Privacy Policy of the Online Store Mamatu
mamatushop.com
Privacy and Cookies Policy effective as of 19 June 2026.
Dear User,
We care about your privacy and want you to feel comfortable when using our Store. Below you will find the most important information about how we process your personal data and how we use cookies and similar technologies in the Mamatu online store. This information has been prepared taking into account the GDPR and applicable rules on electronic communications.
Note: This Policy combines privacy information and cookies information. The Store uses a cookie consent banner that allows users to manage consent for analytics and marketing cookies.
1. Data Controller
The controller of your personal data is apconcept Anna Przeracka-Byskosz, an entrepreneur entered in the Polish Central Register and Information on Business Activity, NIP: 9251842379, REGON: 146386503, address: ul. Kosynierów Gdyńskich 74/2, 51-687 Wrocław, Poland.
You may contact the Controller in matters concerning personal data:
- by e-mail: sklep@mamatu.pl,
- by phone: +48 500 835 853,
- by post: ul. Kosynierów Gdyńskich 74/2, 51-687 Wrocław, Poland.
This Policy applies to the online store available at mamatushop.com.
2. Your rights
In connection with the processing of your personal data, you have the rights set out in the GDPR, including the right to request:
- access to your personal data, including a copy of your data,
- rectification of your data,
- erasure of your data,
- restriction of processing,
- data portability to another controller, where applicable.
You also have the right to:
- object to processing based on the Controller’s legitimate interest, for reasons related to your particular situation,
- object to processing for direct marketing purposes, including profiling related to such marketing,
- withdraw your consent at any time where processing is based on consent; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
To exercise your rights, please contact the Controller. You may also object to the use of cookies by changing your settings in the cookie banner or in your browser.
If you believe that your data is processed unlawfully, you may lodge a complaint with the supervisory authority. In Poland, this authority is the President of the Personal Data Protection Office.
3. Personal data and privacy
Below you will find detailed information on how your data is processed depending on the activity you undertake.
3.1. Placing and fulfilling an order
Purpose: Processing and fulfilling your order, concluding and performing the sales contract, accepting payment, preparing and delivering the product, handling the purchase of a Voucher/Gift Card, issuing sales documents and handling order-related communication.
Legal basis: Article 6(1)(b) GDPR – performance of a contract or pre-contractual steps; Article 6(1)(c) GDPR – legal obligations, in particular tax, accounting and consumer-law obligations; Article 6(1)(f) GDPR – legitimate interest in establishing, pursuing or defending claims.
Retention period: For the duration of the contract, then for the period required by law and until the expiry of limitation periods for claims.
If you do not provide data: You will not be able to place and complete an order.
3.2. Payments
Purpose: Handling payments, identifying payments, refunds, settlements and fraud prevention.
Payment methods: Traditional bank transfer, electronic payment, payment card, PayPal and cash on delivery – according to the methods actually available in the Store when placing an order.
Recipients: Banks, payment operators, in particular Przelewy24 and PayPal, and other providers handling the payment method selected by you.
Legal basis: Article 6(1)(b), (c) and (f) GDPR.
3.3. Delivery of orders
Purpose: Delivering the order, handling shipments, returns and delivery-related complaints.
Recipients: The operator of the BL Paczka service and carriers handling shipments through that service, in particular DPD, DHL and Orlen Paczka, as well as InPost, UPS and Poczta Polska – depending on the delivery method selected. For deliveries outside the EEA, data may also be transferred to carriers, postal operators or customs/logistics partners necessary to deliver the order.
Legal basis: Article 6(1)(b) GDPR – performance of the contract; Article 6(1)(f) GDPR – handling claims and complaints related to delivery.
Retention period: For the time necessary to deliver the order, and then until the expiry of limitation periods for claims or for the period required by law.
3.4. Customer Account
Purpose: Creating and maintaining a customer account, enabling order history, order status preview, saved addresses, coupons, vouchers and other customer panel functions.
Legal basis: Article 6(1)(b) GDPR – performance of the account service agreement.
Retention period: For as long as the account exists, and then until the expiry of limitation periods for claims.
If you do not provide data: You will not be able to create an account and use its functions. Purchases may be possible without an account if such option is available in the Store.
3.5. Contact with us
Purpose: Handling enquiries, correspondence, contact form messages, telephone contact and other requests.
Legal basis: Article 6(1)(b) GDPR – where the contact relates to a contract or pre-contractual steps; Article 6(1)(f) GDPR – legitimate interest in communicating with you and handling requests.
Retention period: For the time necessary to handle the request, and then until the expiry of limitation periods for claims or until your effective objection where the processing is based on legitimate interest.
3.6. Withdrawal from contract, returns and exchanges
Purpose: Handling withdrawal statements, returns, exchanges, refunds, communication with the customer and archiving documentation.
Legal basis: Article 6(1)(c) GDPR – obligations under consumer rights law; Article 6(1)(b) GDPR – performance of the contract; Article 6(1)(f) GDPR – handling and defending claims.
Retention period: For the time necessary to handle the request, and then for the period required by law and until the expiry of limitation periods for claims.
3.7. Complaints and conformity of goods with the contract
Purpose: Receiving, considering and handling complaints, contacting the customer and archiving complaint documentation.
Legal basis: Article 6(1)(c) GDPR – legal obligations of the Controller; Article 6(1)(f) GDPR – establishing, pursuing or defending claims.
Retention period: For the time necessary to handle the complaint and until the expiry of limitation periods for claims.
3.8. Reviews of purchases and products
Purpose: Inviting customers to leave reviews, measuring customer satisfaction, publishing and verifying reviews of purchases or products.
Recipient: TrustMate SA – to the extent necessary to handle the review collection process used in the Store.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in measuring customer satisfaction, improving services and presenting reviews; in specific cases Article 6(1)(a) GDPR – consent, if required for a given form of publication or content.
Retention period: If you do not leave a review – for the time necessary to send the invitation or until your effective objection; if you leave a review – until its removal, withdrawal of consent, effective objection or the end of the period necessary to defend claims.
3.9. Newsletter and marketing communication
Purpose: Sending newsletters, commercial information, information about promotions, products, vouchers and marketing campaigns – if this function is enabled and you give the relevant consent.
Legal basis: Article 6(1)(a) GDPR – consent; electronic communications rules – consent to receive commercial information or direct marketing by electronic means.
Retention period: Until you withdraw consent, unsubscribe from the newsletter or the newsletter service ends.
Note: As at the date of this Policy, no external newsletter tool is used.
3.10. Analytics
Purpose: Analysing how users use the Store, visit statistics, evaluating website effectiveness, improving Store functionality, detecting errors and analysing user behaviour.
Tools: Google Analytics and Microsoft Clarity. Microsoft Clarity may make it possible to analyse user behaviour, including session recordings and heatmaps, if the user consents to the relevant category of cookies.
Legal basis: Article 6(1)(a) GDPR – consent to analytics cookies and similar technologies; for aggregated or technical data necessary for security and operation of the Store – Article 6(1)(f) GDPR.
Retention period: Until consent is withdrawn, cookie settings are changed or for the period set in the relevant analytics tool.
3.11. Google Ads and online marketing
Purpose: Measuring advertising effectiveness, running Google Ads campaigns, possible remarketing, conversion analysis and matching advertising content.
Legal basis: Article 6(1)(a) GDPR – consent to marketing cookies and similar technologies; Article 6(1)(f) GDPR – legitimate interest in marketing our own products and services where consent is not required.
Retention period: Until consent is withdrawn, cookie settings are changed or for the period set in Google Ads settings.
3.12. Social media
Purpose: Maintaining Mamatu social media profiles, communicating with users, handling messages and comments and informing users about the Store’s offer.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in communicating with users and promoting our own products.
Note: The Store does not use Meta Pixel / Facebook Pixel. Links to social media profiles may take you to external services that operate under their own privacy rules.
4. Data recipients
Data may be disclosed only where necessary for the purposes described above. Recipients of data may include in particular:
- hosting, IT, maintenance and sales-system providers,
- payment operators, banks and entities handling payments, including Przelewy24 and PayPal,
- the operator of BL Paczka and carriers: DPD, DHL, Orlen Paczka, InPost, UPS and Poczta Polska,
- accounting, legal, advisory and debt-collection service providers,
- TrustMate SA for review handling,
- Google Ireland Limited / Google LLC for Google Analytics and Google Ads,
- Microsoft Ireland Operations Limited / Microsoft Corporation for Microsoft Clarity,
- public authorities or other entities authorised under applicable law.
5. Transfers outside the European Economic Area
As a rule, we try to use providers that process data within the European Economic Area. However, in connection with the use of tools such as Google Analytics, Google Ads, Microsoft Clarity, PayPal or in connection with deliveries to countries outside the EEA, data may be transferred outside the European Economic Area, in particular to the United States.
In such cases, transfers take place using the appropriate legal mechanisms provided for in the GDPR, in particular an adequacy decision, standard contractual clauses or – for orders delivered outside the EEA – where the transfer is necessary for the performance of the contract with the data subject.
6. Automated decision-making and profiling
We do not make decisions about you that produce legal effects or similarly significantly affect you solely by automated means.
In connection with Google Analytics, Google Ads and Microsoft Clarity, technical or marketing profiling may occur, consisting of analysing how the Store is used, user interests or advertising effectiveness. This profiling is used for statistical analysis, improving the Store and marketing activities, but it does not produce legal effects for you.
7. Cookies and similar technologies
The Store uses cookies, i.e. small text files stored on the user’s terminal device. Cookies may be read by the Store or by providers of external tools used by us.
The Store may use the following categories of cookies:
- necessary cookies – required for the proper operation of the Store, cart, account, session, security and remembering consent settings,
- analytics cookies – used to create statistics, analyse traffic and improve the Store, including Google Analytics and Microsoft Clarity,
- marketing cookies – used to measure advertising effectiveness and conduct advertising activities, including Google Ads.
Necessary cookies are used because they are required for the Store to work. Analytics and marketing cookies are used only if you consent to them in the cookie banner.
You can manage your consents via the cookie banner available in the Store. You can also change cookie settings in your browser. Restricting cookies may affect some Store functions, in particular the cart, login or remembering preferences.
8. External links
The Store may contain links to external websites, including social media, payment operators or carriers. When you go to such a website, the privacy rules of that entity apply.
9. Changes to the Policy
This Policy may be updated in particular if laws change, Store functionality changes, analytics or marketing tools change, service providers change or if the information provided to users needs to be clarified.
The current version of the Policy is published in the Store.