Privacy policy

Version of 19 October 2026 | Compliant with the GDPR (OJ EU L 119 of 4.05.2016). This English text is a translation provided for convenience; in case of any discrepancy, the Polish version prevails.

§1 Data controller

The controller of your personal data is Magdalena Pawłowska, conducting business under the name Magdalena Pawłowska La Opalia, ul. Klinkierowa 1/46, 02-237 Warsaw, Poland, Tax ID (NIP): 5223373172 (the "Controller").

Contact with the controller: kontakt@laopalia.com or laopaliacontact@gmail.com, or by post at the address above.

The Controller has not appointed a Data Protection Officer (DPO). For matters relating to personal data, you can contact the Controller directly.

§2 Purpose and legal basis of processing

We process your personal data for the following purposes:

Purpose of processing	Legal basis	Retention period
Concluding and performing the sales contract (accepting the order, payment, making and shipping the Product, order status emails)	Art. 6(1)(b) GDPR: necessary for the performance of a contract	Until the order is completed, and then until claims become time-barred (as a rule up to 6 years)
Running a Customer account (if you create one)	Art. 6(1)(b) GDPR: performance of the account agreement	Until the account is deleted
Handling complaints, withdrawals and returns	Art. 6(1)(b) and (c) GDPR: performance of a contract and legal obligation	Until the matter is closed, and then until claims become time-barred
Issuing sales documents and keeping accounting records	Art. 6(1)(c) GDPR: legal obligation (tax and accounting laws)	5 years from the end of the calendar year in which the tax payment deadline expired
Replying to messages sent by email, via the contact form or social media	Art. 6(1)(f) GDPR: the Controller's legitimate interest (communicating with you), and where the message concerns an order, Art. 6(1)(b) GDPR	Until the correspondence ends, and then until any claims become time-barred
Newsletter (news and promotions, including the welcome email series)	Art. 6(1)(a) GDPR: your consent	Until you unsubscribe or withdraw your consent
Demonstrating that consent to the newsletter was given and when it was withdrawn	Art. 6(1)(f) GDPR: the controller's legitimate interest	Until claims become time-barred
Statistics and improving the Shop (statistics cookies)	Art. 6(1)(a) GDPR: your consent given in the cookie banner	Until consent is withdrawn or the cookie expires
Marketing and measuring ad performance (marketing cookies)	Art. 6(1)(a) GDPR: your consent given in the cookie banner	Until consent is withdrawn or the cookie expires
Keeping the Shop and payments secure and preventing fraud	Art. 6(1)(f) GDPR: the controller's legitimate interest	For as long as necessary to achieve this purpose
Pursuing and defending against claims	Art. 6(1)(f) GDPR: the controller's legitimate interest	Until claims become time-barred

§3 What data we process

In connection with your order and your contact with us, we process:

• first and last name,
• email address,
• phone number,
• delivery and billing address,
• invoice details (if you request an invoice: tax ID, company name, address),
• order history and information provided in the order notes (e.g. your pet's measurements),
• the content of your correspondence with us.

We do not store payment card details. You enter them directly in the form of the payment operator Stripe, and we only receive the payment status and basic transaction details.

When you sign up for the newsletter, we process your email address and information about opens and clicks in our emails.

When you use the Shop, technical data is collected automatically, such as your IP address, browser and device type, and the pages you visit. We collect statistics and marketing data only after you give your consent in the cookie banner.

Providing data is voluntary, but necessary to place an order, sign up for the newsletter or receive a reply to your message.

§4 Data recipients

Your data may be received by the following recipients, only to the extent necessary for the given purpose:

• Stripe Payments Europe Ltd. (Ireland): processing payments by card, BLIK, Przelewy24, Apple Pay, Google Pay and Link. When you pay with Klarna, data is also received by Klarna Bank AB (Sweden) as an independent controller.
• LH.pl Sp. z o.o. (Poland): website hosting and email.
• Sendinblue SAS (Brevo) (France): sending the newsletter and order-related emails.
• Automattic Inc. (USA): the WooCommerce and Jetpack plugins, including visitor statistics (after consent).
• Microsoft Ireland Operations Ltd. (Ireland): the Microsoft Clarity tool, which shows in a pseudonymised way how users use the website (after consent).
• Meta Platforms Ireland Ltd. (Ireland): the Meta pixel used to measure and target ads on Facebook and Instagram (after consent). As regards the collection of data by the pixel on our website, the Controller and Meta are joint controllers.
• Google Ireland Ltd. (Ireland): Google Tag Manager, Google Ads conversion measurement and Google Merchant Center (marketing tools run only after consent).
• courier companies and Poczta Polska: delivering your order,
• providers of accounting, legal and IT services to the Controller,
• public authorities: only on the basis of legal provisions.

We do not sell your personal data.

§5 Transfer of data outside the EEA

Some of our providers (in particular Stripe, Meta, Microsoft, Google and Automattic) or their subcontractors may process data in countries outside the European Economic Area, including the USA. Such transfers are based on a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by contacting the Controller.

§6 Your rights

In connection with the processing of your personal data, you have the following rights:

• Right of access to your data and to obtain a copy of it (Art. 15 GDPR),
• Right to rectification of your data (Art. 16 GDPR),
• Right to erasure of your data (Art. 17 GDPR), unless this conflicts with the Controller's legal obligations,
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to object to processing based on legitimate interest (Art. 21 GDPR),
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. You can unsubscribe from the newsletter using the link in the footer of every email, and change your cookie consent in the cookie settings on the website,
• Right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Ad personalisation by Meta and Google happens only after you consent to marketing cookies.

To exercise your rights, write to us: kontakt@laopalia.com.

§7 Cookies

The Shop uses cookies and similar technologies. Necessary cookies (e.g. cart, session, payments, remembering your choices in the banner) are always active. Statistics cookies (Jetpack Stats, WooCommerce order attribution, Microsoft Clarity) and marketing cookies (Meta pixel, Google Ads) are stored only after you give your consent in the cookie banner, in accordance with Article 399 of the Polish Electronic Communications Law.

You can change or withdraw your consent at any time in the cookie settings. You will find a detailed list of cookies in our Cookie policy.

§8 Data security

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. The Shop uses an encrypted HTTPS connection (SSL/TLS), and only authorised persons have access to the Shop's admin panel.

§9 Changes to the Privacy Policy

This policy may be updated when the law or the tools we use change. We will announce significant changes on the Shop's website. The current version is always available at laopalia.com/polityka-prywatnosci.