Privacy policy

Version dated 17 October 2026. This document describes data processing at bizuteriazintencja.com.

Who is responsible for your data?

The controller is Kamila Gniadek, conducting unregistered business activity under the brand Biżuteria z intencją, ul. Brzoskwiniowa 6 m. 2, 61-160 Czapury, Poland. For data-related questions, email bizuteriazintencja@gmail.com or call 785 402 288.

What data do we process and why?

• Orders and delivery: name, address, email, telephone, products, order value, selected delivery, parcel locker code and payment information. These are used to enter into and perform the contract — Article 6(1)(b) GDPR. Tax details are provided where needed for a sales document.
• Accounting and consumer rights: transaction data, return and complaint correspondence and required documents. The basis is compliance with legal obligations — Article 6(1)(c) GDPR, particularly tax law and the Consumer Rights Act.
• Contact: information you provide in messages or conversations. For purchase enquiries, the basis is Article 6(1)(b) GDPR; for other matters, Article 6(1)(f), our legitimate interest in responding and retaining a record of arrangements.
• Customer accounts: email, login details and order history where an account is used. The basis is performance of the account service contract, Article 6(1)(b) GDPR. You can purchase without an account.
• Security and claims: technical information such as IP address, request date and time, visited page and browser information, and data needed to establish, pursue or defend claims. The basis is Article 6(1)(f) GDPR: the legitimate interest in protecting the shop and the controller’s rights.

Providing data is voluntary, but without required fields we cannot process the order or service. Do not include sensitive information unnecessary for your purchase in order notes. We do not make automated decisions with legal effects or use profiling for that purpose.

Who may receive the data?

Data may be shared as necessary with hosting and website maintenance providers (Hostinger), email providers (Google/Gmail), technical support providers and InPost as selected at checkout. Autopay and institutions participating in the selected payment receive information needed to process it. Data may be shared with authorised authorities where required by law and with legal or accounting support where necessary. Providers acting on the controller’s behalf process data on appropriate legal bases and only to the extent necessary.

Infrastructure and email providers may process data outside the European Economic Area, particularly in the USA. Such transfers require mechanisms compliant with Chapter V GDPR, such as a European Commission adequacy decision or standard contractual clauses. Contact the controller for information about the applicable mechanism and a copy of appropriate safeguards. Provider information: Hostinger and Google.

How long do we keep data?

• Order data: throughout contract performance, then for the period required by tax law and for handling claims.
• Tax documents: generally 5 years from the end of the year in which the tax payment deadline expired; this may change where the law suspends or interrupts the period.
• Claims-related data: until the applicable limitation period expires, generally up to 6 years, or 3 years for business-related claims, taking account of special periods and ongoing proceedings.
• Account data: until the account is deleted; order records follow the separate periods above.
• Ordinary correspondence unrelated to an order: until the matter is closed, then up to 12 months unless needed for claims.
• Technical logs: as long as needed for infrastructure operation and security under the hosting retention cycle; incident records may be retained until the incident and any claims are resolved.

Your rights

Under the conditions set out in the GDPR, you have rights of access and a copy, rectification, erasure, restriction and portability of data processed automatically based on contract or consent. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Write to the controller. Some records must be retained despite an erasure request where required by law or for the protection of claims. You may also complain to the President of the Polish Personal Data Protection Office; information: uodo.gov.pl.

Cookies and browser storage

The shop uses mechanisms needed to maintain the cart, process orders and login sessions, and remember your chosen language. Typical names are woocommerce_items_in_cart and woocommerce_cart_hash (session), wp_woocommerce_session_* (usually up to 2 days), wordpress_logged_in_* and wordpress_sec_* (login session, usually up to 14 days when “remember me” is selected), wordpress_test_cookie (cookie support test) and bzi_lang (chosen language, up to 30 days). The browser may also store technical cart state locally. Retention depends on the function and session settings.

Analytics: Google Analytics and Microsoft Clarity

We activate analytics tools only with consent to the “Statistics” category. Refusing consent will not prevent browsing or purchasing. The purpose is to understand how visitors use the shop, identify navigation difficulties and improve the website. Personal data processing is based on consent — Article 6(1)(a) GDPR.

Google Analytics 4 (Google Ireland Limited) produces visit and event statistics. It may process cookie identifiers, visited URLs, referral sources, visit times and events, and device and browser information. Google states that GA4 does not log or store IP addresses. Analytics cookies may include _ga and _ga_*. Retention depends on the type of data and service settings. Contact the controller for information about the retention period applicable to your data. See Google’s privacy policy and how Google uses data from partner sites.

Microsoft Clarity (Microsoft Ireland Operations Limited) analyses on-site behaviour through click and scroll heatmaps and session replays. Replays show website interactions, not camera footage or activity outside the website. The tool may process online identifiers, device and browser information, visited pages, clicks, scrolling and visit times. It may use first- and third-party cookies, including _clck and _clsk. According to Microsoft documentation, ordinary recordings are retained for 30 days, and labelled recordings and heatmap data for up to 9 months. Microsoft may also use collected data to improve its products, for personalisation and advertising, as described in the Microsoft Privacy Statement.

After consent, analytics data recipients are Google and Microsoft respectively. These services may transfer data outside the EEA, including to the USA, using applicable Chapter V GDPR safeguards, including an adequacy decision where applicable or standard contractual clauses. Contact the controller or consult provider documentation for information about safeguards.

How can you change or withdraw consent?

Select Cookie settings in the footer of any page. You can enable statistics or disable them and save your choice. Withdrawal does not affect the lawfulness of earlier processing. Necessary shop functions remain active. Complianz records your choice in technical cmplz_* cookies so that you are not asked again on every page. Deleting these cookies or using another browser may display the banner again.

You can also delete or block cookies in your browser settings; blocking necessary cookies may prevent the cart or login from working. Statistics consent is optional and is not required to place an order.

Shop security, email and backups

Wordfence (Defiant, Inc.) helps protect the shop against attacks and unauthorised logins. It may process IP addresses, browser information, server requests and login events, and exchange technical threat-detection information with its provider. The legal basis is the controller’s legitimate interest in security — Article 6(1)(f) GDPR. The technical wfwaf-authcookie-* cookie helps the firewall recognise a logged-in user; it is not an advertising cookie. See the Wordfence privacy policy.

Shop emails are sent using WP Mail SMTP and Gmail. Google processes sender and recipient addresses, message content and delivery metadata to deliver order confirmations, account messages and replies. These messages support the contract or correspondence and do not subscribe you to a newsletter. The legal bases and retention periods are described above.

Backups use UpdraftPlus with Google Drive storage assigned to the controller. Database backups may include account and order data and shop settings. Their purpose is recovery and protection against data loss — Article 6(1)(f) GDPR. The schedule retains 7 daily database backups and 2 weekly file backups. Separate manual backups may be kept during maintenance or incident investigation. Backups are not used for advertising; access should be restricted to authorised shop support staff. Data removed from the live database may remain in backups until replaced or deleted under the retention cycle.

Complianz manages cookie choices and stores technical confirmation of those choices. Its website scanner helps inventory scripts and cookies on public shop pages. See Complianz privacy information. Google and Defiant services may involve processing outside the EEA; safeguards are described in the section on recipients.

External links and changes

The Instagram link leads to Meta’s separate service, governed by its privacy rules. Shop photographs and fonts are served from the website’s server. We update this document when services, data processing or legislation change; the version date appears above.

Autopay payments and Furgonetka shipments

To process payments, we provide Autopay S.A. with the data needed for the transaction, including the order identifier, amount, currency and email address and, depending on the payment method, other information required to complete it. We receive payment identifiers, statuses and refund information. Autopay also acts as a separate controller for payment services, security and legal obligations. Details: Autopay S.A. Privacy Policy.

We use Furgonetka sp. z o.o. sp. k. to prepare and handle shipments. The integration transfers order data needed for shipping: the recipient’s name, address, email, telephone, order number and order information, and selected collection point. InPost receives the data required for carriage. These data support dispatch, delivery, tracking and shipment notifications. Provider details are available in the Furgonetka Privacy Policy. The shop shares data required for payment and delivery to perform the contract (Article 6(1)(b) GDPR), and for statutory accounting obligations where applicable (Article 6(1)(c) GDPR). This does not require statistics or marketing consent.

Collection point map and payment form

The Furgonetka map and Autopay forms are external services used for the delivery and payment you choose. When displayed, their providers may receive technical data such as your IP address and browser information and use session and security mechanisms. Processing necessary for a service you request is separate from optional analytics or advertising. Not every mechanism used by a payment or delivery provider is automatically necessary. When you move to a provider’s service, its privacy information and cookie settings also apply. Shop statistics remain optional.