Privacy and Cookies Policy

1. Data Controller Information

The controller of your personal data is PURE & SWEET KAROLINA ŁYCZKO-BINDACZ, with its registered office at ul. Kolejowa 6, 47-450 Krzyżanowice, Poland, Tax ID (NIP): 6392019249, Business Registry Number (REGON): 385288847. For matters related to the protection of personal data, you can contact the Controller in writing at the registered office address or via e-mail at: [email protected].

2. Purposes and Legal Bases for Data Processing

Your personal data is processed for purposes necessary for the proper provision of commercial and electronic services within the online store:

• Maintaining a Customer Account: Processing of registration data is based on Art. 6(1)(b) of the GDPR to perform the contract for the provision of electronic services.
• Order Execution: Processing of data such as first name, last name, delivery address, e-mail address, telephone number, and purchase history is based on Art. 6(1)(b) of the GDPR (necessity for sales contract performance) and Art. 6(1)(c) of the GDPR for invoicing and tax obligations for 5 years.
• Online Payments: Transaction details are entrusted to an external payment operator in order to secure financial transactions (Art. 6(1)(b) of the GDPR).
• Contact Form: Processing of data to answer inquiries sent electronically is based on the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR).
• Marketing Consents and Newsletter: Processing of data for direct marketing purposes is based on your voluntary consent (Art. 6(1)(a) of the GDPR). Each consent for marketing, newsletter, and promotional notifications is separate and can be managed in your account settings.
• GDPR Registers and Accountability: Compliance with legal obligations related to documenting compliance procedures is based on Art. 6(1)(c) and (f) of the GDPR.
• Archival and Evidentiary Purposes: Storing information to prove facts is based on a legitimate interest (Art. 6(1)(f) of the GDPR).
• Analytics and Optimization: Analyzing user behavior and traffic utilizing cookies is based on your active consent (Art. 6(1)(a) of the GDPR).
• IT Security: Server logs and website administration are processed based on a legitimate interest (Art. 6(1)(f) of the GDPR).
• Claims: Processing for the establishment, exercise, or defense of claims is based on Art. 6(1)(f) of the GDPR, and the retention period is linked to the statute of limitations.

3. Rights of the Data Subject

In connection with the processing of personal data, you have the following rights, which can be exercised by contacting the Controller at [email protected]:

• The right to access your personal data and receive a copy thereof.
• The right to rectify (correct) your data if it is incorrect or incomplete.
• The right to erase data (the right to be forgotten) in situations defined by the GDPR.
• The right to restrict the processing of personal data.
• The right to data portability to another controller.
• The right to object to processing based on a legitimate interest.
• The right to withdraw consent at any time by sending an e-mail to the Controller, which does not affect the lawfulness of processing carried out before withdrawal.
• The right to lodge a complaint with the supervisory authority – President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

4. Recipients of Personal Data

In order to ensure the efficient operation of the store, your data may be transferred to trusted third parties involved in the service process:

• Courier and logistics companies delivering ordered products.
• Online payment operators executing financial transactions.
• Entities providing hosting, IT services, and technical support for the online store.
• Accounting offices and law firms providing accounting and legal support.
• Providers of marketing systems, newsletter delivery, and SMS gateways.
• Insurers for the settlement of potential transport claims.

5. Data Transfer Outside the EEA

Your personal data may be transferred to third parties located outside the European Economic Area, particularly to Google LLC and Meta Platforms, Inc. The transfer of data takes place with the highest security standards, based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or based on Standard Contractual Clauses approved by the European Commission.

6. Cookies and Consent Banner

The website uses cookies divided into three operational categories. The use of analytical and marketing cookies requires your prior and active consent.

• Necessary (operational): Always active cookies, crucial for the basic functioning of the website.
• Analytical: Cookies disabled by default, recording traffic utilizing the Google Analytics 4 (GA4) standard.
• Marketing: Cookies disabled by default, allowing measurement of Meta ad conversions.
• The user can change preferences or reject all cookies at any time using the configuration options in the consent banner.
• Regardless of the banner, you can manage cookies in your web browser settings (blocking, deleting). Restricting necessary cookies may affect the operation of the website.

7. Voluntariness of Data Provision and Profiling

Providing your personal data is fully voluntary but necessary for account registration, order execution, or newsletter subscription. Your data is not subject to automated decision-making, including profiling, producing legal effects, except for standard advertising profiling based on cookies to which you have previously consented.

8. Data Retention Periods

Data is stored for precisely defined periods: customer account – until deletion; orders and invoices – 5 years from the end of the tax year; newsletter – until consent is withdrawn; claims – until the statute of limitations expires under the Civil Code.

9. Final Provisions and Updates

This policy enters into force on July 19, 2026. The Controller reserves the right to make changes to adapt the document to changing legal provisions.