1. Key information
This Privacy Policy explains how we process the personal data of people who visit ojacie.pl, place orders, contact us, make complaints or subscribe to the newsletter. It also explains how we use cookies and similar technologies.
Providing data is voluntary, but some data are necessary to enter into and perform an agreement, handle a request or send the newsletter. Without them, the relevant service may not be possible.
2. Data controller and contact
The controller of personal data is [FULL NAME], carrying out unregistered business activity under the trade name OJACIE!, address: [FULL ADDRESS].
Email: hej@ojacie.pl. Telephone: [TELEPHONE NUMBER]. Correspondence address: [ADDRESS, IF DIFFERENT].
For matters concerning personal data, please contact us primarily at hej@ojacie.pl. The controller has not appointed a data protection officer unless otherwise stated.
3. What data we process
Depending on how the Shop is used, we may process:
- identification and contact data, in particular first and last name, email address, telephone number and delivery or correspondence address;
- Order, payment and delivery data, including Order number, selected products, amounts, payment method, payment status, delivery method and shipment number; we do not receive full payment-card data when payment is handled by an external operator;
- data needed to issue a sales document, including company name, address and NIP where applicable;
- the content of correspondence, a complaint, withdrawal or another request, and data needed to handle it;
- email address and subscription, unsubscription, sending and newsletter interaction information to the extent made available by the Brevo system;
- technical data connected with using the website, for example IP address, cookie identifiers, device and browser type, session information, logs and website events.
4. Purposes, legal bases and retention periods
Order and agreement handling — purpose: receiving the Order, payment, delivery, fulfilment contact and handling withdrawal; legal basis: Article 6(1)(b) GDPR; retention: for the duration of the agreement and then until the limitation period for claims expires.
Legal obligations — purpose: sales documentation, tax and accounting settlements and fulfilment of consumer obligations; legal basis: Article 6(1)(c) GDPR; retention: for the period required by the applicable legislation.
Contact and handling requests — purpose: answering, handling complaints and matters connected with Electronic Services; legal basis: Article 6(1)(b) GDPR where the request concerns an agreement, or Article 6(1)(f) GDPR – the legitimate interest in conducting correspondence and supporting users; retention: until the matter is closed and then until the limitation period for claims expires.
Newsletter and welcome discount — purpose: sending information about OJACIE! products, collections, launches, promotions and news; legal basis: Article 6(1)(a) GDPR – consent; commercial information is sent on the basis of the required communications consent; retention: until consent is withdrawn, the person unsubscribes or the newsletter ends; evidence of consent may be retained for the period needed to defend against claims.
Security and enforcement of claims — purpose: Shop protection, prevention of abuse, backups, establishing, pursuing or defending claims; legal basis: Article 6(1)(f) GDPR – the controller’s legitimate interest; retention: for the period needed to achieve the purpose, no longer than the relevant limitation period; technical logs are retained in accordance with the provider’s retention period.
Cookie-based analytics and marketing — purpose: measuring use of the site, improving the Shop, personalising or measuring advertising, only to the extent started after consent; legal basis: Article 6(1)(a) GDPR – consent; retention: until consent is withdrawn or the cookie expires, in accordance with the tool’s settings.
If several retention periods apply to the same data, we apply the longest required period and then erase or anonymise the data unless further retention is required by law.
5. Newsletter and Brevo
Newsletter subscription is voluntary and is not required to place an Order. We pass the email address and information connected with sending management to Brevo, our mailing-system provider. Every message includes an unsubscribe link; you can also write to hej@ojacie.pl.
Withdrawing consent does not affect the lawfulness of processing performed before it was withdrawn. After unsubscribing, we will not send further newsletters except a technical confirmation of unsubscription where used.
To be completed after checking the Brevo configuration: [IS OPEN AND CLICK TRACKING ENABLED, AND IS DOUBLE OPT-IN USED].
6. Data recipients
Data may be disclosed only to the extent necessary to achieve the relevant purpose. We do not sell personal data.
- providers of hosting, the Shop platform, email, IT support, security and backups: [NAMES OF PROVIDERS / PLATFORM];
- payment operator: [FULL NAME OF PAYMENT OPERATOR];
- carriers and collection-point operators: [NAMES OF CARRIERS];
- newsletter provider Brevo (Sendinblue SAS);
- providers of accounting or legal services: [NAME, IF APPLICABLE];
- providers of analytics or advertising tools, only after the required consent has been obtained: [E.G. GOOGLE ANALYTICS / META PIXEL / NONE];
- public authorities where disclosure is required by law.
7. Transfers outside the European Economic Area
Some providers or their subcontractors may process data outside the European Economic Area. In that case, the transfer takes place only on a mechanism permitted by the GDPR, for example an adequacy decision of the European Commission, standard contractual clauses with required supplementary measures, or another appropriate basis.
To be completed after the provider audit: [STATE ACTUAL TRANSFERS, COUNTRIES AND SAFEGUARDS USED, OR STATE THAT THEY DO NOT OCCUR].
8. Rights of data subjects
Within the limits provided by the GDPR, you have the right to:
- access your data and receive a copy;
- rectify data;
- erase data;
- restrict processing;
- data portability;
- object to processing based on a legitimate interest for reasons related to your particular situation;
- withdraw consent at any time where processing is based on it;
- lodge a complaint with the President of the Polish Personal Data Protection Office.
8. Rights of data subjects — continued
You may send a request to hej@ojacie.pl. We may request additional information needed to confirm the identity of the person making the request. We will respond within the periods set out in the GDPR.
9. Automated decision-making
The controller does not make decisions concerning users that produce legal effects or similarly significantly affect them solely by automated means, including profiling. An external payment operator may apply its own risk-assessment or anti-fraud mechanisms under the rules described in its privacy policy.
10. Cookies and similar technologies
Cookies are small files stored on a user’s device. The Shop may also use similar technologies, such as local storage, session identifiers or pixels. Depending on their purpose, these may be:
- essential cookies – needed for operation of the website, security, basket, Order, payment or saving privacy settings; they are used without consent to the extent permitted by law;
- functional cookies – remembering selected settings or additional features;
- analytics cookies – helping measure traffic and the way the website is used;
- marketing cookies – used to measure campaigns, tailor advertising or build audiences.
10. Cookies and similar technologies — continued
Cookies other than essential cookies are activated only after consent where consent is required. Refusing or withdrawing consent should not block basic Shop functions, although some additional functions may work differently.
Consent can be managed in the cookie settings panel available on the website. Users may also remove or block cookies in their browser settings. Withdrawing consent is as easy as giving it and does not affect the lawfulness of earlier processing.
To be completed using a cookie scan and consent panel: [TABLE: COOKIE NAME / PROVIDER / PURPOSE / CATEGORY / PERIOD / FIRST- OR THIRD-PARTY COOKIE].
11. Social-media data and external links
If the Shop maintains profiles on social media, the operator of each platform processes data under its own rules. To the extent the controller operates a profile, it is responsible for processing connected with communication, moderation and profile statistics on the basis of legitimate interest. Links to other services do not mean that the controller controls their privacy rules.
12. Data security
We apply technical and organisational measures appropriate to the risk, in particular access control, encrypted transmission, updates, backups and limiting access to the people and entities who need the data to perform their tasks. No transmission or storage method, however, guarantees complete security.
13. Changes to this Privacy Policy
This Policy may be updated when law, Shop functions, providers used or processing methods change. The current version is published at ojacie.pl/polityka-prywatnosci together with its effective date. Where a change requires new consent, we will request it before starting that processing.
14. Key laws and sources
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), in particular Articles 5, 6, 12–22, 28, 32 and 44–49.
- Polish Act of 10 May 2018 on the Protection of Personal Data.
- Polish Act of 12 July 2024 – Electronic Communications Law, concerning storage of or access to information on a terminal device and marketing communications.