Privacy policy

1. Who is responsible for your data

The controller of your personal data is ZYMZYM sp. z o.o., operating as Hexy Studio, Al. Niepodległości 18, 02-653 Warszawa, Poland ("we", "us").

For anything related to your data, write to studio@hexy.studio. We have not appointed a Data Protection Officer, as the law does not require it for a company of our size and activity.

2. What we collect and why

Contact, quote and shipping quote forms

When you send a form on our website (contact, quote request, shipping quote, Campaign Launch Check results), we receive the details you enter: your name, e-mail address and, if you provide them, your company, country, project details, planned launch date, budget, expected number of backers, package details and your message. The form is delivered to our team by e-mail. Nothing is sent to you automatically.

• Purpose: answering your enquiry and preparing an offer.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to messages sent to us (Art. 6(1)(f) GDPR).
• How long: as long as we are in touch about your enquiry, and then up to 2 years in case you come back to us. If we start working together, we keep the data for the duration of the cooperation and as required by accounting and tax law.

Online store

When you buy in our store, we process your name, e-mail address, phone number, shipping address, the items you ordered and, if you give it, your company name and VAT number. Payments are handled by Stripe on its own secure page. We never see or store your full card details.

• Purpose: processing and shipping your order, handling returns and complaints, and issuing invoices.
• Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR) and our legal obligations under tax and accounting law (Art. 6(1)(c) GDPR).
• How long: for 5 years from the end of the year in which the purchase was made, as required by Polish tax law, and longer only if needed to handle a claim.

Protecting the website

To block spam, our server keeps a coded (hashed) form of your IP address with the time you sent a form or started a checkout. It is used only to limit repeated submissions within 10 minutes and is removed when the server clears its temporary files. Messages that our spam filter stops are not delivered to us; they are kept in a private log for 30 days so we can check that no real message was caught by mistake, and then deleted. To tell people from bots without puzzles, our forms use Cloudflare Turnstile, which runs an invisible check in your browser when you start filling in a form. Cloudflare processes technical data such as your IP address and browser details for this purpose, as described in theCloudflare Turnstile Privacy Addendum. Like every web server, our hosting also keeps standard access logs (IP address, date, requested page, browser type) for a limited time for security and troubleshooting. The legal basis is our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).

3. Who we share it with

We only share your data with companies that help us run the website, answer you or deliver your order:

• Hosting: cyber_Folks S.A. (Poland), which hosts the website and processes form submissions.
• E-mail: Google Ireland Ltd. (Google Workspace), which stores our team mailboxes.
• Spam protection: Cloudflare, Inc. (Turnstile), which checks that a form is sent by a person.
• Payments: Stripe Payments Europe, Ltd. (Ireland), which processes store payments and acts partly as an independent controller, for example for fraud prevention.
• Delivery: the carrier you choose at checkout, for example InPost or a courier company, which receives your name, address and phone number to deliver the parcel.
• Accounting: our accounting office, for invoices and tax records.

We do not sell your data and we do not share it with advertisers.

4. Transfers outside the European Economic Area

Google, Stripe and Cloudflare may process some data in the United States. Such transfers are protected by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

5. Cookies and similar technologies

We do not use advertising or analytics cookies and we do not track you across websites. Our fonts are served from our own server.

• Store: your cart, chosen currency and delivery country are saved in your browser's local storage so they are still there when you come back. This data stays on your device and is never sent to us until you check out. You can clear it at any time in your browser settings.
• Videos: our videos are hosted on YouTube. A video is loaded only when you press play, from youtube-nocookie.com. From that moment Google receives data such as your IP address, underGoogle's privacy policy.
• Checkout: Stripe's payment page sets its own cookies needed for secure payment and fraud prevention, as described in Stripe's privacy policy.

Links to Kickstarter, Gamefound, Steam, MyMiniFactory and social media take you to other websites with their own privacy policies.

6. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it,
• correct data that is wrong or incomplete,
• have your data deleted,
• restrict how we use your data,
• receive your data in a portable format,
• object to processing based on our legitimate interest,
• lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

To use any of these rights, e-mail studio@hexy.studio. We reply within one month.

7. Is giving us your data required?

No, it is voluntary. Without an e-mail address we cannot reply to your message, and without a name, address and phone number we cannot ship an order.

8. Automated decisions

We do not make automated decisions about you and we do not profile you.

9. Changes

If we change how we handle personal data, we will update this page and the date at the top. For major changes that affect you directly, we will let you know by e-mail.