Privacy policy

The controller of personal data is Oksana Kalhina, NIP 5291870411, REGON 545260041. Privacy contact: estyjorno@gmail.com, phone +48 694 601 865, address: ul. Młodości 5, lok. 6, 05-825 Książenice, Polska.

We process data in accordance with the GDPR, transparency, data minimisation and security principles. Providing data is voluntary, but some data is necessary to place and fulfil an order.

For orders, we process name, e-mail, phone, delivery address, product information, payment, delivery, correspondence, returns and complaints data.

In the returns portal we also process one-time identifiers and cryptographic hashes used to verify access, selected order items, the customer's statement, the preliminary checkpoint result and the case history. The one-time code is not stored in plain text.

For the website, we may process technical data such as IP address, cookie identifiers, language, currency, device information, cart and checkout events.

If marketing consent is given, we may process data needed to send marketing communication, measure campaigns and personalise advertising.

Order data is processed to enter into and perform the contract, handle payment, delivery, customer contact and pre-contract steps requested by the customer.

Accounting and tax data is processed to comply with legal obligations. Complaints, claims and security data may be processed on the basis of the shop's legitimate interest and legal obligations.

Analytics and marketing data based on non-essential cookies is processed only on the basis of consent, which can be withdrawn at any time.

Data may be shared with providers needed to run the shop: payment operators, delivery companies, hosting, e-mail providers, accounting systems, technical tools, IT support and legal or accounting advisers.

Depending on enabled features, recipients or processors may specifically include Stripe (payments), InPost or other carriers, Google/Gmail (correspondence), Telegram (administrative alerts containing a limited order-data set), Meta (analytics and marketing after consent), and the hosting/database provider.

For online payments, payment data is handled by the payment operator. The shop does not store full card details.

If tools outside the European Economic Area are used, transfers are made only with safeguards required by the GDPR, such as standard contractual clauses or other valid mechanisms.

Order data is kept for the time needed to perform the contract, handle returns and complaints, and then for periods required by tax, accounting and limitation rules.

Data processed on the basis of consent is kept until consent is withdrawn, unless a shorter period results from the settings of a specific tool or cookie.

Correspondence is kept for the time needed to handle the matter and secure possible claims.

Chat conversations are kept for no more than 12 months. An e-mail code is valid for 10 minutes and its record is removed within 24 hours; photos are removed 90 days after a conversation closes. Customers can delete their history earlier in their account. Chat content may be processed by the configured OpenAI or Anthropic provider; Gemini does not receive customer data. We do not request children's personal data; please do not include it in messages or photos.

Customers have the right to access, rectify, erase, restrict processing, data portability, object to processing and withdraw consent.

To exercise your rights, write to estyjorno@gmail.com. You may also lodge a complaint with the competent data protection authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

We use organisational and technical measures appropriate to the risk to protect data against unauthorised access, loss or alteration.

Failure to provide required checkout data may prevent the conclusion or performance of the contract. Refusing analytics or marketing cookies does not prevent use of the shop.