Privacy Policy

Privacy Policy of the morasy.pl shop

This policy explains how we process the personal data of Customers and visitors to the online store morasy.pl, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: RODO (GDPR)). Effective from 25 October 2026.

1. Data controller

The controller of your personal data is Joanna Szyda, conducting business under the name Morasydladzieci Joanna Szyda, ul. Tucholska 41, 64-920 Piła, NIP (tax ID): 7641658760, REGON: 300611355 (hereinafter: Controller or we).

For matters concerning personal data, you can contact us:

The Controller has not appointed a data protection officer, as it is not required to do so.

2. Purposes and legal bases of processing

Purpose of processing Legal basis Retention period
Conclusion and performance of the sales contract: accepting and fulfilling the order, payment, delivery, contact regarding the order, handling withdrawal from the contract art. 6(1)(b) RODO (GDPR) (contract) until the contract is performed, and then for the limitation period for claims and the period required by tax regulations (see below)
Maintaining the Customer Account in the Shop Art. 6(1)(b) RODO (GDPR) (agreement for the provision of an electronic service) until the Account is deleted
Handling complaints (non-conformity of goods with the contract) and fulfilling other obligations under the ustawa o prawach konsumenta (Polish Consumer Rights Act) Art. 6(1)(c) GDPR (legal obligation) for the period of the Seller's liability and the limitation period for claims
Issuing sales receipts and invoices, keeping accounting and tax records and documentation Art. 6(1)(c) GDPR in conjunction with tax and accounting regulations 5 years from the end of the calendar year in which the tax payment deadline expired
Establishing, pursuing or defending against claims Art. 6(1)(f) RODO (GDPR) (legitimate interest of the Controller) until the expiry of the limitation period for claims arising from the contract (at most 6 years, counted to the end of the calendar year in which the limitation period expires)
Responding to messages sent by e-mail, by phone or via the contact form art. 6(1)(f) RODO (GDPR) (legitimate interest – communication with people who contact us); art. 6(1)(b) RODO (GDPR), if the message concerns the conclusion or performance of a contract until the matter is closed, and then for a maximum of 12 months, unless the correspondence concerns a contract
Publishing Product reviews and verifying that the review was submitted by a purchaser of the Product Art. 6(1)(f) GDPR (legitimate interest – providing reliable information to other Customers) and Art. 6(1)(c) GDPR (obligation to provide information on review verification) until the review or Account is deleted
Ensuring the security and proper functioning of the Shop (server logs, protection against abuse) Art. 6(1)(f) GDPR (legitimate interest) 14 days
Statistics and analysis of traffic in the Shop (Google Analytics 4) Art. 6(1)(a) RODO (GDPR) (consent given in the cookie banner) until consent is withdrawn; data in Google Analytics is stored for 14 months
Marketing and measuring ad effectiveness (Google Ads, remarketing) Art. 6(1)(a) RODO (GDPR) (consent given in the cookie banner) until consent is withdrawn, no longer than the cookie lifetime described in the Cookie Policy
Remembering your cookie choice Art. 6(1)(c) RODO (GDPR) in conjunction with Art. 399 of the ustawa – Prawo komunikacji elektronicznej (Polish Electronic Communications Law) and Art. 6(1)(f) RODO (GDPR) (accountability) 6 months

If data is processed for several purposes, we retain it until the longest of the periods expires.

3. What data we process

  • Order: first and last name, delivery address, email address, phone number, selected pickup point and, if an invoice is requested, company name and NIP (tax ID); data on the ordered Products and payment (excluding payment card details, which go exclusively to the payment operator).
  • Account: email address, password (stored in encrypted form, not visible to us), address details saved by the Customer, Order history.
  • Personalized products: the lettering (e.g., first name, surname, rank) provided for making a name tape or patch.
  • Reviews: display name, rating, review content, verified purchase information.
  • Technical data: IP address, browser and device information, cookie data – to the extent described in Cookie Policy.

4. Data Recipients

We share your data only to the extent necessary to achieve the purposes described above. The recipients of the data are:

Entities processing data on our behalf

  • Amazon Web Services EMEA SARL (Luxembourg) – Shop hosting; data is stored on servers located in Frankfurt am Main (Germany).
  • Amazon Web Services EMEA SARL – Amazon SES service – sending emails related to orders and the Account (confirmations, statuses, tracking numbers).
  • Google Ireland Limited (Dublin, Ireland) – Google Analytics 4 and Google Ads; only after you give your consent in the cookie banner. With respect to certain advertising data, Google may act as a separate controller – details: business.safety.google/privacy.
  • Accounting office – accounting and tax services: Zaufana Księgowa, pl. Konstytucji 3 Maja 9/21, 64-920 Piła.
  • Providers of IT services and technical support for the Shop – to the extent necessary to maintain and service the Shop – a person or company providing technical administration of the Shop, under a data processing agreement.

Entities with which we share data as separate controllers

  • Autopay S.A. based in Sopot – electronic payment operator (BLIK, payment cards, fast bank transfers, Google Pay, Apple Pay); receives the data necessary to process payments.

  • Carriers – depending on the selected delivery method: InPost sp. z o.o. (Paczkomaty and Kurier InPost), DPD Polska sp. z o.o., Poczta Polska S.A.; they receive your first name and surname, address or pickup point, phone number, and email address in order to deliver the shipment and send notifications.
  • The bank maintaining the Seller's account – in the case of payment by traditional bank transfer or a refund.
  • Public authorities (e.g., the tax office, courts, the Police) – only when the obligation to disclose data arises from the law.

5. Transfers of data outside the European Economic Area

The Shop's data is stored in the European Union (Frankfurt). The use of Google services and – to a limited extent (e.g., technical support, security) – Amazon Web Services may involve the transfer of data to entities within these providers' groups in the United States. The basis for such a transfer is the European Commission decision finding an adequate level of protection under the EU-US Data Privacy Framework (Google LLC and Amazon.com, Inc. participate in this program) and, additionally, standard contractual clauses approved by the European Commission (art. 46(2)(c) RODO (GDPR)). You can obtain a copy of the safeguards applied by contacting us.

6. Your rights

In connection with the processing of your data, you have the right to:

  • access to your data and to obtain a copy of it (art. 15 RODO (GDPR)),
  • rectification (correction) of data (art. 16 RODO (GDPR)) – you can change some of your data yourself in your Account,
  • erasure of data (art. 17 RODO (GDPR)), if there are no grounds for further processing (e.g. an accounting obligation),
  • restriction of processing (Art. 18 GDPR),
  • data portability for data processed on the basis of a contract or consent (Art. 20 RODO (GDPR)),
  • objection to processing based on legitimate interest (Art. 21 GDPR),
  • withdrawal of consent at any time – without affecting the lawfulness of processing carried out before its withdrawal; you can change your consent to analytics and marketing cookies by clicking Cookie Settings,
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), if you believe that we are processing your data unlawfully.

To exercise your rights, write to morasydladzieci@interia.pl. We will respond without undue delay, no later than within one month. To protect your data, we may ask you to confirm your identity (e.g. a message from the email address associated with your Account or Order).

7. Voluntary Provision of Data

Providing data is voluntary. However, providing the data marked as required in the forms is necessary to conclude and perform the contract (without it, we cannot accept and deliver the order) or to create an Account. Providing invoice data is necessary if you wish to receive an invoice. Consent to analytics and marketing cookies is entirely voluntary and does not affect your ability to make purchases.

8. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. If you consent to marketing cookies, Google may tailor the ads shown to you to your interests (remarketing) – this does not produce legal effects for you.

9. Customer Account

Creating an Account is voluntary – you can also place an order as a guest. In the Account, we store your address details and order history to make future purchases easier and to enable you to add verified reviews. You may request deletion of your Account at any time by writing to morasydladzieci@interia.pl. After the Account is deleted, we retain data related to placed orders only to the extent and for the period required by law or for defense against claims.

10. Product reviews

A review may only be added by a logged-in Customer who has purchased the given Product. To this end, we compare the Account email address with the order history. A published review shows the display name provided by the author (this may be a pseudonym or just a first name), the date, the rating and the “verified purchase” label. The author's email address is not published. You may request deletion of your review at any time.

11. Cookies

The Store uses cookies necessary for its operation and – only with consent – analytics and marketing cookies. Details can be found in the Cookie Policy.

12. Security

We apply technical and organizational measures appropriate to the risk, in particular an encrypted connection (HTTPS), access control to the administration panel, regular backups, and software updates.

13. Changes to the privacy policy

The policy may be updated, e.g., in the event of changes in the law or in service providers. The current version is always available on this page, and we will announce any significant changes on the Shop's website.