MOLACZKA
PRIVACY
AND COOKIE POLICY
Sale of handmade goods as an unregistered business activity
| Shop brand | Molaczka |
| Document version | 1.4 |
| Legal status as of | 7 November 2026 |
Privacy and Cookie Policy of the Molaczka online shop
This Policy explains what personal data I process in connection with your use of the molaczka.com online shop, for what purposes, on what legal basis and for how long, to whom I disclose it, what rights you have, and how the Shop uses cookies. Capitalised terms have the meaning given to them in the Terms and Conditions.
§ 1. Data controller
The controller of your personal data is Iwona Molak, conducting an unregistered business activity (działalność nierejestrowana) under the Molaczka brand, ul. Traugutta 14, 59-700 Bolesławiec, Poland (hereinafter: the “Controller” or the “Seller”).
You can contact me regarding personal data matters:
- by email: bok@molaczka.com,
- by phone: +48 608 022 811,
- by post: ul. Traugutta 14, 59-700 Bolesławiec, Poland.
The Controller has not appointed a data protection officer, as there is no legal obligation to do so.
§ 2. Purposes, legal bases and retention periods
I process only the data needed for a given purpose. The legal bases derive from Art. 6(1) of Regulation (EU) 2016/679 (GDPR).
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Concluding and performing the sales contract (Order, payment, delivery, communication about the Order) | full name, address, email, phone number, Order details, optionally personalisation details | Art. 6(1)(b) GDPR – contract | until the contract has been fully performed, and thereafter for the purposes listed in the following rows |
| Maintaining an Account in the Shop | email, password (in encrypted form), address details, Order history | Art. 6(1)(b) GDPR – Account agreement | until the Account is deleted |
| Handling withdrawal from the contract and returns (§ 3) | details from the withdrawal statement or return form, Order number, bank account number (if you provide it) | Art. 6(1)(c) GDPR – legal obligation under the Polish Consumer Rights Act | until the limitation period for contractual claims expires |
| Handling complaints | contact details, description of the defect, photos, correspondence | Art. 6(1)(c) GDPR – legal obligation | until the limitation period for contractual claims expires |
| Accounting and sales records | Order and payment details | Art. 6(1)(c) GDPR – tax regulations | 5 years from the end of the calendar year in which the tax payment deadline fell |
| Replying to messages (contact form, email, phone, Messenger) | data provided in the message | Art. 6(1)(f) GDPR – legitimate interest in communicating with you | until the matter is resolved, but no longer than 12 months, unless the message concerns a contract |
| Establishing, pursuing or defending legal claims | data from Orders and correspondence | Art. 6(1)(f) GDPR – legitimate interest | until the limitation period for claims expires |
| Shop security and spam protection | IP address, technical browser data | Art. 6(1)(f) GDPR – legitimate interest | up to 30 days |
| Requesting a review of purchased Products (a one-off email with a personal link, sent a few days after the Order is fulfilled – only if you tick the consent box in the Order form) | first name, email address, Order details; if you submit a review – its content, rating and signature | Art. 6(1)(a) GDPR – your consent (voluntary; you may withdraw it at any time by writing to bok@molaczka.com); publication of a submitted review – Art. 6(1)(f) GDPR, legitimate interest | until the message is sent or consent is withdrawn; review – until it is deleted |
| Information on how you found the Shop – recorded only for Orders placed up to 7 October 2026 (WooCommerce order attribution, now disabled) | source of visit, number of visits, device type | Art. 6(1)(f) GDPR – legitimate interest in developing the Shop | together with the Order data |
The general limitation period for claims is 6 years, and for claims arising from sales – 2 years; in both cases, the period ends on the last day of the calendar year (Articles 118 and 554 of the Polish Civil Code).
§ 3. Return and withdrawal form
You can submit a statement of withdrawal from the contract via the return form in the Shop, by email or by post. Using the form is not mandatory.
- Required data: Order number, date of receipt, full name, address, the email address given in the Order, list of Products being returned. Without these, I cannot link the statement to the Order.
- Optional data: phone number, reason for return, bank account number. You do not have to give a reason for withdrawal. I will use the account number solely to refund your payment.
- Technical data: I record the IP address and the time the form was sent to protect against spam and abuse; I delete them after 30 days.
After submitting the form, you will receive an email confirming receipt of your statement, in accordance with Art. 32(2) of the Polish Consumer Rights Act.
§ 4. Recipients of data
I do not sell your data. I disclose it only to entities that help me run the Shop, and only to the extent necessary for them to perform their tasks:
- the hosting and email provider on whose servers the Shop and the bok@molaczka.com mailbox run,
- the bank holding the Seller's account – for bank transfer payments and refunds,
- carriers making the delivery – depending on the chosen method: InPost (parcel lockers) or the courier company specified when selecting delivery,
- Automattic Inc. (Gravatar service) – if you post a comment on the site, WordPress sends an encrypted hash of your email address to display an avatar,
- providers of accounting or legal services – if I use them,
- public authorities – where required by law,
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – provider of Google Analytics, only if you consent to statistics cookies.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – provider of Google reCAPTCHA, which protects the Shop's forms against spam and abuse (details in § 6).
If you contact me via Messenger (e.g. using the “Write to us” button on the site), your data is also processed by Meta Platforms Ireland Ltd. as a separate controller, under the terms described in its privacy policy. For automated replies in Messenger (e.g. information about shipping, returns and made-to-measure orders), I use ManyChat, Inc. (USA) as a processor – it has access to your name from your Facebook profile, your Messenger ID and the content of the conversation.
Transfers outside the European Economic Area. Some providers (e.g. Automattic Inc., ManyChat, Inc.) are based in the USA. In such cases, data is transferred on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. You can obtain information about the safeguards applied by writing to bok@molaczka.com.
§ 5. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify your data,
- erasure of your data – unless I am required to keep it by law or in connection with claims,
- restrict processing,
- data portability for data processed on the basis of a contract,
- object to processing based on legitimate interest,
- withdraw your consent at any time where processing is based on consent – without affecting the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise your rights, write to bok@molaczka.com. I will respond within one month. I may ask for information needed to confirm that the request is being made by the right person (e.g. the Order number).
§ 6. Cookies
Cookies are small text files stored in your browser. The Shop uses only cookies necessary for it to function (and – with your consent – cookies that remember your details in the review or comment form). The Shop does not use advertising cookies. With your consent, it uses Google Analytics, a visitor statistics tool. To protect its forms against spam, the Shop uses Google reCAPTCHA – described below.
| Cookies | Purpose | Retention period |
|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | cart and shopping session functionality | up to 48 hours |
| wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | logging in to your Account | until the browser is closed, or up to 14 days with the “Remember me” option |
| comment_author_* | remembering your details in the comment form, if you consent | up to 12 months |
| cmplz_* | remembering your choices in the consent banner | up to 12 months |
| _ga, _ga_* | visitor statistics (Google Analytics) – only with your consent | up to 2 years |
Google Analytics. With your consent (Art. 6(1)(a) GDPR), I use Google Analytics 4, provided by Google Ireland Limited. The tool collects information about how you use the Shop – e.g. pages visited, visit duration, approximate location, device and browser type. IP addresses are not stored. Data may be transferred to Google LLC in the USA on the basis of the European Commission's decision on the EU-US Data Privacy Framework. I keep statistical data for no longer than 14 months. You can withdraw your consent at any time by clicking “Manage consent” on the Shop's website.
Google reCAPTCHA. To protect the Shop's forms (including the contact form and the made-to-order form) against spam and automated abuse, I use Google reCAPTCHA v3, provided by Google Ireland Limited. The legal basis is my legitimate interest (Art. 6(1)(f) GDPR), namely the security of the Shop. reCAPTCHA analyses, among other things, your IP address, browser and device information and how you use the site, and may store cookies or similar data in your browser. Data may be transferred to Google LLC in the USA on the basis of the European Commission's decision on the EU-US Data Privacy Framework. More information: Google Privacy Policy and Google Terms of Service.
You can block or delete cookies in your browser settings. Blocking necessary cookies may prevent you from using the cart and your Account.
§ 7. Final provisions
- Providing your data is voluntary, but without the data required in the Order form or return form, I cannot fulfil the Order or accept a statement submitted via the form.
- I do not make decisions based solely on automated processing of data, including profiling.
- The Shop runs over an encrypted connection (HTTPS). Only authorised persons have access to the Shop's admin panel and email inbox.
- I will announce any material changes to this Policy on the Shop's website. The current version is always available on this page.
Version 1.4 of this Policy has been in force since 7 November 2026 (version 1.3 applied from 1 November 2026, version 1.2 from 11 October 2026, version 1.1 from 7 October 2026, and version 1.0 from 22 September 2026).