Last updated: 4 July 2026

This Privacy Policy explains how personal data is collected, used and protected in connection with the website nhpolska.com and the activities of Nyckelharpa Polska.

We respect your privacy and process personal data in accordance with applicable data protection law, including Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR).

1. Data Controller

The controller of your personal data is:

Nyckelharpa Polska Anna Kołodziej
Borówkowa 10
20-142 Lublin
Poland

Tax Identification Number (NIP): 9462280381

Email: info@nhpolska.com
Website: nhpolska.com

If you have any questions concerning this Privacy Policy or the processing of your personal data, you may contact us by email.

2. What Personal Data We May Collect

Depending on how you use the website or contact us, we may process the following categories of personal data:

• your name and surname;
• email address;
• telephone number;
• postal address, billing address or delivery address;
• company or business details, where applicable;
• tax identification details, where required for invoicing or accounting purposes;
• information contained in messages, enquiries and correspondence;
• information necessary to prepare, process and fulfil an order;
• information necessary to arrange lessons, workshops, meetings or other services;
• payment-related information necessary to identify or confirm a transaction;
• shipping and customs information necessary for international delivery;
• technical information connected with your use of the website, such as IP address, browser information, device information and cookie identifiers, where applicable.

Please do not provide personal data that is not necessary for your enquiry or transaction.

3. How We Collect Personal Data

We may collect personal data when you:

• contact us through a contact form on the website;
• contact us by email, telephone or another communication channel;
• enquire about a nyckelharpa, accessory or other product;
• purchase or rent an instrument;
• request restoration, adjustment or another service;
• book or enquire about an online lesson, workshop, presentation or other event;
• request a sound sample, video, online meeting or individual recommendation;
• enter into a transaction with us;
• browse or use the website, where technical data or cookies are used.

We may also receive limited personal data from third parties involved in a transaction or service, for example payment providers, courier companies, postal operators or other persons acting on your behalf.

4. Purposes and Legal Bases for Processing

We process personal data only where there is an appropriate legal basis.

A. Responding to enquiries and correspondence

We process your contact details and the content of your message in order to:

• answer questions;
• provide information about available instruments;
• prepare individual recommendations;
• provide photographs, videos or sound samples;
• arrange online meetings;
• discuss lessons, workshops or other services.

The legal basis is our legitimate interest in communicating with persons who contact us and, where your enquiry concerns a possible purchase or service, taking steps at your request before entering into a contract.

B. Processing orders and performing contracts

When you purchase or rent an instrument, book a service or otherwise enter into a contract with us, we process data necessary to:

• confirm the transaction;
• prepare the instrument or service;
• arrange payment;
• issue relevant documents;
• organise delivery;
• communicate about the order;
• handle after-sales matters.

The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

C. Payments

Where payment is made by bank transfer or through an external payment service, we may process information necessary to identify, confirm and document the payment.

The legal basis is the performance of a contract and compliance with applicable legal and accounting obligations.

Payment providers and financial institutions may process personal data under their own terms and privacy policies.

D. Shipping and international delivery

Where goods are shipped to you, we may process and share information necessary for delivery, including:

• name and surname;
• delivery address;
• telephone number;
• email address;
• shipment information;
• information required for customs clearance or import procedures, where applicable.

The legal basis is the performance of a contract and, where applicable, compliance with legal obligations.

For international shipments, additional information may be required by courier companies, customs authorities or other competent authorities. We process and disclose only information reasonably necessary for the shipment and related procedures.

E. Accounting, tax and legal obligations

We may process transaction, invoice, payment and customer information where necessary to comply with:

• tax law;
• accounting obligations;
• customs requirements;
• other applicable legal duties.

The legal basis is compliance with a legal obligation.

F. Establishing, exercising or defending legal claims

We may retain and process relevant correspondence, transaction records and other necessary information where this is required to establish, exercise or defend legal claims.

The legal basis is our legitimate interest in protecting our rights and conducting our business responsibly.

G. Website security and technical operation

We may process limited technical data in order to:

• operate the website;
• maintain security;
• prevent abuse;
• diagnose technical problems;
• protect the website and its users.

The legal basis is our legitimate interest in ensuring the secure and reliable operation of the website.

H. Analytics and non-essential cookies

Where analytics or other non-essential technologies are used, personal data may be processed on the basis of your consent where such consent is required by law.

You can find more information in our separate Cookies Policy and manage your preferences through the cookie consent mechanism available on the website.

5. Contact Forms and Email Communication

If you contact us through the website or by email, we process the information you provide in order to respond to your message and handle the matter concerned.

Providing personal data is voluntary, but without sufficient contact information we may be unable to respond to your enquiry or provide the requested service.

Please avoid sending unnecessary sensitive personal information through contact forms or ordinary email.

6. Sales, Instrument Enquiries and Individual Recommendations

Nyckelharpa Polska offers carefully selected instruments and related services. Customers may contact us to discuss:

• available nyckelharpas;
• instrument specifications and condition;
• sound characteristics;
• accessories;
• restoration or adjustment;
• rental;
• shipping;
• individual recommendations.

In such cases, we process only the information reasonably necessary to communicate with you, understand your request and, where applicable, prepare or perform a transaction.

7. Lessons, Workshops and Other Services

If you enquire about or book:

• online lessons;
• individual lessons;
• workshops;
• presentations;
• meetings;
• educational or musical services,

we may process your contact details and organisational information necessary to arrange and provide the service.

Where an external videoconferencing or communication platform is used, that provider may process personal data under its own privacy terms.

8. Recipients of Personal Data

Where necessary, personal data may be disclosed to or processed by trusted third parties that support our activities, including:

• website hosting and technical service providers;
• IT and website maintenance providers;
• email service providers;
• accounting and professional service providers;
• banks and payment service providers;
• courier companies and postal operators;
• customs agents and competent authorities where required;
• providers of online meeting or communication services;
• analytics, security or consent-management providers, where used;
• legal advisers or public authorities where disclosure is required or justified by law.

We do not sell personal data.

We disclose personal data only where necessary for a specific purpose and in accordance with applicable law.

9. International Transfers of Personal Data

Some service providers used in connection with the website, communications, analytics, embedded content or online services may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we seek to rely on a lawful transfer mechanism, such as:

• an adequacy decision of the European Commission;
• appropriate safeguards, including Standard Contractual Clauses;
• another lawful mechanism available under the GDPR.

International shipping may also require personal data to be shared with courier companies, customs authorities or other entities located in the destination or transit country where necessary to fulfil the transaction and delivery.

10. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected and in accordance with applicable legal requirements.

In general:

• ordinary enquiries and correspondence are retained for as long as reasonably necessary to handle the matter and any relevant follow-up;
• data related to transactions and contracts may be retained for the duration of the contractual relationship and afterwards for periods necessary to comply with legal obligations or protect against claims;
• accounting and tax documentation is retained for the period required by applicable law;
• data processed on the basis of consent is retained until consent is withdrawn or until the relevant processing purpose ends, unless another legal basis applies;
• technical and security data is retained only for a period reasonably necessary for website operation, security and incident handling.

Retention periods may vary depending on the nature of the relationship, legal obligations and the need to establish, exercise or defend legal claims.

11. Cookies

The website may use cookies and similar technologies.

Some cookies are necessary for the proper functioning and security of the website. Other cookies, including analytics or third-party cookies, may require your consent.

Detailed information about cookies, their purposes and available choices is provided in the separate Cookies Policy and through the cookie consent mechanism displayed on the website.

You may change or withdraw your cookie consent preferences where the consent-management tool provides this option.

12. Third-Party Content and External Services

The website may contain links to external websites or content provided by third parties, including social media platforms, video platforms or other online services.

When you interact with external content or follow a link to another website, the third party may process personal data according to its own privacy policy.

We encourage you to review the privacy information provided by those third parties.

Where third-party content is embedded directly on the website, data may be transmitted to the relevant provider. Where required by law, such non-essential content should be activated only after the appropriate consent has been obtained.

13. Social Media and Other Communication Channels

Nyckelharpa Polska may maintain profiles or communicate with customers through external social media and communication platforms.

If you contact us through such a platform, both Nyckelharpa Polska and the platform provider may process personal data in connection with that interaction, each according to the applicable role and legal basis.

The platform provider’s own privacy policy applies to processing carried out independently by that provider.

14. Your Rights Under the GDPR

Subject to the conditions set out in applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive personal data in a structured, commonly used and machine-readable format and request data portability where applicable;
• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, contact:

info@nhpolska.com

We may need to verify your identity before fulfilling a request where this is necessary to protect personal data.

15. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.

In Poland, the supervisory authority is:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych – UODO)

You may also have the right to contact the competent supervisory authority in another EU or EEA country, depending on your circumstances.

16. Automated Decision-Making

We do not use personal data for automated decision-making that produces legal effects or similarly significantly affects individuals.

17. Requirement to Provide Personal Data

Providing personal data is generally voluntary.

However, certain information may be necessary in order to:

• respond to your enquiry;
• prepare or perform a contract;
• process a payment;
• issue legally required documents;
• arrange delivery;
• complete customs procedures;
• provide a requested service.

If necessary information is not provided, we may be unable to complete the relevant request or transaction.

18. Data Security

We take reasonable technical and organisational measures to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• destruction;
• misuse.

However, no method of transmission or storage is completely risk-free. Users should also take appropriate care when sending personal information online.

19. Children’s Personal Data

The website and commercial offer are not directed specifically at children for the purpose of collecting personal data online.

Where lessons, workshops or educational activities involve minors, personal data should normally be provided and managed by a parent, legal guardian or other authorised adult where appropriate.

We do not knowingly seek to collect unnecessary personal data from children through the website.

20. Changes to This Privacy Policy

We may update this Privacy Policy when:

• our services change;
• website functionality changes;
• new service providers or technologies are introduced;
• legal requirements change.

The current version will be published on this page with the date of the latest update.

21. Contact

For questions about privacy or personal data processing, please contact:

Nyckelharpa Polska Anna Kołodziej
Borówkowa 10
20-142 Lublin
Poland

Email: info@nhpolska.com
Website: nhpolska.com

Last updated: 4 July 2026