Effective date: 12 October 2026

This Policy explains who is responsible for your personal data when you use minellestudio.pl (the “Website”), what data we collect, why we use it, who we share it with and what rights you have. It applies to visitors, customers and people who contact us or interact with Minelle Studio on social media.

§1. Data controller

  1. The controller of your personal data is Magdalena Biesok, running Minelle Studio as an unregistered business activity (działalność nierejestrowana) under Polish law (“we”, “us”).
  2. Contact in all matters related to personal data: magda@minellestudio.pl
  3. We have not appointed a Data Protection Officer.
  4. Our Terms & Conditions are available at: https://minellestudio.pl/terms-conditions/

§2. What data we process, why, and on what legal basis

a) Placing an order

  • Data: first name, last name, country, email address, order notes (optional), order details (products, price, currency, date), payment status.
  • Purpose: concluding and performing the sales contract, delivering digital products, customer service.
  • Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Providing this data is required to place an order.
  • We do not receive or store your full card details – payments are processed directly by the payment providers listed in section 4.

b) Accounting and tax obligations

  • Data: order and payment data.
  • Legal basis: Art. 6(1)(c) GDPR (legal obligation under Polish tax and accounting law).

c) Customer account (if you create one)

  • Data: name, email address, login, order history.
  • Legal basis: Art. 6(1)(b) GDPR. You can delete your account at any time.

d) Contact form and email

  • Data: name, email address and any information you include in your message.
  • Purpose: answering your message.
  • Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in responding to you).

e) Complaints and withdrawals

  • Legal basis: Art. 6(1)(c) GDPR (consumer law obligations) and Art. 6(1)(f) GDPR.

f) Social media (Instagram, Facebook, Pinterest)

  • Data: your public profile name, comments, likes and messages.
  • Purpose: running our brand profiles, communicating with you and sending you the links you ask for. When you comment a keyword under our Instagram posts, an automated message with the requested link is sent to you via ManyChat.
  • Legal basis: Art. 6(1)(f) GDPR. For page statistics (Insights) we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR).

g) Website statistics

  • Tools: Google Analytics (via MonsterInsights) and Jetpack Stats.
  • Purpose: understanding how the Website is used and improving it.
  • Legal basis: Art. 6(1)(a) GDPR (your consent to analytics cookies); for basic, aggregated Jetpack statistics – Art. 6(1)(f) GDPR.

h) Advertising and measuring ads (Meta Pixel and Conversions API)

  • We use Meta Pixel and the Meta Conversions API (through the PixelYourSite plugin) to show ads on Instagram and Facebook to people who visited our Website, to reach similar audiences and to measure which ads lead to purchases.
  • What is sent to Meta: events such as page views, product views, add to cart and purchase (with product, value and currency), technical data (IP address, browser information, Meta cookie identifiers) and – for the Conversions API – your email address, name and country in hashed (encrypted) form. The Conversions API sends this information from our server rather than from your browser.
  • Legal basis: Art. 6(1)(a) GDPR – only if you accept advertising (marketing) cookies. You can withdraw consent at any time (see section 3).

i) Security, backups and legal claims

  • Purpose: protecting the Website, making backups, establishing or defending legal claims.
  • Legal basis: Art. 6(1)(f) GDPR.

§3. Cookies and your consent

  1. Cookies are small text files saved on your device when you visit the Website.
  2. We use the CookieYes consent banner. On your first visit you can accept all cookies, reject non-essential cookies or choose categories. You can change your choice at any time using the cookie settings button visible on the Website.
  3. Categories we use:
    • Necessary – required for the shop, cart, checkout, security and remembering your cookie choice (e.g. WooCommerce session cookies, the CookieYes consent cookie, Stripe fraud-prevention cookies). These do not require consent.
    • Analytics – help us understand traffic (e.g. Google Analytics: _ga, ga*). Used only with your consent.
    • Advertising – used for Meta ads, remarketing and measuring ad results (e.g. _fbp, _fbc). Used only with your consent.
  4. You can also block or delete cookies in your browser settings. Blocking necessary cookies may prevent the shop from working properly.

§4. Who receives your data

We share data only as far as needed, with:

  • Hosting and website service providers – the company hosting the Website, and Automattic Inc. (WooCommerce, WooPayments, Jetpack).
  • Payment providers – Stripe (card payments, Apple Pay, Google Pay and Przelewy24 processed via WooPayments), PayPal (Europe) S.à r.l. et Cie, S.C.A., and our bank for bank transfers. Payment providers act as independent controllers under their own privacy policies.
  • Google Ireland Ltd. – Google Analytics (with your consent).
  • Meta Platforms Ireland Ltd. – Instagram, Facebook, Meta Pixel and Conversions API (advertising only with your consent).
  • ManyChat Inc. – automated Instagram messages.
  • Backup storage provider used by our backup plugin.
  • Public authorities, when required by law.

If you buy our products on Etsy, Etsy is the controller of the data processed on its platform under its own privacy policy.

§5. Transfers outside the European Economic Area

Some providers (Google LLC, Meta Platforms Inc., Stripe Inc., Automattic Inc., ManyChat Inc.) may process data in the USA. Such transfers are based on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) where the recipient is certified, and otherwise on the Standard Contractual Clauses approved by the European Commission.

§6. How long we keep data

  • Order and accounting data – 5 years from the end of the calendar year in which the tax obligation arose (Polish tax law), and until any claims expire.
  • Messages and contact form data – until the matter is resolved, then up to the limitation period for possible claims.
  • Customer account – until you delete the account.
  • Data processed on the basis of consent – until you withdraw it (cookies expire according to their lifetime).
  • Social media data – as long as it remains on the platform or until you delete it.

§7. Your rights

You have the right to:

  • access your data and receive a copy,
  • rectify (correct) your data,
  • erasure (“right to be forgotten”),
  • restrict processing,
  • data portability,
  • object to processing based on our legitimate interest – including at any time to processing for marketing purposes,
  • withdraw consent at any time – this does not affect the lawfulness of processing carried out before withdrawal.

To use these rights, email magda@minellestudio.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl) or with the data protection authority in the EU country where you live.

§8. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects. If you consent to advertising cookies, Meta may use the collected information to personalise the ads you see.

§9. Security

The Website uses an SSL-encrypted connection. We use technical and organisational measures appropriate to the risk, including regular updates and backups.

§10. Children

Our products are intended for adults planning their weddings. We do not knowingly collect data from children under 16.

§11. Changes to this Policy

We may update this Policy when our services, tools or the law change. The current version is always available on this page with its effective date.