Privacy Policy

Your privacy matters to us. Here's how we process your personal data, what rights you have and which cookies the EFFY shop uses.

Data controller

The controller of your personal data is Effy Sp. z o.o., with its registered office in Poznań, ul. Błażeja Winklera 6H/35, 61-001 Poznań, Poland, tax ID (NIP): 7792611928, National Court Register (KRS): 0001268956, REGON: 545793783 (hereinafter "EFFY" or "we").

For any matter concerning your personal data, write to us at hello@effy.com.pl or by post to our registered office. We have not appointed a data protection officer - you can contact us directly about any matter.

We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

What data we process, why and on what basis

We process data you provide yourself - in an order, in the contact form or when creating an account - the technical data needed to run the shop, and data we receive from payment operators in connection with your payment (e.g. the payment status and, for a saved card, its identifier, brand, last 4 digits and expiry date).

  • Order fulfilment - first and last name, delivery address, email, phone number, order and payment details (without the full card number or CVC). Basis: Art. 6(1)(b) GDPR - performance of the sales contract and steps taken before entering into it.
  • Tax and accounting - order and invoice data (including company details and tax ID (NIP), if you provide them). Basis: Art. 6(1)(c) GDPR - obligations under tax law and the Polish Accounting Act.
  • Complaints, returns and claims - order data, the content of your request, correspondence. Basis: Art. 6(1)(c) GDPR (the obligation to handle complaints) and Art. 6(1)(f) GDPR - our legitimate interest in establishing, exercising or defending legal claims.
  • Contact via the form or email - full name, email, subject and message content. Basis: Art. 6(1)(f) GDPR - our legitimate interest in replying to you, and where the matter concerns an order - Art. 6(1)(b) GDPR.
  • Customer account - login details, address details, order history and, if you pay via Stripe, the identifier of your Stripe customer profile. Basis: Art. 6(1)(b) GDPR - the account agreement you enter into when registering in the shop.
  • Saved card (optional, Account holders only) - the card identifier issued by Stripe, card brand, last four digits and expiry date; the full card number is stored only by Stripe (in a PCI DSS compliant system) and neither Stripe nor we store the CVC after the payment is authorised. Basis: Art. 6(1)(a) GDPR - your consent, given by ticking the save-card box when paying (the box is not ticked by default, and saving a card is not a condition for placing an order). We use a saved card only when you select it while placing an order. You can withdraw your consent at any time by deleting the card in “My account → Payment methods” or by emailing hello@effy.com.pl - deleting the card in the shop also detaches it from your Stripe customer profile.
  • Security and proper functioning of the shop - IP address, server logs, basic browser and device data, essential cookies. Basis: Art. 6(1)(f) GDPR - our legitimate interest in protecting the shop against abuse and keeping it running.
  • Protecting the contact form against spam - when you start filling in the contact form (click into any of its fields), your browser loads Google reCAPTCHA v3. The service analyses, among other things, your IP address, browser and device data, how you use the page (e.g. cursor movements and the time taken to fill in the form) and the _GRECAPTCHA cookie and other Google cookies your browser sends to Google, and when you send the form it gives our server an assessment of whether a human or an automated program (bot) filled it in. Messages assessed as spam - and messages sent without this assessment, e.g. because your browser blocks reCAPTCHA - are rejected and never reach us. Basis: Art. 6(1)(f) GDPR - our legitimate interest in protecting the form and our inbox against spam and abuse. We load reCAPTCHA only once you start using the form; we consider it a safeguard necessary to send the message you ask us to send, so we do not ask for your consent to cookies (Art. 399(3)(2) of the Polish Electronic Communications Law). If you do not want reCAPTCHA to load, email us directly at hello@effy.com.pl.
  • Analytics (only with your consent to analytics cookies) - information about how you use the shop: pages visited, clicks, scrolling and cursor movements, visit duration, device and browser data, approximate location derived from your IP address and identifiers stored in cookies. We use Microsoft Clarity for this (statistics, heatmaps and session recordings) and Google Analytics 4 (statistics on visits and events in the shop, e.g. adding to cart, purchases and their value or sending the contact form), run through Google Tag Manager and the Google Site Kit plugin. We do not use the advertising features of Google Analytics (Google signals, ad personalisation). Purpose: understanding how the shop is used and improving it. Basis: Art. 6(1)(a) GDPR - your consent (and, for storing and reading information on your device, Art. 399 of the Polish Electronic Communications Law).
  • Marketing (only with your consent to marketing cookies) - where you came to the shop from (referring website, search engine or campaign, e.g. utm parameters in the link), the landing page, the number of pages viewed during the current visit and your browser and device type (WooCommerce order attribution); if you place an order, the source of the visit is attached to it. Purpose: measuring the effectiveness of our marketing and advertising. We currently do not use third-party advertising tools (e.g. Google Ads, Meta) - if that changes, we will update this policy and ask for your consent again. We also pass your choice in this category to Google tags (Google Consent Mode) so that they do not store advertising cookies without your consent. Basis: Art. 6(1)(a) GDPR - your consent (and, for storing and reading information on your device, Art. 399 of the Polish Electronic Communications Law).
  • Cookie consent management - a random consent identifier, the date, version and scope of your choice (no IP address). Purpose: remembering your choice and demonstrating that consent was given. Basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

We do not run a newsletter.

Data recipients

We share data only with parties that help us run the shop and fulfil orders, and only to the extent necessary for their tasks: with processors acting on our behalf - under data processing agreements, and with parties acting as separate controllers (e.g. payment operators, Klarna, carriers) - to the extent needed to perform the contract or required by law, and with analytics providers only with your consent and to the extent described for each of them below. We never sell your data.

  • Stripe payment operator - Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland - handling payments in the shop (except the direct Przelewy24 payment described below, if made available): card (including Apple Pay and Google Pay), BLIK, Przelewy24 and Klarna and, if you ask for it, saving your card for future purchases. Stripe receives the data needed to process the payment: first and last name, email, phone number, billing and delivery address, amount, currency and order number and, if you have an Account, your username; in addition, the card details entered in the Stripe form or the BLIK code, and technical device data (e.g. IP address). When processing payments Stripe acts on our behalf, and for its own purposes - including fraud prevention and compliance with legal obligations - as a separate controller (Stripe Privacy Policy). On your first payment via Stripe - including guest purchases - we create a Stripe customer profile with your name, email, phone number and address (and, if you have an Account, your username); it is updated on later purchases from your Account (Art. 6(1)(b) GDPR). When you pay with Przelewy24 or Klarna, Stripe passes the data needed for the payment to PayPro S.A. or Klarna Bank AB (publ) respectively, described below.
  • Przelewy24 payment operator - PayPro S.A., ul. Pastelowa 8, 60-198 Poznań, Poland - when you pay with Przelewy24, either via Stripe or directly (if this option is available in the shop; in that case PayPro also handles BLIK and card payments). PayPro receives the data needed for the payment (including first and last name, email, amount and transaction description) and processes it as a separate controller, under the Przelewy24 information notice (in Polish).
  • Klarna - Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, registration no. 556737-0431 - if you choose to pay with Klarna. Via Stripe we share with Klarna the data needed to conclude and perform your agreement with Klarna: first and last name, email, phone number, billing and delivery address, amount, currency and order number and, where necessary, information about refunds and disputes relating to that payment (e.g. shipping details). Basis: Art. 6(1)(b) GDPR (the payment method you chose under the sales contract) and, for refunds and disputes, also Art. 6(1)(f) GDPR - our legitimate interest in settling refunds and defending against claims and disputes concerning the payment. Klarna processes this data - and the data you provide directly to Klarna - as a separate controller, including to verify your identity, assess your creditworthiness (also using credit reference and business information bureaus) and prevent fraud. Details, including the contact of Klarna’s data protection officer (odo@klarna.pl), are in Klarna’s privacy policy (in Polish).
  • Apple Pay and Google Pay - if you pay with a digital wallet, you use the Apple or Google service under your own agreement with that provider; the wallet provider processes data in accordance with its own privacy policy.
  • Carriers - InPost Sp. z o.o. (parcel lockers) and InPost Sp. z o.o. (courier) and, for shipments abroad, DPD Polska Sp. z o.o. and a partner in the DPD network in the destination country - delivery of orders; we pass on the name, address, phone number and email needed for delivery.
  • Hosting and email providers - WP Engine Poland Sp. z o.o. (hosting and storing the shop's data; as part of this service, traffic to the shop passes through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which speeds up page loading and protects the shop against attacks and bots, processing e.g. your IP address and technical browser data) and LH.PL Sp. z o.o. (handling email correspondence).
  • Accounting office - Woźniak Księgowość i Doradztwo Sp. z o.o., ul. Jana Kazimierza 4, 62-400 Słupca, NIP 667-178-15-65, REGON 389832348 - bookkeeping and tax services (processing order and invoice data for accounting and tax purposes).
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) - only with your consent to analytics cookies: Google Tag Manager (the tool we use to manage scripts in the shop; your browser downloads it from Google’s servers only after you consent) and Google Analytics 4, run through Google Tag Manager and the Google Site Kit plugin. Google receives the data described under “Analytics”, including your IP address and technical browser data. For Google Analytics, Google processes the data on our behalf as a processor (under Google’s data processing terms) and, to the extent it uses the data for its own purposes (e.g. maintaining and protecting its services), as a separate controller. More: Google Privacy Policy.
  • Google - reCAPTCHA service (Google Cloud) - protecting the contact form against spam (see “Protecting the contact form against spam”). Google receives the data described there, including your IP address and technical browser data, and processes it on our behalf as a processor - under the Google Cloud Terms of Service and the Cloud Data Processing Addendum - only to the extent needed to provide and secure the service.
  • Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) - Microsoft Clarity, only with your consent to analytics cookies. Microsoft receives the usage data described under “Analytics”. We and Microsoft are joint controllers (Art. 26 GDPR) for collecting this data in the shop and transmitting it to Microsoft: we are responsible for obtaining your consent and informing you about the processing, and Microsoft for processing the data in the Clarity service. You can exercise your rights against us or against Microsoft. To the extent Microsoft uses the data for its own purposes (e.g. improving its services), it acts as a separate controller, under the terms of the Microsoft Privacy Statement. We do not give Microsoft consent to use the data for advertising.
  • Public authorities - courts, tax or law enforcement authorities, where the law obliges us to do so.

Transfers outside the European Economic Area

As a rule, we process your data within the European Economic Area. The exceptions are payments via Stripe - Stripe Payments Europe, Limited may transfer data to Stripe, LLC in the United States - Google tools (Google reCAPTCHA on the contact form and, with your consent, Google Tag Manager and Google Analytics) - Google may transfer data to Google LLC in the United States - Microsoft Clarity (with your consent) - Microsoft may transfer data to Microsoft Corporation in the United States - and the Cloudflare network through which traffic to the shop passes - data may be processed by Cloudflare, Inc. in the United States. These transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, which Stripe, LLC, Google LLC, Microsoft Corporation and Cloudflare, Inc. have joined, and additionally on the standard contractual clauses approved by the European Commission. Klarna, as a separate controller, may transfer data outside the EEA under the terms described in its privacy policy. In any other case, a transfer outside the EEA would only take place under the standard contractual clauses approved by the European Commission - and we would inform you of it in this policy.

How long we keep your data

  • Orders - for the duration of the contract and then for 5 years from the end of the calendar year in which the tax payment deadline expired (accounting records), but no shorter than until the limitation period for claims under the sales contract has expired. A Stripe customer profile created for a guest purchase is kept for the same period.
  • Complaints and returns - until the complaint or return procedure is closed, and then until the limitation period for claims has expired.
  • Contact - until the matter is closed, and then for 12 months in case of follow-up questions; if you object earlier (Art. 21 GDPR) - until your objection is upheld.
  • Customer account - until you ask us to delete the account; data of orders placed from the account is kept for the period stated above; when you delete your Account we also delete your Stripe customer profile.
  • Saved card - until you delete the card, withdraw your consent or delete your Account, whichever comes first.
  • Server logs and technical data - for the period needed to ensure security, no longer than 12 months.
  • Contact form protection (reCAPTCHA) - we do not store the reCAPTCHA assessment: it is used only to accept or reject a message at the moment it is sent, and we do not keep messages rejected as spam either. Google keeps the data processed in the reCAPTCHA service on our behalf only for as long as needed to provide and secure the service, under the Google Cloud terms; the _GRECAPTCHA cookie expires after 6 months.
  • Analytics and marketing data - until you withdraw your consent, but no longer than the retention period of the tool concerned (Microsoft Clarity - session recordings 30 days, recordings marked or randomly sampled for analysis up to 9 months; Google Analytics - up to 14 months). The source of your visit (WooCommerce order attribution) is kept in your browser until the end of the visit and, once attached to an order, for as long as the order data.
  • Cookie consent record - for 3 years from when your choice is saved. The choice remembered in your browser expires after 12 months at the latest - we will then ask you again (and earlier if we change the tools or purposes we ask you to consent to).

After these periods, we delete or anonymise the data.

Your rights

In connection with the processing of your data, you have the right to:

  • access your data and obtain a copy of it (Art. 15 GDPR),
  • rectification of your data (Art. 16 GDPR),
  • erasure - the "right to be forgotten" (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • portability of the data we process on the basis of a contract or consent (Art. 20 GDPR),
  • object to processing based on our legitimate interest (Art. 21 GDPR),
  • withdraw consent at any time - without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).

To exercise your rights, write to us at hello@effy.com.pl. We will reply without undue delay and in any event within one month. If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

Do you have to provide your data?

Providing your data is voluntary but necessary to place an order, create an account or receive a reply to your message. Without address details we cannot deliver your parcel, and without an email address we cannot confirm your order. Providing a phone number makes it easier for the carrier to deliver the parcel.

Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not build a profile of your interests to tailor ads. The contact form uses Google reCAPTCHA’s automated assessment: messages assessed as spam (or sent without that assessment, e.g. when your browser blocks reCAPTCHA) are rejected automatically. This does not limit your ability to contact us - if your message is not sent, email us directly at hello@effy.com.pl. Payment operators may automatically assess transaction risk to prevent fraud - they do so as separate controllers, under the terms described in their own privacy policies. If you choose to pay with Klarna, Klarna - as a separate controller - decides by automated means, among other things, whether to offer you the selected payment option (creditworthiness assessment, identity verification, fraud risk). In respect of such a decision you have the rights you hold against Klarna, including the right to obtain human intervention, to express your point of view and to contest the decision (odo@klarna.pl).

Data security

The connection to the shop is encrypted (SSL/TLS). Payments are handled by the certified operator Stripe and, for selected methods, also by PayPro S.A. (Przelewy24) and Klarna. The full card number and CVC go only to the operator - we never see or store them. If you save a card to your Account, in connection with it we store only its identifier (token) issued by Stripe, the card brand, the last 4 digits and the expiry date. Customer account passwords are stored in encrypted form, and only people who need it to handle orders have access to your data.

Cookies

Cookies are small text files stored in your browser. We use cookies that are essential for the shop to work - the ones without which the cart, account login, remembering your chosen language or your cookie choice would not function, as well as cookies that protect the shop against bots and attacks (Cloudflare), secure payments (Stripe) and protect the contact form against spam (Google reCAPTCHA - loaded only when you start filling in the form). Under Art. 399(3)(2) of the Polish Electronic Communications Law of 12 July 2024, cookies necessary to provide a service you request do not require your consent; any personal data processed in connection with them is processed on the basis of Art. 6(1)(f) GDPR.

Only with your consent do we also use analytics cookies and similar technologies (Microsoft Clarity and Google Analytics 4, run through Google Tag Manager and the Google Site Kit plugin) and marketing cookies (WooCommerce order attribution). The scripts of these tools - including Google Tag Manager - are loaded only after you consent. On your first visit you will see a banner where you can accept all cookies, reject all or choose categories under “Settings”. Refusing is as easy as accepting and does not limit your ability to shop. You can change your choice or withdraw consent at any time - click “Cookie settings” in the shop footer (on pages without a footer - the button in the corner of the screen). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal; after you withdraw it, we delete the cookies of that category’s tools stored on the shop’s domain and the page reloads without them (cookies stored on the providers’ domains, e.g. Microsoft’s, can be deleted in your browser settings). We remember your choice for up to 12 months - then we will ask again.

The cookies used by the shop:

WordPress (shop software)

  • wordpress_test_cookie - checks whether your browser accepts cookies (set when logging in). Lifetime: until you close the browser.
  • wordpress_logged_in_*, wordpress_sec_* - keep you logged in to your customer account. Lifetime: until you close the browser, or 14 days with "Remember me". Logged-in users only.
  • wp-settings-*, wp-settings-time-* - remember the interface settings of a logged-in user. Lifetime: 1 year. Logged-in users only.

WooCommerce (cart and orders)

  • wp_woocommerce_session_* - the identifier of your shopping session, which lets the cart remember the products you added. Lifetime: 2 days (7 days for logged-in users).
  • woocommerce_cart_hash, woocommerce_items_in_cart - indicate that there are products in the cart and allow it to refresh. Lifetime: until you close the browser.
  • woocommerce_recently_viewed - the list of recently viewed products; set only when the "recently viewed" feature is enabled in the shop. Lifetime: until you close the browser.

Polylang (language versions)

  • pll_language - remembers the language version of the shop you chose (PL/EN). Lifetime: 1 year.

Cookie consent (essential)

  • effy_consent - remembers your cookie choice (scope of consent, date and a random consent identifier). Lifetime: up to 12 months.

Cloudflare (shop protection - essential)

  • __cf_bm - tells human visitors from automated bots and protects the shop against attacks; set by Cloudflare, Inc., whose network carries traffic to the shop. Lifetime: 30 minutes.

Stripe (payments)

  • __stripe_mid, __stripe_sid - set by the Stripe script on the checkout page (and other pages where you can pay via Stripe) to prevent fraud and process the payment securely. Provider: Stripe Payments Europe, Limited. Lifetime: __stripe_mid - 1 year, __stripe_sid - 30 minutes. More: Stripe Cookie Policy.

Google reCAPTCHA (contact form protection - essential)

  • _GRECAPTCHA - stored on the google.com domain when you start filling in the contact form; used for risk analysis and to tell humans from bots. When reCAPTCHA loads, your browser may also send Google cookies previously stored in it (e.g. NID) to Google, if its settings allow; reCAPTCHA may also save a _grecaptcha entry in your browser’s storage (local storage). Provider: Google (reCAPTCHA service in Google Cloud, acting on our behalf). Lifetime: 6 months.

Microsoft Clarity (analytics - only with consent)

  • _clck, _clsk - Microsoft Clarity user and session identifiers (statistics, heatmaps, session recordings). Provider: Microsoft Ireland Operations Limited. Lifetime: _clck - 1 year, _clsk - 1 day.
  • CLID, MUID, MR, SM, ANONCHK - Microsoft cookies stored on Microsoft domains (e.g. clarity.ms, bing.com) to recognise the browser across Microsoft services; Microsoft is responsible for them as a controller and may also use them for its own purposes, under the terms of the Microsoft Privacy Statement. Lifetime: up to 1 year.

Google Analytics 4 (analytics - only with consent)

  • _ga, _ga_* - distinguish users and sessions in Google Analytics. Provider: Google Ireland Limited. Lifetime: up to 2 years.

WooCommerce order attribution and Google (marketing - only with consent)

  • sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_session, sbjs_udata, sbjs_migrations - remember where you came to the shop from (referring website, search engine, campaign), the landing page, the number of pages viewed during the current visit and your browser type; when you place an order, this information is attached to it. Provider: EFFY (WooCommerce). Lifetime: until you close the browser, sbjs_session - 30 minutes.
  • _gcl_au, _gcl_aw - may be stored by Google’s script (Google Analytics), e.g. when you arrive from a Google ad; they link the visit to the ad click. Provider: Google Ireland Limited. Lifetime: 90 days.

How to manage cookies

You can change your consent to analytics and marketing cookies at any time under “Cookie settings” in the shop footer (on pages without a footer - with the button in the corner of the screen). You can also delete or block cookies in your browser settings. Keep in mind that blocking essential cookies will prevent you from placing an order - the cart and login will not work, and blocking Google reCAPTCHA will prevent you from sending the contact form (you can then email us at hello@effy.com.pl). Instructions for the most popular browsers:

Changes to this policy

This policy applies from 1 September 2026. Last updated: 30 October 2026. We may update it when the law, the way the shop works or the tools we use change. The current version is always available on this page, and we will notify you of significant changes by email if you have an account with us. The shopping rules are set out in the Terms & Conditions, and information about returns under Returns & Complaints.

This English version is provided for convenience; in case of discrepancies the Polish version prevails.