Privacy policy

Last updated: 21 October 2026

1. Who is responsible for your data

The controller of your personal data is Bartosz Bilejczyk, operating as a sole proprietor, ul. Sucha 5, 64-920 Piła, Poland, owner of the Together Games store and brand (hereinafter: “we”). For matters concerning personal data, write to us at hello@togethergames.eu, call +48 665 266 378 or send a letter to the address above.

2. What data we collect, why and on what basis

  • Orders, delivery, returns and complaints - first and last name, delivery and billing address, e-mail address, telephone number, ordered products and order history. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Accounting and taxes - data from sales documents. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
  • Contacting us - data you provide in messages. Legal basis: our legitimate interest, namely answering your question (Art. 6(1)(f) GDPR).
  • Newsletter and marketing messages - e-mail address and information about whether you open our messages. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by clicking the unsubscribe link in the message.
  • Analytics and advertising with cookies - information about your device, browser and how you use the store. Legal basis: your consent given in the cookie banner (Art. 6(1)(a) GDPR).
  • Anonymous event counters without cookies (page views, clicks, purchase steps, time on page) - described in section 3. Legal basis: our legitimate interest, namely basic visitor statistics (Art. 6(1)(f) GDPR).
  • Sales statistics - for every paid order in the store, we provide Google Analytics 4 and PostHog with purchase information: ordered products, value, currency, delivery country and visit source (e.g. Google search engine or campaign name). We do not provide your first and last name, address, e-mail address, telephone number or IP address. If you do not consent to cookies (including when you do not respond in the banner), we assign the purchase a one-time identifier that is not stored on your device and does not allow the purchase to be linked to other visits. Google does not use this data for advertising. Legal basis: our legitimate interest, namely counting our sales and the channels that generate them (Art. 6(1)(f) GDPR). When you give consent, we link this data to your visit based on your consent.
  • Security and establishing claims - data necessary to protect the store against abuse and to establish, pursue or defend claims. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Providing data when placing an order is voluntary, but without it we cannot fulfil the order. We do not make decisions about you based solely on automated processing that would have legal effects.

3. Cookies and similar technologies

  • Essential - ensure the operation of the store: shopping cart, order placement, remembering your choice in the cookie banner and the discount code from a link. They do not require consent.
  • Analytics and marketing - we activate them only after you click “Accept” in the banner. They allow us to measure traffic in the store, test new versions of pages, record visits (without content entered into forms) and display advertisements.
  • Without your consent (after clicking “Reject” or before making a decision), we do not store analytics or marketing cookies on your device. In PostHog and Google Analytics, we only count visits and purchase steps (viewing a product, adding it to the cart, proceeding to checkout, opening checkout and placing an order) anonymously: a visit identifier is created on the server as an irreversible hash of the IP address, browser data and a randomly generated value that changes daily. We do not store the IP address, and we do not link visits from different days. We also store information about the visit source in your cart (landing page address, referring page, campaign name or advertising click identifier) in order to determine where a paid order came from (sales statistics, section 2).

You can change your choice at any time in “Cookie settings” in the website footer.

4. Who we share data with

We use the services of trusted companies that process data on our behalf or as separate controllers:

  • Shopify International Limited (Ireland) - store platform and order processing. Shopify also processes some data as a separate controller; details are available at privacy.shopify.com/pl.
  • Payment providers - payment processing. We do not store full card numbers.
  • Courier companies, logistics providers and warehouse - order delivery and return handling.
  • BaseLinker - order management.
  • Accounting firm and accounting system - accounting services.
  • Klaviyo, Inc. (USA) - sending newsletters and e-mail messages.
  • Google Ireland Limited - Google Analytics 4 and Google Ads. Cookies and visit tracking only with your consent. Without consent, Google Analytics 4 receives only anonymous signals without cookies and without a user identifier, as described in section 3 (Google, like every server, sees the IP address and browser data), as well as the sales statistics described in section 2. We do not use them for advertising.
  • Meta Platforms Ireland Limited - Meta pixel and advertising on Facebook and Instagram (only with your consent).
  • Supabase, Inc. - the store database (orders, inventory).
  • PostHog, Inc. (data stored in the EU, in Frankfurt) - visit statistics; session recordings and cookies only with your consent, without consent only anonymous counting of visits and purchase steps (section 3) and sales statistics (section 2).

We may also disclose data to public authorities if required by law.

5. Transfers of data outside the European Economic Area

Some of our providers (e.g. Shopify, Google, Meta, Klaviyo) may process data outside the European Economic Area, including in the USA. In such cases, data is protected based on decisions of the European Commission (e.g. the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

6. How long we keep data

  • Order data - for the duration of the contract, and then until the expiry of limitation periods for claims.
  • Accounting documents - for 5 years from the end of the calendar year in which the tax payment deadline expired.
  • Newsletter - until you unsubscribe.
  • Session recordings - 30 days. Other analytics data, including sales statistics - no longer than necessary for statistical purposes.
  • Data processed based on consent - until consent is withdrawn.

7. Your rights

You have the right to access your data, rectify it, erase it, restrict its processing and transfer it, as well as to object to processing based on our legitimate interest. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before its withdrawal. To exercise these rights, write to hello@togethergames.eu. If you object to sales statistics, we will delete purchase data linked to your order from Google Analytics 4, PostHog and our data warehouse.

You also have the right to lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

8. Children's data

The store is not intended for children, and we do not knowingly collect their data. If you are a parent or guardian and believe that a child has provided us with their data, write to us and we will delete it.

9. Changes to the privacy policy

We may update this policy, for example when we change tools or when required by law. The current version is always available on this page, and the date at the top shows the most recent change.