Home

Privacy Policy

This Privacy Policy explains the purposes, methods and security of processing your personal data when you use https://candleroom.pl/ (the "Website"). It identifies the data controller, the information collected, how it is used and how it is protected.

Section 1. General Information

  1. Your data controller is Anna Małkiewicz, a sole trader registered in Poland's Central Register and Information on Economic Activity under the business name Anna Małkiewicz, with her registered office at 31 Warszawska Street, 05-510 Konstancin-Jeziorna, tax identification number (NIP) 1131979752 (the "Controller").
  2. Contact the Controller by email at candleroomwww@gmail.com, by telephone on +48 22 896 34 64 or by post at 31 Warszawska Street, 05-510 Konstancin-Jeziorna.
  3. The terms for electronic services are available in the Terms and Conditions.
  4. The Controller processes personal data in accordance with applicable law, particularly Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR"), the Polish Personal Data Protection Act, the Act on the Provision of Electronic Services, the Electronic Communications Law and consumer rights legislation.
  5. Providing personal data is voluntary, but in some cases necessary to use particular Website functions, place an order, create a customer account, subscribe to the newsletter, contact the Controller, publish a review or exercise consumer rights.
  6. Do not provide special-category data in Website forms, such as information about health, political opinions, religious beliefs or racial or ethnic origin, unless it is expressly necessary for a particular matter and you consciously choose to provide it.

Section 2. Data Processing Principles

  1. The Controller processes personal data lawfully and on an appropriate legal basis; fairly; transparently; for specific purposes rather than collecting it in advance without a purpose; only to the extent adequate and necessary; with care for accuracy; no longer than necessary; and with appropriate security.
  2. Appropriate technical and organisational measures protect personal data against unauthorised access, loss, destruction, alteration or disclosure.

Section 3. Purposes, Legal Bases and Scope of Processing

1. Purposes and Legal Bases

  1. To answer messages received by email, contact form, telephone or other means, based on the Controller's legitimate interest in handling correspondence and enquiries.
  2. To fulfil orders, including accepting orders, handling payments, preparing parcels, delivery, collection and order-related contact, based on the sales contract or steps taken before entering into it.
  3. To handle payments, including online payments, Przelewy24, cards, BLIK, bank transfers, payments into the bank account and payments on collection, based on performance of a contract, legal obligations and the Controller's legitimate interest in proper payment handling.
  4. To arrange delivery, including transferring parcels to a courier, parcel locker operator or another carrier agreed with the customer, based on performance of the sales contract.
  5. To handle complaints, returns and withdrawals, including those submitted through the Website's electronic withdrawal function, based on legal obligations and the Controller's legitimate interest in handling customer requests and establishing, exercising or defending claims.
  6. To meet product safety obligations, including general product safety requirements, handling safety reports, corrective action and recall notices, based on legal obligations and the Controller's legitimate interests.
  7. To create and maintain a customer account, based on the electronic services agreement.
  8. To provide order history, store credit and other customer account functions where used, based on performance of a contract or the Controller's legitimate interests.
  9. For newsletter marketing where you subscribe, based on your consent.
  10. To enable comments and product reviews, based on the Controller's legitimate interest in allowing users to express opinions about products and services.
  11. To operate business profiles on Facebook, Instagram, TikTok, Pinterest and X (formerly Twitter), including sharing product information, promotions and business news and responding to messages, comments and reactions, based on the Controller's legitimate interests and the relevant platform's rules.
  12. For technical purposes using necessary cookies and similar technologies, including Website operation and security, the cart, login, forms, language and cookie preferences, anti-spam measures and protection against misuse, based on the Controller's legitimate interests.
  13. For statistics and analytics where you consent to analytics cookies or similar technologies, based on your consent.
  14. For marketing and advertising where you consent to marketing cookies, pixels or similar technologies, based on your consent.
  15. To operate external tools used in the Shop, particularly Shopify apps, withdrawal, review and product safety apps, and analytics, advertising, communication and sales tools, based on performance of a contract, consent, legal obligations or legitimate interests, depending on the tool and purpose.
  16. To comply with legal obligations, particularly tax, bookkeeping, accounting, archiving, consumer rights, data protection and product safety requirements.
  17. To establish, exercise or defend claims, based on the Controller's legitimate interests.

2. Categories of Data

  1. When you email, use the contact form, telephone or otherwise contact us, we process the information you provide, particularly your name, business or other identifying name, email address, telephone number and correspondence. Providing this information is voluntary but necessary for a response.
  2. For newsletter subscriptions, we process your email address and subscription information, such as the subscription date, consent status and any unsubscribe date. Subscribing is voluntary and you may unsubscribe at any time.
  3. For purchases, we process information necessary to fulfil the order, particularly your name, email address, telephone number, billing and delivery addresses, order details, selected payment and delivery methods and other information entered in the order form. Providing required information is a condition of placing an order and entering into the contract.
  4. For online payments, necessary information may be shared with Przelewy24 or other parties involved, such as banks, card operators or BLIK, to the extent necessary for payment processing.
  5. For bank transfers or payments into the bank account, we may process information shown in the transfer confirmation, particularly the sender's name, bank account number, payment reference and amount.
  6. For delivery, we process information needed to dispatch and deliver the parcel, particularly your name, delivery address, telephone number, email address, order number and information required by DPD, InPost or another agreed carrier for international or alternative delivery.
  7. For collection from the shop, we may process information needed to prepare the order and confirm collection.
  8. For complaints, returns or withdrawal statements, including electronic withdrawal forms, we process information necessary to handle the request, particularly your name, email address, order number, purchased product, request details, return or delivery address, bank account number where needed for a refund and any other information you provide.
  9. For customer accounts, we process information provided when creating or using the account, particularly your name, email address, telephone number, addresses, order history, account status, login information and information relating to account functions. Providing the required information is a condition of creating and maintaining the account.
  10. For comments and reviews, we process information provided when publishing, particularly your name, username or nickname, email address, comment, review, product rating, publication date and any photographs or other material you voluntarily add.
  11. When you like, comment on or share our content, message us or otherwise interact with our social profiles, we process information visible under the platform's settings, particularly your profile name and photograph, comments, messages, reactions, shares and activity information.
  12. When you use the Website, we may process technical information such as IP addresses, cookie and device identifiers, browser and operating system details, device type, Website activity, cookie and language preferences, approximate country or region and information relating to anti-spam measures, including hCaptcha.
  13. If you consent to analytics cookies, we may process information about Website use, particularly pages visited, time spent, traffic sources, clicks, views, cart activity, shopping journeys and Shop-related events.
  14. If you consent to marketing cookies, pixels or similar technologies, we may process information about Website and Shop activity for advertising, remarketing, measuring advertising effectiveness and tailoring advertising to your interests.
  15. The Website may use APIs, pixels, apps and tools from external partners to operate the online shop, payments, delivery, reviews, analytics, advertising, social media, newsletters, customer communication, product safety and functions for withdrawals, returns and complaints. These tools may involve processing by external providers under their own privacy rules.

Section 4. Recipients and Transfers Outside the European Economic Area

  1. Your data may be received by:
    1. Shopify and Shopify group companies, to the extent needed to operate the Shop.
    2. Providers administering, maintaining and technically supporting the Website.
    3. Shop apps and tool providers, including BOO EU Withdrawal Button, GPSR Compliance, Judge.me Reviews, R Terms & Conditions, Messaging and other Shopify app providers, where their apps process personal data.
    4. Przelewy24 and other payment participants, such as banks, card operators and BLIK.
    5. The Controller's bank for bank transfers or refunds to a bank account.
    6. Carriers and couriers, particularly DPD and InPost, and other carriers selected for international or individually agreed delivery.
    7. Providers of bookkeeping, accounting, tax, legal, administrative, IT, hosting and email correspondence services.
    8. Email and communication service providers, to the extent required for correspondence.
    9. The newsletter provider if you subscribe.
    10. The review tool provider if you publish a review.
    11. Anti-spam and form protection providers, including hCaptcha.
    12. Analytics tool providers, including Google & YouTube, if you consent to analytics cookies or similar technologies.
    13. Advertising and marketing providers, including Google & YouTube and Meta Platforms (Facebook and Instagram), if you consent to marketing cookies, pixels or similar technologies.
    14. Social platform operators, including Facebook, Instagram, TikTok, Pinterest and X (formerly Twitter), if you interact with our profiles.
    15. Public bodies, authorities, courts and other authorised parties where disclosure is required by law.
  2. Your data may be transferred outside the European Economic Area (EEA) where we use providers processing data outside the EEA.
  3. Such transfers take place only with an appropriate legal basis, particularly a European Commission adequacy decision, standard contractual clauses or another mechanism permitted by the GDPR.
  4. For providers based in the United States, transfers may rely on the EU-US Data Privacy Framework where the provider holds the relevant certification, or another GDPR mechanism.
  5. Contact the Controller for information about safeguards used for transfers outside the EEA.

Section 5. Retention Periods

  1. We retain personal data for as long as necessary for the purposes for which it was collected, and then for the period required by law or necessary to establish, exercise or defend claims.
  2. Order information is retained for the periods required by tax, bookkeeping and accounting law and the limitation period for potential claims.
  3. Payment information is retained as necessary for payments, settlements, refunds, accounting and tax obligations and the limitation period for potential claims.
  4. Complaint, return and withdrawal information is retained as necessary to handle the request and subsequently for the legally required period or the limitation period for potential claims.
  5. Product safety information is retained as necessary to fulfil those obligations and for the period required by law.
  6. Customer account information is retained until the account is deleted, unless continued retention is necessary for legal obligations, orders, complaints, returns, withdrawals or establishing, exercising or defending claims.
  7. Newsletter information is retained until consent is withdrawn or you unsubscribe.
  8. Comment and review information is retained until deletion or a successful objection, unless continued retention is justified by claims or a legal obligation.
  9. Social media communication information is retained while available on the platform or until the message, comment or reaction is deleted or you stop following the profile, in accordance with the platform's rules.
  10. Information processed with consent to analytics or marketing cookies is retained until consent is withdrawn, preferences change or the relevant tool's retention period expires.
  11. Information provided through email, contact forms, telephone or social media is retained as necessary to respond and handle the matter, and then as needed to establish, exercise or defend claims.

Section 6. Your Rights

  1. You have the right to access your data, receive a copy, request correction, request erasure, restrict processing, obtain data portability, object to processing, withdraw consent at any time where processing relies on consent, and obtain information about safeguards for transfers outside the EEA. Withdrawing consent does not affect the lawfulness of earlier processing.
  2. To exercise your rights, email candleroomwww@gmail.com.
  3. The Controller may request additional information to confirm your identity where necessary to handle your request correctly.
  4. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.
  5. Current supervisory authority contact details and further information are available at www.uodo.gov.pl.

Section 7. Cookies and Similar Technologies

  1. We use cookies and similar technologies such as pixels, tags, identifiers and customer events.
  2. Cookies are small text files stored on your device while using the Website. They may support Website operation, the cart, login, forms, saved preferences, security, traffic analysis and marketing.
  3. Cookies may be persistent or session-based. Session cookies are deleted when the browser closes. Persistent cookies remain for a defined period or until you delete them.
  4. We use first-party and third-party cookies. First-party cookies are set by the Website. Third-party cookies may come from analytics, advertising, social media, security and other tools used in the Shop.
  5. You can manage cookie consent through the cookie banner and preference settings on the Website. You can accept cookies, reject non-essential cookies or manage individual preferences.
  6. You may change or withdraw consent to analytics and marketing cookies at any time through the Website's cookie settings. Withdrawal does not affect the lawfulness of earlier processing.
  7. You can also block, restrict or delete cookies through your browser settings.
  8. Disabling or restricting some cookies may affect Website operation and the availability of particular Shop functions.

Section 8. Types of Cookies

  1. The Website may use technical and necessary cookies; functional cookies; analytics cookies; marketing and advertising cookies; security and anti-spam cookies; and cookies or similar technologies related to external social, analytics, advertising and sales integrations.
  2. Technical and necessary cookies support the Website and Shop, including the cart, ordering, forms, login, customer accounts, cookie preferences, security and basic functions.
  3. Functional cookies may remember settings such as language, region, display preferences and other choices that make the Website easier to use.
  4. Analytics cookies are used with your consent to analyse Website use, visits, traffic sources, page popularity, user activity and Shop performance.
  5. Marketing and advertising cookies are used with your consent for remarketing, measuring advertising effectiveness and tailoring advertising to your interests.
  6. Security technologies may protect contact and comment forms, login, account creation and password recovery against spam, misuse and automated bots, including through hCaptcha.

Section 9. Analytics, Advertising and Social Tools

  1. The Shop may use analytics, advertising and sales tools within Shopify and sales channels or integrations, particularly Google & YouTube and Facebook & Instagram.
  2. If you consent to analytics or marketing cookies, these tools may collect information about activity such as page views, clicks, adding products to the cart, beginning checkout, placing orders and other Shop-related events.
  3. Information collected may be used to assess marketing effectiveness, prepare statistics, measure conversions, optimise advertising and run remarketing campaigns.
  4. The Shop may use sales channels and social profiles such as Facebook, Instagram, TikTok, Pinterest and X (formerly Twitter). Interactions with these profiles are also processed under the platform's privacy rules.
  5. Any additional analytics, advertising or sales tools or pixels activated in future will be used in accordance with applicable law and, for non-essential tools, after obtaining consent where required. Material changes to the scope of processing will be reflected in this Privacy Policy.

Section 10. Newsletter and Marketing Communications

  1. If you subscribe, we process your email address to send information about products, promotions, new arrivals, marketing content and Shop activities.
  2. Subscribing is voluntary.
  3. You may unsubscribe at any time through the email's unsubscribe link where available, or by contacting candleroomwww@gmail.com.
  4. Unsubscribing does not affect the lawfulness of earlier processing.

Section 11. Reviews and Comments

  1. The Website may offer product review and comment functions.
  2. Information provided when publishing may be visible to other users to the extent supported by the relevant tool.
  3. The Shop may use Judge.me Reviews or similar tools.
  4. The Controller may remove content that breaches the law, accepted standards of conduct, third-party rights or the Website's Terms and Conditions.

Section 12. Product Safety and Information Obligations

  1. The Controller may process personal data to fulfil product safety obligations, including general product safety requirements.
  2. This may particularly include order and product information and customer contact details needed to handle reports, communicate hazards, corrective actions or recalls, or fulfil other legal obligations.
  3. The Shop may use GPSR Compliance or similar tools for these purposes.

Section 13. Automated Decision-Making and Profiling

  1. The Controller does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
  2. If you consent to marketing cookies, pixels or similar technologies, your data may be used to create audience groups, analyse advertising effectiveness, carry out remarketing and tailor advertising to your interests.
  3. These activities do not produce legal effects or similarly significantly affect you.
  4. You may limit or disable these activities through Website cookie settings or the privacy settings of the relevant external service or tool.

Section 14. Data Security

  1. The Controller uses appropriate technical and organisational measures to protect personal data.
  2. Access is limited to people and entities that need it for specific processing purposes.
  3. The Controller uses external providers that declare an appropriate level of data security or are contractually obliged to provide it under their agreements or service terms.
  4. The Website may use anti-spam measures and tools protecting forms, login and other Shop functions against misuse.

Section 15. Changes to This Privacy Policy

  1. The Controller may update this Policy, particularly following changes in law, Website functions, tools, apps, sales channels, service providers or processing methods.
  2. The current version is available on the Website.
  3. For significant changes, the Controller may inform users in a manner appropriate to the nature of the changes.

Section 16. Final Provisions

  1. Matters not covered by this Policy are governed by applicable law, particularly the GDPR and Polish law.
  2. For questions about personal data processing, email candleroomwww@gmail.com.