Privacy Policy

effective from 30.07.2026

§ 1. Data Controller

The controller of personal data collected via the poppinpress.com store is Melania Rachwalska, correspondence address: ul. Szałwiowa 24, 40-750 Katowice, Poland, e-mail: info@poppinpress.com (hereinafter: the “Controller”).

For matters relating to personal data, the Controller can be contacted by e-mail.

§ 2. What Data We Collect and Why

Data provided when placing an order: name and surname, e-mail address, phone number (for InPost notifications), selected Paczkomat locker, nail sizes and design preferences (for personalised products), for the purpose of concluding and performing the sales agreement (Article 6(1)(b) GDPR).

Data contained in sales records, invoices, and accounting documents, for the purpose of fulfilling legal obligations, in particular tax obligations (Article 6(1)(c) GDPR).

Data relating to returns, complaints, and correspondence, for the purpose of handling these processes and establishing, pursuing, or defending claims (Article 6(1)(b), (c) and (f) GDPR).

Data used to run a customer account (e-mail address and your order history), if you choose to create an account, so you can sign in and track your orders. Creating an account is optional (Article 6(1)(a) and (f) GDPR).

Photos and design references you upload for a custom order. Solely to prepare your personalised product (Article 6(1)(b) GDPR).

E-mail address, for sending the newsletter and information about new collections, exclusively on the basis of separate, voluntary consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.

The content and signature of a product review you choose to leave, after a verified purchase, on the basis of your consent (Article 6(1)(a) GDPR).

Data about how you use the store: the pages you visit, what you click, an approximate location derived from your IP address, and your device and browser type, for statistics and to improve the store, exclusively on the basis of the voluntary consent you give in the cookie banner (Article 6(1)(a) GDPR), which you may withdraw at any time.

Session recordings (PostHog): a recording of your browser interactions (movement, clicks, scrolling), on the same basis and under the same consent. This helps us understand and improve how the store works. Anything you type into a form field, and everything shown once you are signed in to your customer account (personal details, order history, Paczkomat locker code), is automatically masked in these recordings and never appears in them.

Ad-performance data (the Meta pixel): which products you viewed, additions to the bag, and started and completed orders together with their value, sent to Meta Platforms Ireland Ltd to measure how our advertising performs, exclusively on the basis of the voluntary consent you give to marketing cookies (Article 6(1)(a) GDPR), which you may withdraw at any time. See § 6 for details.

Providing data is voluntary but necessary to place and fulfil an order. Payment data (e.g. card numbers) is processed exclusively by the payment provider. The Controller has no access to it.

§ 3. Who We Share Data With

Data is shared only with entities necessary to fulfil the order:

InPost, parcel delivery (name, surname, phone number, e-mail, selected Paczkomat locker),
Stripe, online payment processing (BLIK, cards, Przelewy24, and others),
Netlify, hosting of the store website and handling of the contact and custom-order forms (the store runs on Netlify's infrastructure, and the messages sent through those forms, including your e-mail address and the details you provide, are delivered to the Netlify dashboard and to the Administrator's e-mail),
Supabase, database and file storage: customer accounts, order records, product reviews, and the photos and design references uploaded for custom orders,
Resend, newsletter handling: storing the e-mail address you sign up with and sending marketing messages, only after you confirm your subscription by clicking the link in a confirmation e-mail (double opt-in) and on the basis of your voluntary consent, which can be withdrawn at any time (the “unsubscribe” link in every message); newsletter messages contain no tracking pixels and no click-counting links, so we do not record who opened a message or when,
PostHog, statistics and session recordings: browsing data (pages visited, clicks, approximate location derived from the IP address, device and browser type) and a recording of your browser interactions, only after you consent in the cookie banner, which you can withdraw at any time (“Cookie settings” in the footer), anything typed into a form and anything shown in your customer account is automatically masked in the recordings; the transaction events described in § 6 are recorded regardless of that consent,
Meta Platforms Ireland Ltd, ad measurement and marketing: the Meta pixel passes on information about your visit to the store (pages visited, products viewed, additions to the bag, and started and completed orders together with their value), exclusively on the basis of your consent to marketing cookies (Article 6(1)(a) GDPR), which you may withdraw at any time (“Cookie settings” in the footer); until you give that consent the pixel is not loaded and no data is sent to Meta,
where necessary: an accounting office or tax adviser.

We do not sell your data. Other than the Meta pixel described above, which runs only with your consent and serves to measure how our own advertising performs, we do not share data with third parties for marketing purposes.

Providers such as Stripe, Supabase, Netlify, PostHog or Meta may store data outside the European Economic Area. This takes place on the basis of mechanisms provided for by the GDPR (including standard contractual clauses and the EU–US Data Privacy Framework). Details can be found in these providers' privacy policies. The controller of the data collected by the pixel is Meta Platforms Ireland Ltd (Ireland), and that data may be transferred to Meta Platforms Inc. in the United States on the basis of standard contractual clauses. Newsletter data is held on Resend servers located in the European Union (Ireland); Resend is, however, a US company, so access to that data from outside the EEA cannot be ruled out and takes place on the same basis.

§ 4. How Long We Keep Data

Data relating to orders and accounting documentation, for 5 years from the end of the tax year in which the order was fulfilled.
Data relating to complaints and potential claims. Until the expiry of limitation periods (as a rule, 6 years).
Data processed on the basis of consent (newsletter, store usage statistics), until consent is withdrawn.

§ 5. Your Rights

Every person has the right to access their data, rectify it, erase it, restrict its processing, port it, and object to processing based on legitimate interest. Simply send an e-mail to info@poppinpress.com.

Every person also has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects.

§ 6. Cookies

The store uses essential cookies and similar local storage necessary for it to work, for example keeping the items in your cart, remembering your chosen size, keeping you signed in to your account, and processing your payment securely through Stripe. These are required for the store to function and do not need consent.

Beyond those, we use two categories of cookies that require your consent and are off by default: analytics and marketing. We ask for that consent in the banner shown on your first visit. You can accept both (“Accept all”), reject both (“Essential only”), or choose them individually under “Settings”. Until you consent, we set no cookies from these categories and do not start the tools that would set them.

Analytics cookies (PostHog) help us understand how visitors use the store, which pages are viewed and what is clicked, so that we can improve it. On the same basis and under the same consent, we may also record a session replay (a recording of your interactions on the site, movement, clicks, and scrolling). Anything typed into a form field, and everything shown once you are signed in to your customer account, is automatically masked in these recordings.

Marketing cookies mean the Meta pixel (Facebook, Instagram). It measures how our advertising performs: it passes on to Meta Platforms Ireland Ltd which products you viewed, additions to the bag, and started and completed orders together with their value, which lets us see which ads lead to a purchase. We load the pixel only after you consent to this category, and its cookies are:

_fbp, category: marketing. Identifies your browser for ad measurement, stored for about 3 months, set only after consent,
_fbc, category: marketing. Records an ad click identifier and appears only if you reach the store from a Meta ad, stored for about 3 months, set only after consent.

Regardless of your analytics- and marketing-cookie choices, we record events relating to the transaction itself. Placing an order, subscribing to the newsletter, sending a custom-design enquiry. These are recorded by our server, without cookies and without tracking your browsing activity; they serve order handling and sales statistics (Article 6(1)(b) and (f) GDPR).

You can withdraw your consent at any time, and just as easily as you gave it. Click “Cookie settings” in the site footer and choose “Essential only”, or untick a single category. Withdrawal takes effect from the moment you withdraw and does not affect what we processed beforehand on that basis. You can also block or delete cookies at any time in your browser settings.

§ 7. Final Provisions

The Controller applies technical and organisational measures to protect the data processed, including an encrypted SSL connection on the store's website.

This Privacy Policy may be updated, for example if service providers change. The current version is always available at poppinpress.com.