Privacy Policy

PRIVACY POLICY OF THE ONLINE STORE WWW.MALUASHOP.COM

Last updated: August 5, 2026

§ 1 GENERAL PROVISIONS

  1. The controller of personal data collected via the online Store www.maluashop.com is DOUBLE M SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, entered in the Register of Entrepreneurs by the SĄD REJONOWY W GLIWICACH, X WYDZIAŁ GOSPODARCZY KRAJOWEGO REJESTRU SĄDOWEGO, under KRS number: 0001009002, share capital paid up in full: PLN 5,000.00, place of business and address for correspondence: ul. Tadeusza Kościuszki 38/4, 44-100 Gliwice, Poland, NIP: 6312709651, REGON: 523961476, email address: hello@maluashop.com, telephone number: +48 506 855 877, hereinafter referred to as the "Controller" and being at the same time the "Service Provider".
  2. Personal data collected by the Controller via the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.
  3. All words or expressions written with a capital letter in this Privacy Policy are to be understood in accordance with their definitions set out in the Terms & Conditions of the online Store www.maluashop.com.

§ 2 TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

  1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes the personal data of Users of the Store www.maluashop.com in the case of:
    1. registration of an Account in the Store, for the purpose of creating an individual account and managing that Account, on the basis of art. 6(1)(b) GDPR (performance of a contract for the provision of services by electronic means in accordance with the Store Terms & Conditions),
    2. placing an order in the Store, for the purpose of performing the sales agreement, on the basis of art. 6(1)(b) GDPR (performance of the sales agreement),
    3. subscribing to the Newsletter for the purpose of sending commercial information by electronic means. Personal data is processed after separate consent has been given, on the basis of art. 6(1)(a) GDPR,
    4. use of the Review System, for the purpose of learning the Customer's opinion about the Sales Agreement concluded with the Controller, on the basis of art. 6(1)(f) GDPR (legitimate interest of the entrepreneur),
    5. use of the Contact Form, for the purpose of sending a message to the Controller, on the basis of art. 6(1)(f) GDPR (legitimate interest of the entrepreneur),
    6. fulfilment of legal obligations incumbent on the Controller, arising in particular from tax law, accounting law, consumer protection law and other provisions governing the conduct of business activity, on the basis of art. 6(1)(c) GDPR (processing necessary for compliance with a legal obligation to which the controller is subject).
  2. TYPE OF PERSONAL DATA PROCESSED. The User provides, in the case of:
    1. an Account: first name and surname, login, residential address, email address.
    2. an Order: first name and surname, address, NIP (tax identification number), email address, telephone number.
    3. the Newsletter: first name, email address.
    4. the Review System: first name,
    5. the Contact Form: first name, email address, telephone number.
  3. PERIOD OF PERSONAL DATA RETENTION. The personal data of Users is stored by the Controller:
    1. where the basis for processing the data is the performance of a contract, for as long as is necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodic payments and claims connected with the conduct of business activity, three years.
    2. where the basis for processing the data is consent, for as long as the consent has not been withdrawn, and after the withdrawal of consent for a period corresponding to the limitation period for claims that the Controller may raise and that may be raised against the Controller. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodic payments and claims connected with the conduct of business activity, three years.
  4. When using the Store, additional information may be collected, in particular: the IP address assigned to the User's computer or the external IP address of the internet provider, the domain name, the browser type, the access time, and the operating system type.
  5. After separate consent has been given, on the basis of art. 6(1)(a) GDPR, data may also be processed for the purpose of sending commercial information by electronic means or making telephone calls for the purpose of direct marketing, respectively in connection with art. 398(1) and (2) of the Act of 12 July 2024, Electronic Communications Law, including communications directed as a result of profiling, provided that the User has given the relevant consent.
  6. As part of the User's activity in the Store, profiling may take place, the purpose of which is to select appropriate advertising content to be directed to the User.
  7. Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Profiling does not produce legal effects concerning the User or similarly significantly affect their situation. Its sole purpose is to better match marketing content and offers.
  8. Navigation data may also be collected from Users, including information about links and references that they choose to click on, or other activities undertaken in the Store. The legal basis for this type of activity is the legitimate interest of the Controller (art. 6(1)(f) GDPR), consisting in facilitating the use of services provided by electronic means and improving the functionality of those services.
  9. The provision of personal data by the User is voluntary.
  10. The Controller exercises particular care to protect the interests of the data subjects, and in particular ensures that the data it collects is:
    1. processed lawfully,
    2. collected for specified, lawful purposes and not subjected to further processing incompatible with those purposes,
    3. substantively correct and adequate in relation to the purposes for which it is processed, and stored in a form permitting identification of the data subjects for no longer than is necessary to achieve the purpose of processing.

§ 3 DISCLOSURE OF PERSONAL DATA

  1. The personal data of Users is transferred to the service providers used by the Controller in operating the Store, and in particular to:
    1. entities carrying out the delivery of Products,
    2. payment system providers,
    3. providers of review survey systems,
    4. the accounting office,
    5. the hosting provider,
    6. the provider of software enabling the conduct of business activity,
    7. entities providing the mailing system,
    8. the provider of software required to operate the online store,
    9. public entities processing data in connection with the Controller's legal obligation, including the ministry of finance operating the KSeF system.
  2. The service providers referred to in point 1 of this paragraph, to whom personal data is transferred, depending on the contractual arrangements and circumstances, either follow the Controller's instructions as to the purposes and means of processing that data (processors), or determine the purposes and means of processing themselves (controllers).
  3. The personal data of Users is stored exclusively within the European Economic Area (EEA), subject to § 5 point 5 and § 6 of the Privacy Policy.
  4. Personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, in connection with the Controller's use of the services of providers of analytical and marketing tools (e.g. Google LLC, Meta Platforms Inc., Microsoft Corporation). The transfer of data takes place on the basis of Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with art. 46(2)(c) GDPR.

§ 4 RIGHT OF CONTROL, ACCESS TO ONE'S OWN DATA AND ITS RECTIFICATION

  1. The data subject has the right of access to the content of their personal data and the right to rectify, erase and restrict the processing of that data, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
  2. Legal bases for the User's request:
    1. Access to data, art. 15 GDPR.
    2. Rectification of data, art. 16 GDPR.
    3. Erasure of data (the so-called right to be forgotten), art. 17 GDPR.
    4. Restriction of processing, art. 18 GDPR.
    5. Data portability, art. 20 GDPR.
    6. Objection, art. 21 GDPR.
    7. Withdrawal of consent, art. 7(3) GDPR.
  3. In order to exercise the rights referred to in point 2, an appropriate email message may be sent to: hello@maluashop.com.
  4. Where the User exercises a right arising from the above entitlements, the Controller shall satisfy the request or refuse to satisfy it without undue delay, and no later than within one month of its receipt. However, if, due to the complex nature of the request or the number of requests, the Controller is unable to satisfy the request within one month, it shall satisfy it within the following two months, having informed the User beforehand, within one month of receiving the request, of the intended extension of the deadline and the reasons for it.
  5. Where it is found that the processing of personal data infringes the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

§ 5 "COOKIES"

  1. The Controller's website uses "cookies".
  2. The installation of "cookies" is necessary for the proper provision of services on the Store's website. "Cookies" contain information necessary for the proper functioning of the website, and they also make it possible to compile general statistics on website visits.
  3. Two types of "cookies" are used on the website: "session" and "persistent".
    1. "Session" "cookies" are temporary files that are stored on the User's end device until logging out (leaving the website).
    2. "Persistent" "cookies" are stored on the User's end device for the period specified in the parameters of the "cookies" or until they are deleted by the User.
  4. The Controller uses its own cookies in order to better understand how Users interact with the content of the website. The files collect information about how the User uses the website, the type of page from which the User was redirected, and the number of visits and the duration of the User's visit to the website. This information does not record the User's specific personal data, but serves to compile statistics on the use of the website.
  5. The Controller also uses external cookies in order to collect general and anonymous statistical data by means of the analytical tools Google Analytics (controller of the external cookie: Google LLC, established in the USA) and Microsoft Clarity, which serves to analyse how the website is used, including the creation of heat maps (heatmaps) and the recording of the course of the User's session on the website (controller of the external cookie: Microsoft Corporation, established in the USA).
  6. Cookies may also be used by advertising networks, in particular the Google network, in order to display advertisements matched to the way in which the User uses the Store. For this purpose, they may retain information about the User's navigation path or the time spent on a given page.
  7. The User has the right to decide on the access of "cookies" to their computer by:
    1. selecting the types of cookies to the collection of which they consent, immediately after entering the Store's website and the appearance of the cookie message,
    2. changing the settings in their browser window. Detailed information about the possibilities and methods of handling "cookies" is also available in the software settings (internet browser).

§ 6 ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

  1. The Store uses so-called social plugins ("plugins") of social networking services. When displaying the website www.maluashop.com containing such a plugin, the User's browser will establish a direct connection with the servers of Facebook, Instagram, Pinterest, YouTube and Google.
  2. The content of the plugin is transmitted by the given service provider directly to the User's browser and integrated with the website. Thanks to this integration, the service providers receive the information that the User's browser has displayed the website www.maluashop.com, even if the User does not have a profile with the given service provider or is not logged in with them at the time. Such information (together with the User's IP address) is transmitted by the browser directly to the server of the given service provider (some servers are located in the USA) and stored there.
  3. If the User logs in to one of the above social networking services, that service provider will be able to directly assign the visit to the website www.maluashop.com to the User's profile on that social networking service.
  4. If the User uses a given plugin, for example by clicking the "Like" button or the "Share" button, the relevant information will also be transmitted directly to the server of the given service provider and stored there.
  5. The purpose and scope of data collection and its further processing and use by the service providers, as well as the possibility of contact and the User's rights in this respect and the possibility of making settings to protect the User's privacy, are described in the service providers' privacy policies:
    1. https://www.facebook.com/policy.php
    2. https://help.instagram.com/519522125107875?helpref=page_content
    3. https://policy.pinterest.com/pl/privacy-policy
    4. https://www.youtube.com/howyoutubeworks/privacy/
    5. https://policies.google.com/privacy?hl=pl&gl=ZZ
  6. If the User does not want social networking services to assign the data collected during their visit to the website www.maluashop.com directly to their profile on the given service, then before visiting the website www.maluashop.com they must log out of that service. The User may also completely prevent the plugins from loading on the website by using appropriate browser extensions, for example blocking scripts by means of "NoScript".
  7. The Controller uses remarketing tools on its website, namely Google Ads, which involves the use of Google LLC cookies relating to the Google Ads service. Within the mechanism for managing cookie settings, the User has the option to decide whether the Service Provider will be able to use Google Ads (controller of the external cookie: Google LLC, established in the USA) in relation to them.

§ 7 FINAL PROVISIONS

  1. The Controller applies technical and organisational measures ensuring the protection of the personal data processed, appropriate to the risks and the categories of data covered by the protection, and in particular secures the data against being made available to unauthorised persons, being taken by an unauthorised person, being processed in breach of the applicable provisions, and being altered, lost, damaged or destroyed.
  2. The Controller provides appropriate technical measures preventing unauthorised persons from obtaining and modifying personal data transmitted by electronic means.
  3. In matters not governed by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law shall apply accordingly.
  4. The Controller updates this Privacy Policy in connection with legal changes or the development of its business. Information about a modification of the Privacy Policy will be published at least 7 days before it comes into force on the Store's website, or sent by email to the User who uses Electronic Services provided on a continuous basis (Account, Newsletter).

Customers are saying

4.75 ★ (101)
Verified