Privacy policy

PRIVACY POLICY OF LOVINGLY MADE

1. Data Controller The controller of your personal data is Anita Wójcik, conducting business under the name Anita Wójcik, NIP: 6612226885, ul. Michała Kleofasa Ogińskiego 2, 27-400 Ostrowiec Świętokrzyski, Poland. Contact: anita1888@o2.pl

2. Data Protection Officer We are not required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR, as we are not a public authority, do not carry out large-scale systematic monitoring of individuals, and do not process special categories of data on a large scale. For all data protection matters, please contact us directly at: anita1888@o2.pl

3. What Data We Collect We collect the following personal data when you place an order or contact us: first and last name, delivery address, e-mail address, phone number (if provided), payment data (processed by the payment operator — we do not store card details), IP address and browsing data (via cookies).

4. Purposes and Legal Basis for Processing

  • Order fulfilment and contract performance: Art. 6(1)(b) GDPR
  • Accounting and legal obligations: Art. 6(1)(c) GDPR
  • Customer service and complaints: Art. 6(1)(b) GDPR
  • Marketing communications (if consented): Art. 6(1)(a) GDPR
  • Fraud prevention and security: Art. 6(1)(f) GDPR (legitimate interest)

5. Automated Decision-Making and Profiling We do not use automated decision-making or profiling that produces legal or similarly significant effects on you, as referred to in Art. 22 GDPR.

6. Data Retention

  • Order data: 5 years from the end of the tax year (accounting obligations).
  • Complaint data: until resolved and the limitation period expires.
  • Marketing data: until you withdraw your consent.

7. Recipients of Your Data Your data may be shared with: delivery carriers (InPost, DPD, DHL), payment operators — PayPro S.A. (Przelewy24), Shopify Payments, Shopify Inc. (e-commerce platform provider, under Shopify's Data Processing Agreement), accounting and legal service providers (under confidentiality obligations). We do not sell your personal data to third parties.

8. International Data Transfers Your data may be transferred outside the EEA to Shopify Inc. (Canada/USA) under Standard Contractual Clauses approved by the European Commission.

9. Your Rights Under GDPR, you have the right to: access, rectify, erase, restrict processing, data portability, object to processing based on legitimate interest, withdraw consent at any time, and lodge a complaint with the supervisory authority — President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw. Contact us at anita1888@o2.pl; we respond within 30 days (extendable by 60 days for complex cases).

10. Personal Data Breach Notification In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the President of UODO within 72 hours of becoming aware of the breach (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay (Art. 34 GDPR).

11. Cookies Our Store uses: necessary cookies (Store functioning), analytical cookies (e.g. Google Analytics — traffic analysis), marketing cookies (personalised content and ads — if consented). You can manage cookie preferences via your browser settings or the cookie consent banner on our website.

12. Changes to This Privacy Policy We reserve the right to update this Privacy Policy. Changes will be published on this page with an updated effective date. Last updated: May 2026.