OJACIE! online shop (ojacie.pl) · Effective from: 23 October 2026
1. Key information
This Privacy Policy explains how we process the personal data of people who visit ojacie.pl, place orders, contact us, make complaints or subscribe to the newsletter. It also explains how we use cookies and similar technologies.
Providing data is voluntary, but some data are necessary to enter into and perform an agreement, handle a request or send the newsletter. Without them, the relevant service may not be possible.
2. Data controller and contact
The controller of personal data is Iwona Kowalik, carrying out unregistered business activity under the trade name OJACIE!, address: Pcim 591, 32-432 Pcim.
Email: hej@ojacie.pl. Telephone: +48 798 476 696. Correspondence address: Pcim 591, 32-432 Pcim.
For matters concerning personal data, please contact us primarily at hej@ojacie.pl. The controller has not appointed a data protection officer unless otherwise stated.
3. What data we process
Depending on how the Shop is used, we may process:
identification and contact data, in particular first and last name, email address, telephone number and delivery or correspondence address;
Order, payment and delivery data, including Order number, selected products, amounts, payment method, payment status, delivery method and shipment number; we do not receive full payment-card data when payment is handled by an external operator;
data needed to issue a sales document, including company name, address and NIP where applicable;
the content of correspondence, a complaint, withdrawal or another request, and data needed to handle it;
email address and subscription, consent, unsubscription and sending information for newsletters and premiere alerts, stored in the shop system;
technical data connected with using the website, for example IP address, cookie identifiers, device and browser type, session information, logs and website events.
4. Purposes, legal bases and retention periods
Order and agreement handling — purpose: receiving the Order, payment, delivery, fulfilment contact and handling withdrawal; legal basis: Article 6(1)(b) GDPR; retention: for the duration of the agreement and then until the limitation period for claims expires.
Legal obligations — purpose: sales documentation, tax and accounting settlements and fulfilment of consumer obligations; legal basis: Article 6(1)(c) GDPR; retention: for the period required by the applicable legislation.
Contact and handling requests — purpose: answering, handling complaints and matters connected with Electronic Services; legal basis: Article 6(1)(b) GDPR where the request concerns an agreement, or Article 6(1)(f) GDPR – the legitimate interest in conducting correspondence and supporting users; retention: until the matter is closed and then until the limitation period for claims expires.
Newsletter and welcome discount — purpose: sending information about OJACIE! products, collections, launches, promotions and news; legal basis: Article 6(1)(a) GDPR – consent; commercial information is sent on the basis of the required communications consent; retention: until consent is withdrawn, the person unsubscribes or the newsletter ends; evidence of consent may be retained for the period needed to defend against claims.
Security and enforcement of claims — purpose: Shop protection, prevention of abuse, backups, establishing, pursuing or defending claims; legal basis: Article 6(1)(f) GDPR – the controller’s legitimate interest; retention: for the period needed to achieve the purpose, no longer than the relevant limitation period; technical logs are retained in accordance with the provider’s retention period.
Cookie-based analytics and marketing — purpose: measuring use of the site, improving the Shop, personalising or measuring advertising, only to the extent started after consent; legal basis: Article 6(1)(a) GDPR – consent; retention: until consent is withdrawn or the cookie expires, in accordance with the tool’s settings.
The Shop currently processes orders as a guest and does not offer customer account registration or sign-in. Existing order and settlement data are retained for applicable statutory and claims periods.
Local suggestions — purpose: reviewing places and local stories and following up on submissions; legal basis: Article 6(1)(f) GDPR, legitimate interest in developing collections and corresponding with users. Email is optional and submission does not subscribe the user to the newsletter. Retention: for the time needed to review and use the suggestion or complete follow-up, then deletion or anonymisation unless needed for claims.
If several retention periods apply to the same data, we apply the longest required period and then erase or anonymise the data unless further retention is required by law.
5. Newsletter and premiere alerts
Newsletter and premiere-alert subscriptions are voluntary and are not required to place an Order. We store the email address and sending-management information in the shop system based on WordPress and WooCommerce. Every message includes an unsubscribe link; you can also write to hej@ojacie.pl.
Withdrawing consent does not affect the lawfulness of processing performed before it was withdrawn. After unsubscribing, we will not send further newsletters except a technical confirmation of unsubscription where used.
6. Data recipients
Data may be disclosed only to the extent necessary to achieve the relevant purpose. We do not sell personal data.
Hostido (WordPress hosting and email), Cloudflare (website infrastructure and local-suggestion database) and Sites (website publishing);
payment operator: WooPayments, in partnership with Stripe;
GLS, to the extent needed to deliver the shipment;
the external printing company in Poland handling printing, packing and delivery directly to the Customer: recipient details, address, contact details needed for delivery and information about the ordered posters;
hosting, email and shop-system providers, to the extent needed to run the newsletter and premiere alerts;
people authorised to handle orders and settlements, and legal advisers where necessary to establish or defend claims;
providers of analytics or advertising tools, only after the required consent has been obtained: Google Analytics 4;
public authorities where disclosure is required by law.
7. Transfers outside the European Economic Area
Some providers or their subcontractors may process data outside the European Economic Area. In that case, the transfer takes place only on a mechanism permitted by the GDPR, for example an adequacy decision of the European Commission, standard contractual clauses with required supplementary measures, or another appropriate basis.
Cloudflare, Sites, Google Analytics and WooPayments/Stripe may use providers or subprocessors outside the EEA, particularly in the USA. Specific transfer mechanisms and current subprocessor lists are described in each provider’s documentation. You can request processing information at hej@ojacie.pl.
8. Rights of data subjects
Within the limits provided by the GDPR, you have the right to:
access your data and receive a copy;
rectify data;
erase data;
restrict processing;
data portability;
object to processing based on a legitimate interest for reasons related to your particular situation;
withdraw consent at any time where processing is based on it;
lodge a complaint with the President of the Polish Personal Data Protection Office.
8. Rights of data subjects — continued
You may send a request to hej@ojacie.pl. We may request additional information needed to confirm the identity of the person making the request. We will respond within the periods set out in the GDPR.
9. Automated decision-making
The controller does not make decisions concerning users that produce legal effects or similarly significantly affect them solely by automated means, including profiling. An external payment operator may apply its own risk-assessment or anti-fraud mechanisms under the rules described in its privacy policy.
10. Cookies and similar technologies
Cookies are small files stored on a user’s device. The Shop may also use similar technologies, such as local storage, session identifiers or pixels. Depending on their purpose, these may be:
essential cookies – needed for operation of the website, security, basket, Order, payment or saving privacy settings; they are used without consent to the extent permitted by law;
functional cookies – remembering selected settings or additional features;
analytics cookies – helping measure traffic and the way the website is used;
marketing cookies – used to measure campaigns, tailor advertising or build audiences.
10. Cookies and similar technologies — continued
Cookies other than essential cookies are activated only after consent where consent is required. Refusing or withdrawing consent should not block basic Shop functions, although some additional functions may work differently.
Consent can be managed in the cookie settings panel available on the website. Users may also remove or block cookies in their browser settings. Withdrawing consent is as easy as giving it and does not affect the lawfulness of earlier processing.
The site stores the consent choice (ojacie-cookie-consent) and basket (ojacie-cart-v1) in browser storage until the user clears it. The cookie choice is shared by the storefront and checkout through ojacie_consent (up to 180 days) and wp_consent_* category cookies. Advertising cookies remain disabled. WooCommerce checkout uses session cookies including wp_woocommerce_session_*, woocommerce_items_in_cart and woocommerce_cart_hash. Google Analytics 4 loads only after consent and may set _ga and _ga_* cookies, with lifetimes depending on service settings. Payment services may store essential session and security identifiers. Cookies and site storage can be cleared in browser settings.
The ojacie-preview cookie enables shop preview before launch and expires after 30 days. The ojacie-community cookie protects the internal suggestions inbox and expires after 8 hours; customers do not need it. The current consent panel covers analytics; it does not activate advertising cookies or advertising personalisation.
11. Social-media data and external links
If the Shop maintains profiles on social media, the operator of each platform processes data under its own rules. To the extent the controller operates a profile, it is responsible for processing connected with communication, moderation and profile statistics on the basis of legitimate interest. Links to other services do not mean that the controller controls their privacy rules.
12. Data security
We apply technical and organisational measures appropriate to the risk, in particular access control, encrypted transmission, updates, backups and limiting access to the people and entities who need the data to perform their tasks. No transmission or storage method, however, guarantees complete security.
13. Changes to this Privacy Policy
This Policy may be updated when law, Shop functions, providers used or processing methods change. The current version is published at ojacie.pl/polityka-prywatnosci together with its effective date. Where a change requires new consent, we will request it before starting that processing.
14. Key laws and sources
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), in particular Articles 5, 6, 12–22, 28, 32 and 44–49.
Polish Act of 10 May 2018 on the Protection of Personal Data.
Polish Act of 12 July 2024 – Electronic Communications Law, concerning storage of or access to information on a terminal device and marketing communications.
