tracking of our email marketing platform, Klaviyo, to show you advertising on other websites, to personalise the emails we send you and to measure the effectiveness of both, including based on what you viewed or bought.
• Embedded content — where we embed a YouTube video or other third-party content, the provider may set cookies and receive information about your device and your use of the Store. Where possible we use the privacy-enhanced embedding mode.

Where consent is required, non-essential cookies and pixels are set only after you give it, in the cookie banner shown on your first visit. You can change or withdraw your choice at any time through the "Cookie preferences" link in the footer of the Store, and you can also manage or delete cookies in your browser settings. The cookies Shopify itself sets on the Store are described in the Shopify Cookie Policy. Blocking strictly necessary cookies may prevent parts of the Store, including checkout, from working.

The current list of cookies and the providers behind them is available in the cookie preference centre on the Store, which always reflects the tools actually in use.

9. Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not use personal information to build profiles of you for such decisions.

We do use automated tools for everyday purposes — for example fraud screening at checkout, spam and abuse filtering on reviews, and measuring the performance of our advertising. Where you are in Quebec, we inform you that no decision concerning you is taken exclusively by an automated system with the effects described above.

10. Children

The Store is not intended for children. We do not knowingly collect personal information from children under the age of majority in your jurisdiction. Where we need to set a specific age:

• in the European Economic Area and the United Kingdom, we do not knowingly process personal information of children under 16;
• in the United States, we do not knowingly collect personal information from children under 13;
• in Quebec, where a person is under 14, consent for the collection of personal information must be given by the parent or guardian.

If you are a parent or guardian and believe that a child has given us personal information, write to contact@leonarto.studio and we will delete it. We do not sell or share the personal information of people under 16.

11. Security

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls and working only with providers that meet recognised security standards. No system is perfect, and we cannot guarantee absolute security. Please keep your account password confidential and do not send us sensitive information through unsecured channels.

If a personal data breach occurs that is likely to result in a high risk to your rights, we will inform you and the competent supervisory authority as required by law. Under Quebec law we keep a register of confidentiality incidents and notify the Commission d'accès à l'information of any incident presenting a risk of serious injury.

12. How long we keep your personal information

We keep personal information only as long as we need it for the purposes described above, and then delete or anonymise it. In practice:

• Orders, invoices and accounting records — for 5 years from the end of the tax year in which the invoice was issued, as required by Polish tax law, and where a contract claim is possible, for the statutory limitation period for contractual claims, which is generally up to 6 years under Polish law.
• Account data — for as long as your account exists, and for up to 30 days after you delete it, while our backups refresh.
• Correspondence, complaints and returns — for as long as needed to handle the matter and then for the limitation period for related claims.
• Reviews — for as long as they remain published; the platform also keeps records of hidden and removed reviews. You can ask us to remove a review you wrote.
• Marketing data — until you withdraw your consent or opt out, and then for a short period to record your preference.
• Cookie and analytics data — for the periods stated in the cookie preference centre.
• Customer lists used for advertising — for as long as you remain a customer or subscriber and have not opted out; the lists we upload expire automatically if they are not refreshed, and when you withdraw consent or ask us to delete your data we remove you from them.

Where a legal obligation, a complaint, an investigation or a legal claim requires it, we may keep the relevant information for longer, limited to what is necessary.

13. Transfers outside your country

We — and the providers we work with — may transfer, store and process your personal information outside the country you live in, including outside the European Economic Area and the United Kingdom.

Where we transfer personal information out of the EEA, Switzerland or the UK, we rely on recognised safeguards: an adequacy decision of the European Commission or the UK adequacy regulations; the Standard Contractual Clauses approved by the European Commission; the UK International Data Transfer Addendum; or the EU–US Data Privacy Framework, the UK Extension and the Swiss–US Data Privacy Framework where the recipient is certified under them. For Shopify, transfers rely on its Binding Corporate Rules, the Standard Contractual Clauses and the European Commission's adequacy decision for Canada.

Some of the third countries concerned are worth naming, because different providers transfer to different places:

• our platform operates infrastructure in the European Union, the United States and Canada; our review platform, Judge.me, operates from the United Kingdom and transfers data onward under the Standard Contractual Clauses and the UK International Data Transfer Addendum; our production partners print and ship each order at a facility in or near the country of delivery;
• our email marketing provider, Klaviyo, Inc., stores the personal data it processes for us in the United States and relies on its certification under the EU–US Data Privacy Framework, the UK Extension and the Swiss–US Data Privacy Framework, with the Standard Contractual Clauses as a fallback; it has appointed the European Data Protection Office (EDPO) as its data protection representative in the EU/EEA and the UK;
• TikTok informs controllers that personal data of users in the EEA is stored on servers in the United States and Singapore and may be accessed remotely by entities in its corporate group located in Brazil, China, Malaysia, the Philippines, Singapore and the United States;
• Google, Meta and Pinterest transfer personal data to the United States and to other countries, relying on the Data Privacy Framework where they are certified and otherwise on Standard Contractual Clauses.

Our production model means that your delivery details are shared with the printing facility closest to you, which may be located in a country other than your own, so that your order travels the shortest possible distance. Where required by law, including under Quebec's Law 25, we assess the transfer before it takes place. You can ask us for more information about the safeguards we rely on by writing to contact@leonarto.studio.

14. Your rights

Depending on where you live, you may have some or all of the following rights. They are not absolute and may be subject to legal conditions and exceptions. We will never discriminate against you for exercising them.

• Access and information — you can ask what personal information we hold about you, and where it came from.
• Copy and portability — you can ask for a copy of your personal information in a structured, commonly used format, and in some cases ask us to transfer it to another provider.
• Correction — you can ask us to correct inaccurate or incomplete information.
• Deletion — you can ask us to delete your personal information, subject to the records we are required to keep.
• Restriction and objection — you can ask us to restrict processing, and object to processing based on our legitimate interests.
• Withdrawal of consent — where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Opt out of sale, sharing and targeted advertising — you can ask us not to use your personal information for targeted advertising or for what the applicable US state law calls "sale" or "sharing". You can exercise this through the "Cookie preferences" link and, in the United States, through the "Your privacy choices" link in the footer of the Store, or by writing to us.
• Global Privacy Control — if you visit the Store with the Global Privacy Control signal enabled, we treat it as a request to opt out of sale and sharing for the browser or device you use, and, where we can link the signal to an account, for the account as well. We do not respond to other "Do Not Track" signals.
• Appeal — if we refuse a request, you can ask us to reconsider it by replying to our decision.
• De-indexing and cessation of dissemination — if you are in Quebec, you may ask us to stop disseminating your personal information and to de-index any hyperlink attaching your name to information that contravenes law or a court order.
• Limiting the use of sensitive personal information — if you are in California, you may direct us to limit the use of sensitive personal information; we do not collect or use sensitive personal information for that purpose.

If you are outside the EEA, the UK, Switzerland, Brazil, California and Canada, local law may still give you some of these rights, and we will apply them where we can.

15. How to exercise your rights

Write to contact@leonarto.studio with "Privacy" in the subject line, or by post to the address in section 1. Please tell us what you want and enough about you for us to find your records.

We will answer without undue delay and, at the latest, within one month of receiving your request, as required by the GDPR; where a request is complex we may extend that period and will tell you why. Under Quebec law we acknowledge requests promptly and give a reasoned answer within 30 days.

We may need to verify your identity before acting, so we do not disclose personal information to the wrong person. If you use an authorised agent, we may ask for proof that you authorised them, and in some cases we may still need to confirm your identity directly with you.

There is no charge for exercising your rights, except where a request is manifestly unfounded or excessive, in which case a reasonable fee may apply and you will be told before we proceed.

16. Complaints

If you are unhappy with how we handle your personal information, please contact our privacy contact in section 1 first — most matters are resolved quickly that way. You can also ask us to reconsider a decision we have taken on your request.

You always have the right to complain to a supervisory authority:

• Poland and the EEA — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland. A list of authorities in other EEA countries is available on the European Data Protection Board website.
• United Kingdom — the Information Commissioner's Office (ICO).
• Quebec — the Commission d'accès à l'information du Québec (CAI); elsewhere in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in what we do, in the law or in our providers. The current version is always published on the Store, with the date of the last update shown at the top. Where a change is significant, we will notify you as required by applicable law — for example by email to registered users, or by a notice on the Store. Continuing to use the Store after a change means you accept the updated policy.

18. Language

This Privacy Policy is published in English. If you are a consumer in Québec, a French version is available on the Store and on request at contact@leonarto.studio; where the French and English versions diverge, the version most favourable to you applies. Where the law of your country requires this policy or your consent to be given in another official language, that version prevails.

19. Contact

For any question about this Privacy Policy or about how we handle your personal information:

Bargen Invest
Henryka Barona 18/17
82-300 Elbląg, Poland
Person responsible for the protection of personal information: Krystian Będkowski
Email: contact@leonarto.studio
Customer service: Monday to Friday, 9:00–16:30 CET