Privacy Policy

Last updated: August 12, 2026

This Privacy Policy explains how Behemoth Webstore, operated by Behemoth Webstore Maciej Gruszka, with its business address at Gdyńska 99, 80-297 Miszewo, Poland (“Behemoth Webstore”, “we”, “us”, or “our”), collects, uses, stores, discloses, and otherwise processes personal information when you visit or use our website, create an account, place an order, subscribe to email or text message marketing, submit a review, communicate with us, or otherwise use our products and services (collectively, the “Services”).

Our store is powered by Shopify. We also use third-party service providers, including Klaviyo for email and SMS marketing, Judge.me for product and store reviews, BaseLinker for order, inventory, and fulfillment management, and eDesk for customer support.

This Privacy Policy is intended to provide information required under applicable privacy and data protection laws, including Regulation (EU) 2016/679 (“GDPR”), applicable Polish law, the UK GDPR, Swiss data protection law, and, where applicable, privacy laws in other jurisdictions in which we offer our Services.

Where applicable local law provides you with additional or greater rights than those described in this Privacy Policy, the applicable local law will prevail.

---

1. Data Controller

The controller responsible for your personal information is:

Behemoth Webstore Maciej Gruszka
Gdyńska 99
80-297 Miszewo
Poland
NIP: PL5842331183
REGON: 220949515

Email: support@behemoth-store.com

You may use these contact details to ask questions about this Privacy Policy or to exercise your privacy rights.

---

2. Scope and Definitions

“Personal information” or “personal data” means any information relating to an identified or identifiable individual, including information that can reasonably be linked to you directly or indirectly.

Personal information does not include information that has been irreversibly anonymized or aggregated so that it can no longer reasonably be linked to an identifiable individual.

This Privacy Policy does not apply to third-party websites, platforms, applications, or services that we do not control, even if they are linked from our website. Those third parties process information in accordance with their own privacy policies.

---

3. Personal Information We Collect

Depending on how you interact with the Services, we may collect the following categories of personal information.

3.1 Identification and contact information

• First and last name
• Email address
• Telephone number
• Billing and shipping address
• Country or region
• Customer or account identifiers

3.2 Order and commercial information

• Products viewed, selected, saved, added to a cart, or purchased
• Order contents and order value
• Discounts and promotional codes
• Purchase history
• Returns, exchanges, cancellations, and refunds
• Shipping and delivery information
• Product interests and customer preferences
• Interactions with product recommendations and promotions

3.3 Payment information

• Selected payment method
• Payment status and confirmation
• Transaction identifiers
• Limited billing information received from payment providers

Complete payment card information is generally collected and processed directly by Shopify Payments or another payment service provider. We do not normally receive or store your complete payment card number or card security code.

3.4 Account and authentication information

• Account login information
• Account settings and preferences
• Authentication and security records
• Provider-specific identifiers used for social sign-in

3.5 Device, browser, and online activity information

• IP address
• Browser type and version
• Device type
• Operating system
• Device and online identifiers
• Language and time-zone settings
• Network and connection information
• Pages and products viewed
• Links and buttons clicked
• Date, time, and duration of visits
• Referring website, campaign, or advertising source
• Shopping cart and checkout activity
• Purchase events
• Cookie, pixel, SDK, and similar technology identifiers
• Email and SMS delivery and engagement information, where applicable

3.6 Approximate location and market localization

When you visit the Services, Shopify may use your IP address to estimate your country or general region and match you to the appropriate store market.

We may also use information such as your browser language, selected country or region, previously saved market preference, telephone country code, billing address, and shipping address for localization purposes.

We use this information to display the appropriate version of the store, including relevant language, currency, prices, taxes, product availability, shipping options, and other market-specific content.

This is approximate, IP-based localization and may not always identify your location correctly, for example if you use a VPN, corporate network, proxy, or certain mobile networks.

We do not use browser-based GPS functionality or intentionally collect precise GPS coordinates, latitude, or longitude through the Services. If we introduce a feature that collects precise device location in the future, we will provide an appropriate notice and request any consent or device permission required by applicable law.

3.7 Email and SMS marketing information

When you subscribe to email or text message marketing, we may collect and retain:

• Your email address and/or telephone number
• The marketing channel to which you subscribed
• The date and time of subscription
• The signup form, page, checkout, or other source through which consent was provided
• Your IP address, country, device, and browser information associated with signup
• The consent disclosure presented when you subscribed
• Single or double opt-in confirmation information, where applicable
• Your subscription, suppression, and unsubscribe status
• Delivery, click, and other engagement information
• Records of opt-out, help, or support requests

3.8 Communications

When you contact us, we may collect information contained in your communication, including:

• Customer service inquiries
• Emails and other messages
• Return and exchange requests
• Complaints and warranty claims
• Other information that you voluntarily provide to us

3.9 Reviews and customer feedback

If you submit a product or store review, or if we invite you to submit a review through Judge.me, we may process:

• Your name or reviewer display name
• Your email address
• Your order number and order information
• Products and product variants purchased
• Review rating and review content
• Photos, videos, or other media submitted with a review
• Information used to verify that you purchased a product
• Review request, submission, verification, publication, and moderation status

Reviews that you choose to publish may be visible to other visitors of our website. Please do not include information in a public review that you do not want to make publicly available.

3.10 Social sign-in information

If you choose to create or access an account using Google or Facebook, we may receive information made available by the relevant identity provider, such as:

• Your name
• Email address
• Profile image
• Language or locale
• A provider-specific account identifier

We do not receive your Google or Facebook password.

3.11 Inferences and customer segments

We may create limited inferences about product interests, purchasing preferences, customer engagement, and likely relevance of offers based on your interactions with the Services.

We may use these inferences to create customer segments, personalize content, determine which communications may be relevant to you, and measure marketing performance, subject to applicable consent and opt-out requirements.

3.12 Sensitive information

We do not intentionally request or collect special-category or highly sensitive personal information such as health information, biometric identifiers, religious beliefs, political opinions, sexual orientation, or precise GPS location.

Please do not provide such information in free-text messages unless it is genuinely necessary for us to respond to your request.

---

4. Sources of Personal Information

We may collect personal information from the following sources:

• Directly from you, including when you create an account, place an order, subscribe to marketing, contact us, submit a review, or complete a form.
• Automatically from your browser or device, through cookies, pixels, SDKs, local storage, server logs, and similar technologies.
• From Shopify, which hosts and supports the Services and provides ecommerce functionality.
• From Klaviyo, which supports customer profiles, email marketing, SMS marketing, consent records, onsite forms, customer segmentation, and marketing analytics.
• From Judge.me, which provides review functionality, review requests, review verification, and review management.
• From BaseLinker and eDesk, which support order management, inventory, fulfillment, shipping documentation, and customer support handling.
• From payment, shipping, fulfillment, customer support, fraud-prevention, security, analytics, and technology service providers acting for us.
• From advertising and social media providers, such as Google and Meta, where permitted by applicable law and your privacy choices.
• From identity providers, such as Google or Meta/Facebook, if you choose to use social sign-in.
• From publicly available sources and other third parties, where permitted by law.

---

5. How and Why We Use Personal Information

Where the GDPR, UK GDPR, or another law requiring a specific legal basis applies, we process personal information on one or more of the legal bases described below.

Information required to provide the Services

Certain personal information is necessary to process an order, accept payment, deliver products, provide customer service, or comply with applicable law.

If you do not provide information that is necessary for these purposes, we may be unable to accept or fulfil your order or provide the requested Service.

Providing information for email or SMS marketing is optional. You may purchase products without subscribing to marketing communications.

---

6. Email and SMS Marketing

6.1 Separate consent for email and SMS

Email marketing consent and SMS marketing consent are separate.

Subscribing to email marketing does not automatically subscribe you to SMS marketing, and subscribing to SMS marketing does not automatically subscribe you to email marketing.

Where consent is required, we send marketing communications only after you have affirmatively agreed to receive them through the relevant channel.

Consent to receive marketing communications is not a condition of purchasing products or using the non-marketing parts of the Services.

6.2 Email marketing

If you subscribe to email marketing, we may send you communications regarding:

• New products and collections
• Product releases
• Restocks
• Collaborations
• Events and brand news
• Promotions and special offers
• Other marketing relating to Behemoth Webstore

You can unsubscribe at any time by using the unsubscribe link contained in a marketing email or by contacting us.

6.3 SMS marketing program

If you separately subscribe to SMS marketing, we may send text messages regarding:

• Product releases and new collections
• Restocks and product availability
• Promotions, discounts, and special campaigns
• Events, collaborations, and brand news
• Cart and checkout reminders, where enabled and permitted by applicable law

Messages may be sent using automated technology. Message frequency may vary. Message and data rates may apply depending on your mobile provider, mobile plan, and country.

Consent to receive text messages is not a condition of any purchase. Where two-way messaging is supported for the sending number used, you may reply “STOP” to unsubscribe or “HELP” for assistance. You may also contact us at support@behemoth-store.com at any time.

Further information about our SMS program is available in our Mobile Messaging Terms.

6.4 How we use telephone numbers and SMS consent information

We may use telephone numbers and associated SMS consent information to:

• Record and verify your SMS subscription
• Send messages you have agreed to receive
• Personalize SMS communications
• Measure delivery and program performance
• Process unsubscribe and help requests
• Maintain suppression and opt-out records
• Prevent fraudulent or unauthorized subscriptions
• Provide customer support relating to the SMS program
• Demonstrate compliance with applicable legal, carrier, and messaging requirements

6.5 Abandoned cart and checkout text messages

Our website uses cookies, similar technologies, Shopify functionality, Klaviyo onsite tracking, and related technical tools to help record products that you view or place in your shopping cart and to determine when a shopping cart or checkout appears to have been abandoned.

If you have separately provided valid consent to receive SMS marketing from Behemoth Webstore, and applicable law and messaging requirements permit it, we may use this information to determine when to send you a shopping cart or checkout reminder by text message.

We do not treat the mere act of entering a telephone number during checkout as consent to receive promotional text messages unless an appropriate SMS consent disclosure was presented and you affirmatively agreed to receive such messages.

6.6 SMS opt-in information and third-party sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of information described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We do not sell or rent your mobile telephone number, SMS opt-in data, or SMS consent information.

This restriction does not prevent us from disclosing information to service providers that process information on our behalf solely to operate, deliver, secure, or support our SMS program. These service providers may include Klaviyo, Shopify, telecommunications carriers, messaging aggregators, cloud service providers, technical support providers, and fraud-prevention providers.

We may also disclose information where required by applicable law, a valid legal request, or where necessary to protect our legal rights.

6.7 Withdrawing marketing consent

You may withdraw your consent to email marketing at any time by using the unsubscribe link in our marketing emails or by contacting us.

The available opt-out method for text messages depends on the type of sending number used for a given message. Where two-way messaging is supported, you may reply with a supported keyword such as “STOP” to unsubscribe, or “HELP” to request assistance. Where messages are sent using a branded sender ID or another sending method that does not support incoming replies, an unsubscribe link is included in the message instead. You may also unsubscribe at any time by contacting us at support@behemoth-store.com.

Withdrawal of consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

Unsubscribing from marketing does not prevent us from sending non-marketing communications necessary to process your order, provide requested customer service, protect your account, or comply with law.

6.8 Availability of the SMS program

Our SMS marketing program is not available in every country. We are able to collect SMS consent and deliver text messages only in a limited set of countries supported by our messaging service provider.

If your country is not supported, the SMS subscription option may not be offered to you, or a subscription may not result in the delivery of messages. In that case you can continue to receive our communications by email.

The list of supported countries may change over time. You may contact us at support@behemoth-store.com to ask whether the SMS program is currently available in your country.

---

7. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, SDKs, local storage, server-side events, plugins, and other similar technologies.

These technologies may be used to:

• Operate essential website and checkout functionality
• Keep products in your shopping cart
• Authenticate accounts
• Prevent fraud and protect the Services
• Remember your privacy, language, and market preferences
• Determine your approximate country or region
• Measure website use and performance
• Understand browsing and product activity
• Understand shopping cart, checkout, and purchase activity
• Personalize content and product recommendations
• Measure and improve advertising
• Create advertising audiences where permitted
• Determine whether a shopping cart or checkout has been abandoned
• Support Shopify Enhanced Services and Network Intelligence where enabled

In the European Economic Area, United Kingdom, Switzerland, and other jurisdictions that require prior consent, we use non-essential analytics, personalization, advertising, and similar technologies only after obtaining the required consent.

Technologies that are strictly necessary to provide a service you requested, such as maintaining your shopping cart, processing checkout, protecting the website, or recording privacy choices, may operate without optional consent where permitted by law.

You can manage your preferences using our cookie banner and our Privacy Preferences page.

You can withdraw consent at any time. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.

Where required by applicable law, we recognize a supported Global Privacy Control (GPC) signal as a request to opt out of qualifying sale, sharing, or use of personal information for targeted advertising for the browser and device transmitting that signal.

Other browser “Do Not Track” signals may not be recognized because there is no consistent industry standard for interpreting such signals.

---

8. How We Disclose Personal Information

We disclose personal information only where reasonably necessary for the purposes described in this Privacy Policy, including to the following categories of recipients.

8.1 Shopify

Shopify hosts our store and provides ecommerce, checkout, customer account, payment, fraud-prevention, localization, analytics, personalization, and related technology services.

8.2 Klaviyo and messaging providers

We use Klaviyo for customer profiles, email marketing, SMS marketing, signup forms, consent records, customer segmentation, onsite activity tracking, suppression records, and marketing analytics.

Telecommunications carriers and messaging providers may process telephone numbers and routing information in order to deliver text messages.

8.3 Judge.me

We use Judge.me to collect, verify, display, moderate, and manage product and store reviews and, where enabled, to send post-purchase review requests.

For these purposes, Judge.me may process information such as your name, email address, order information, purchased products, product variants, fulfilment information, review request status, review content, review media, and information used to verify that a review relates to a genuine purchase.

When Judge.me processes buyer or reviewer information received from us in connection with our store, Judge.me generally acts as a processor or sub-processor on our behalf. Judge.me may act as an independent controller when you interact directly with its own services.

You can learn more about Judge.me's processing at: Judge.me Privacy Policy.

8.4 Payment providers

Payment processors, banks, card networks, and fraud-prevention providers may process information necessary to authorize payments, prevent fraud, manage payment disputes, and issue refunds.

8.5 Shipping and fulfillment providers

We may disclose information such as your name, shipping address, email address, telephone number, and order details to postal operators, couriers, fulfillment providers, customs agents, and other delivery partners where necessary to fulfil your order.

8.6 Technology and professional service providers

We may use hosting, cloud storage, IT support, security, analytics, customer support, accounting, legal, auditing, and consulting service providers. These include BaseLinker, which we use for order management, inventory, fulfillment, and shipping documentation, and eDesk, which we use to receive, organize, and respond to customer support communications.

8.7 Advertising, analytics, and social media partners

Subject to applicable consent and opt-out requirements, we may disclose identifiers, device information, online activity, purchase information, and related information to advertising and analytics providers such as Google, Meta, Shopify, and similar providers.

This information may be used to measure campaigns, create audiences, understand advertising performance, personalize content, and display relevant advertising.

Under certain United States state privacy laws, some of these disclosures may be considered a “sale”, “sharing”, or processing for “targeted advertising”, even where we do not receive money in exchange for the information.

Where applicable, you may exercise an opt-out through our Privacy Preferences page or through a supported Global Privacy Control signal.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of information described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

8.8 Identity providers

If you use Google or Facebook to create or access an account, information may be exchanged with the identity provider as necessary to authenticate you and operate the linked account functionality.

8.9 Legal requirements and protection of rights

We may disclose personal information when reasonably necessary to comply with applicable law, a court order, valid legal process, regulatory request, or law-enforcement request, or to protect the rights, property, safety, and security of Behemoth Webstore, our customers, or others.

8.10 Business transactions

Personal information may be disclosed in connection with a merger, acquisition, restructuring, financing, sale of assets, insolvency, or another business transaction, subject to applicable confidentiality and legal safeguards.

8.11 At your direction

We may disclose information where you ask us to do so or provide specific consent.

---

9. Shopify and Shopify Network Intelligence

Our Services are hosted by Shopify. Information you submit through the Services is transmitted to and processed by Shopify, its affiliates, and its service providers in order to operate our store, provide ecommerce and checkout functionality, protect against fraud, and provide related services.

If Shopify Network Intelligence is enabled for our store, Shopify may process information about your interactions with our store together with information about your interactions with Shopify and other Shopify merchants in order to provide Enhanced Services.

These Enhanced Services may include:

• Improved personalization
• Product and shopping recommendations
• Advertising and advertising measurement
• Fraud prevention and security
• Customer and business insights
• Store, checkout, and ecommerce improvements

For some activities, Shopify processes information as our processor or service provider. For certain Shopify consumer services and processing carried out for Shopify's own purposes, Shopify may act as an independent controller or business under applicable law.

Where consent is required for non-essential cookies or similar technologies, Shopify's use of information for non-essential Network Intelligence purposes is subject to the privacy choices communicated through our consent management tools.

Where applicable law provides an opt-out right relating to sale, sharing, or targeted advertising, you may use our Privacy Preferences page or a supported Global Privacy Control signal.

You can learn more about Shopify's processing through:

• Shopify Consumer Privacy Policy
• Shopify Privacy Portal

---

10. Social Sign-In: Google and Facebook

You may be able to create or access an account using Google or Facebook.

When you use social sign-in, the identity provider authenticates you and may provide selected account information to us so that we can create or link your store account, provide access to it, and protect against unauthorized access.

We do not receive your Google or Facebook password.

Google and Meta/Facebook process information for their own purposes in accordance with their respective privacy policies.

You can revoke access through your provider settings:

• Google: Google account permissions
• Facebook: Facebook apps and websites settings

You may also contact us at support@behemoth-store.com if you want assistance unlinking social sign-in from your store account.

---

11. International Data Transfers

We are established in Poland, but some of our service providers and business partners may process personal information in countries outside Poland, the European Economic Area, the United Kingdom, or Switzerland.

Where personal information is transferred to a country that has not been recognized as providing an adequate level of data protection and applicable law requires safeguards, we rely on an appropriate transfer mechanism, which may include:

• European Commission Standard Contractual Clauses
• The UK International Data Transfer Agreement or UK Addendum
• Applicable Swiss transfer safeguards
• Binding corporate rules
• Approved certification mechanisms
• Another transfer mechanism permitted by applicable law

We may also use supplementary technical, contractual, and organizational safeguards where appropriate.

You may contact us for additional information about safeguards used in connection with applicable international transfers.

---

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for any additional period required or permitted by applicable law.

Retention periods may be extended where information is required because of an ongoing dispute, legal claim, investigation, fraud concern, legal hold, regulatory obligation, or court or authority request.

When information is no longer required, we delete it, anonymize it, or restrict its further use, subject to technical backup and legal requirements.

---

13. Your Privacy Rights

Your privacy rights depend on your location and the law applicable to our processing. Rights may be subject to legal exceptions and identity-verification requirements.

13.1 European Economic Area, United Kingdom, and Switzerland

You may have the right to:

• Obtain confirmation as to whether we process your personal information
• Request access to your personal information
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information
• Request restriction of processing
• Receive certain information in a structured, commonly used, machine-readable format
• Request transmission of certain information to another controller where applicable
• Object to processing based on legitimate interests
• Withdraw consent at any time
• Object to qualifying profiling or automated processing
• Lodge a complaint with a competent data protection authority

You have the right to object at any time to the processing of your personal information for direct marketing purposes, including profiling related to such direct marketing. If you object, we will stop processing your personal information for those purposes.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

13.2 Complaints in Poland

If you believe that our processing of your personal information infringes applicable data protection law, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO).

Website: https://uodo.gov.pl/

You may also have the right to lodge a complaint with another competent supervisory authority in the country where you live, work, or believe an infringement occurred.

13.3 United States privacy rights

If an applicable United States state privacy law applies to our processing of your personal information, you may have one or more of the following rights:

• Confirm whether we process your personal information
• Access personal information
• Correct inaccurate personal information
• Request deletion
• Obtain a portable copy of certain information
• Opt out of qualifying sale of personal information
• Opt out of qualifying sharing of personal information
• Opt out of targeted advertising
• Opt out of qualifying profiling or automated decisions
• Limit certain uses or disclosures of sensitive information where applicable
• Appeal certain decisions concerning a privacy request where applicable

We do not sell personal information in exchange for money.

However, certain disclosures of identifiers, online activity, commercial information, or related information to advertising partners may constitute “sale”, “sharing”, or “targeted advertising” under certain state privacy laws. These disclosures never include text messaging originator opt-in data or SMS consent information.

Where an applicable opt-out right exists, you may exercise it through our Privacy Preferences page or through a supported Global Privacy Control signal.

We will not unlawfully discriminate against you because you exercise an applicable privacy right.

Where permitted by law, an authorized agent may submit a privacy request on your behalf. We may require evidence of authorization and verification of your identity.

13.4 Other countries and regions

Residents of Canada, Brazil, Australia, New Zealand, and other countries may have additional rights under applicable local privacy laws.

Depending on the jurisdiction, these rights may include access, correction, deletion, portability, withdrawal of consent, objection or restriction, information about disclosures, review of certain automated decisions, and the right to complain to a competent privacy regulator.

13.5 How to exercise your rights

You may submit a privacy request by:

• Emailing support@behemoth-store.com
• Using our Privacy Preferences page
• Using another privacy or account tool made available through the Services

Please describe the right you wish to exercise and provide enough information for us to identify the relevant account or records.

We may need to verify your identity before completing your request.

We may deny or limit a request where permitted or required by law, including where identity cannot reasonably be verified or where information must be retained because of legal obligations, fraud prevention, security, or legal claims.

---

14. Profiling and Automated Processing

We may use automated tools to create customer segments, recommend products, personalize content, measure the likely relevance of communications and advertising, and detect potentially fraudulent activity.

We do not ordinarily make decisions based solely on automated processing that produce legal effects or similarly significant effects for you.

If we introduce such processing in the future, we will provide any additional notice, choices, or review rights required under applicable law.

---

15. Security

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, use, alteration, disclosure, loss, misuse, or destruction.

These measures may include:

• Access controls and authentication
• Encryption in transit where supported
• Secure payment processing
• Security logging and monitoring
• Vendor and service-provider safeguards
• Data minimization and retention controls
• Incident-response procedures

No internet transmission, storage system, or security measure can be guaranteed to be completely secure.

You are responsible for protecting your account credentials and should notify us if you believe your account has been accessed without authorization.

---

16. Children’s Privacy

The Services are not directed to children under 16 years of age, and we do not knowingly collect personal information from children in a manner prohibited by applicable law.

Our email and SMS marketing programs are intended only for individuals who are at least 16 years of age.

If you are a parent or legal guardian and believe that a child has provided personal information to us without required authorization, please contact us so that we can investigate and, where appropriate, delete the information.

We do not knowingly sell or share for targeted advertising the personal information of individuals under 16 years of age.

---

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, technologies, service providers, privacy practices, business operations, or applicable legal requirements.

We will publish the revised Privacy Policy on this website and update the “Last updated” date.

Where required by law, we will provide additional notice or request renewed consent before using personal information for a materially different purpose.

---

18. Contact Us

If you have questions about this Privacy Policy, our privacy practices, our email or SMS marketing programs, or your privacy rights, please contact:

Behemoth Webstore Maciej Gruszka
Gdyńska 99
80-297 Miszewo
Poland
NIP: PL5842331183
REGON: 220949515

Email: support@behemoth-store.com