Privacy Policy

Valid from June 1, 2026

Note: This is an English translation provided for convenience. The Polish version is the legally binding one. In case of discrepancy, the Polish text prevails.

§1. Data Controller

The controller of your personal data collected via the online store mananadulce.store is:

Data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).

§2. Purposes and legal bases of processing

We process your personal data for the following purposes:

a) Order fulfillment

Purpose: conclusion and performance of the Sales Agreement. Legal basis: art. 6(1)(b) GDPR (contract performance).

Scope of data: first name, last name, delivery address, e-mail, phone number, invoice details (if required).

b) Issuing accounting documents

Purpose: fulfilling tax and accounting obligations. Legal basis: art. 6(1)(c) GDPR (legal obligation — Polish Tax Ordinance, VAT Act).

Retention period: 5 years from the end of the calendar year in which the document was issued.

c) Handling complaints and returns

Purpose: processing complaints and handling returns. Legal basis: art. 6(1)(b) and (c) GDPR.

d) Direct marketing — newsletter

Purpose: sending commercial information about the Seller's products. Legal basis: art. 6(1)(a) GDPR (consent) — only based on explicit, voluntary consent.

You can withdraw your newsletter consent at any time — the unsubscribe link is in each message, or contact: mananadulce.store@gmail.com.

e) Statistics and improving the Store's operation

Purpose: analyzing website traffic, improving the Store. Legal basis: art. 6(1)(f) GDPR (legitimate interest of the Controller).

§3. Data recipients

Your personal data may be transferred to the following categories of recipients:

• Payment operators — for transaction processing (e.g. Przelewy24 — PayPro S.A. based in Poznań),
• Courier companies and postal operators — for delivering orders (InPost, DPD, DHL, Orlen Paczka, and international courier operators for shipments to Austria, Czech Republic, Germany, Lithuania, and Slovakia),
• Manufacturers fulfilling on-demand orders — to the extent necessary for order fulfillment (BrandMe sp. z o.o. — adult t-shirt production),
• E-commerce platform provider — Shopify Inc. (Canada) as data processor based on a processing agreement,
• Accounting office / accountant — to the extent necessary for bookkeeping,
• Analytics and marketing tool providers — including Google (Analytics), Meta (Pixel) — to the extent you accept in cookie settings.

All entities processing data on our behalf are obliged to maintain confidentiality and data security based on processing agreements concluded with us.

§4. Data transfers outside the EEA

When using services from providers such as Shopify (Canada), Google (USA), Meta (USA), your data may be transferred outside the European Economic Area. The transfer takes place based on standard contractual clauses approved by the European Commission and relevant adequacy decisions (Canada — full adequacy; USA — Data Privacy Framework).

§5. Data retention period

• Order data: until the expiry of claim limitation periods (usually 6 years),
• Accounting documents: 5 years from the end of the calendar year,
• Marketing data (newsletter): until consent is withdrawn,
• Contact form data: up to 1 year after the end of correspondence,
• Statistical data (cookies): according to the periods in §7.

§6. Your rights

In connection with the processing of your personal data, you have the following rights:

• Right of access to your data and to receive copies,
• Right to rectification of inaccurate or incomplete data,
• Right to erasure ("right to be forgotten") — in situations provided for by GDPR,
• Right to restriction of processing,
• Right to data portability — to receive data in a structured format,
• Right to object to processing (in cases based on legitimate interest),
• Right to withdraw consent at any time — without affecting the lawfulness of processing carried out based on consent before its withdrawal,
• Right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

To exercise the above rights, please contact us: mananadulce.store@gmail.com.

§7. Cookies

The Store uses cookies — small text files saved on your device. We use the following types of cookies:

• Necessary — enabling the Store to function (e.g. preserving the cart, sessions). They do not require consent.
• Functional — remembering user preferences (e.g. language, view settings).
• Analytical — Google Analytics (anonymous traffic statistics). Require your consent.
• Marketing — Meta Pixel (Facebook), Google Ads. Require your consent.

You can change cookie settings at any time in your browser or via the cookie consent banner on our website. Disabling certain cookies may affect the Store's functionality.

§8. Data security

We apply appropriate technical and organizational measures to ensure the protection of processed personal data:

• connection encryption (SSL/TLS),
• data access control — only authorized persons,
• regular software updates,
• backups performed by the platform provider (Shopify).

§9. Children's data

The Store is not directed at persons under 16 years of age. We knowingly do not collect children's data. If you notice that a child has provided us with data without the consent of a legal guardian, please contact us — we will promptly delete such data.

§10. Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy. We will inform about each change by publishing a new version on the Store's website together with the effective date.

This Privacy Policy is valid from June 1, 2026.