Last updated: 15 June 2026

GDPR information clause

Applies to the purchase of digital content offered at pinksand.pl/przewodniki/en: the PDF e-book, Premium access in the Crete Guide app, and the bundle combining both products.

1. Data controllers

The controllers of personal data related to purchase and service delivery (e-book, Premium access, bundle) are Anna Łacińska and Tomasz Łaciński, operating under the Pink Sand Crete brand.

Address: Ir. Politechniou 44, 731 32 Chania, Greece. Contact: info@pinksand.pl.

2. Categories of data processed

In connection with purchase and service delivery, the following may be processed:

• first and last name,
• email address,
• transaction data (Stripe payment ID, amount, date, payment status),
• technical data related to e-book delivery (e.g. session ID, delivery status),
• for Premium access or bundle — email address of the Crete Guide app account (Google or email login).

3. Purposes and legal bases for processing

• Contract performance — order acceptance, payment, e-book delivery, PDF personalisation, complaint handling (Art. 6(1)(b) GDPR).
• Copyright and copy protection — marking the e-book with Buyer data to identify the copy and prevent unauthorised distribution (Art. 6(1)(b) and (f) GDPR — legitimate interest of the controller).
• Premium access in the app — assigning entitlements to the user account (Art. 6(1)(b) GDPR).
• Legal obligations — retention of accounting and tax data where applicable (Art. 6(1)(c) GDPR).
• Claims — establishing, pursuing, or defending claims (Art. 6(1)(f) GDPR).

4. Data recipients (processors)

Data may be shared with technology providers necessary to deliver the service:

• Stripe Payments Europe, Ltd. — online payment processing,
• Resend, Inc. — email delivery of the e-book,
• Google LLC / Firebase (Google Cloud) — hosting of automated delivery functions, database, and technical logs,
• entities authorised by law (e.g. tax authorities), where there is a mandatory legal basis.

Transfers outside the European Economic Area may occur only with appropriate safeguards (e.g. EU Standard Contractual Clauses) — in line with the technology providers' policies.

5. Data retention periods

• data related to order fulfilment and e-book delivery — for the duration of the contract and complaint handling,
• transaction and accounting data — for the period required by tax and accounting law (as a rule, up to 5 years from the end of the tax year),
• data processed for claims — until the limitation period for claims expires,
• technical delivery logs — for the period necessary for diagnostics and system security (usually up to 24 months).

6. Your rights

You have the right to:

• access your data,
• rectification,
• erasure,
• restriction of processing,
• data portability,
• object to processing based on Art. 6(1)(f) GDPR,
• withdraw consent — where processing is based on consent (not applicable to contract performance).

You may lodge a complaint with the Polish Data Protection Authority (UODO), uodo.gov.pl.

7. Voluntary nature of providing data

Providing your name and email address is required to conclude the contract, process payment, deliver the personalised e-book (if applicable), and assign Premium access in the app (if applicable). Failure to provide data makes order fulfilment impossible.

8. Automated decision-making

Data is not used for automated decision-making, including profiling, within the meaning of Art. 22 GDPR. E-book personalisation is performed automatically based on payment data (name, email).

9. GDPR contact

Please direct all requests and questions regarding personal data to: info@pinksand.pl.