Privacy Policy
Good day!
If you arrived here, it is a clear sign that you value your privacy. We fully understand this, which is why we provide you with this document, where in one place you will find the rules regarding the processing of personal data and the use of cookies and other similar technologies in connection with the operation of the website www.olakanofocka.pl and its associated social media profiles.
We process your personal data primarily for purposes related to your use of our website, such as managing a user account, processing orders, handling complaints and statutory withdrawals, fulfilling legal and tax obligations, sending newsletters, managing claims, analytics, statistics, marketing, etc.
We process your personal data for the period necessary to fulfill each specific purpose.
You have the right to access your personal data, rectify it, erase it, or restrict its processing, the right to object to processing, as well as the right to data portability. Furthermore, you may lodge a complaint with the President of the Personal Data Protection Office (PUODO).
Detailed information regarding the rules of processing your personal data can be found in the subsequent sections of this Privacy Policy.
In case of any doubts related to this Privacy Policy, you can contact us at any time by sending a message to info@olakanofocka.pl.
Table of Contents
Section 1: Who is the personal data controller?
Section 2: Who can you contact regarding the processing of personal data?
Section 3: For what purposes do we process personal data?
Section 4: What information do we hold about you?
Section 5: What is „Anonymous Information”?
Section 6: Where do we obtain information about you from?
Section 7: Is the data secure?
Section 8: How long will we store personal data?
Section 9: Who are the recipients of personal data?
Section 10: Do we transfer data to third countries or international organizations?
Section 11: Do we use profiling?
Section 12: What are your rights?
Section 13: Do we use cookies or other similar technologies and how do they work?
Section 14: On what legal basis do we use cookies or other similar technologies?
Section 15: Can you disable cookies or other similar technologies?
Section 16: For what purposes do we use cookies or other similar technologies?
Section 17: What external tools do we use?
Section 18: Do we track your behavior within the website?
Section 19: Do we target you with personalized advertising?
Section 20: How can you manage your privacy?
Section 21: Is there anything else you should know?
Section 22: Is this Privacy Policy subject to change?
Appendix – List of External Tools
Section 1: Who is the personal data controller?
The controller of your personal data is Aleksandra Kanofocka Projects (OK Projects) Żwirki i Wigury 6, 55-120 Oborniki Śląskie, NIP (Tax ID): PL 9151598968. Wherever we use terms such as „we”, „our”, etc., in this Privacy Policy, we refer to the aforementioned entity.
Regarding our social media profiles associated with our website, in accordance with the case law of the Court of Justice of the European Union, we are a joint controller of personal data together with the provider of the respective social media platform where the given profile operates.
Details regarding the processing of personal data by individual social network providers we use can be found here:
Facebook
Instagram
LinkedIn
YouTube
Section 2: Who can you contact regarding the processing of personal data?
As part of implementing the personal data protection system in our organization, we decided not to appoint a Data Protection Officer (DPO), due to the fact that it is not mandatory in our situation.
In matters related to personal data protection and broader privacy issues, you can contact us via e-mail at info@olakanofocka.pl. Regarding social media, you can additionally contact the administrators of the respective social media platforms where we maintain our profiles directly.
Section 3: For what purposes do we process personal data?
There is more than one purpose. Below is a list, along with a detailed discussion. Corresponding legal bases for processing have also been assigned to each purpose:
| Purpose of Processing | Description of Processing Purpose | Legal Basis |
| User Account Management | Registering a user account requires providing necessary data specified in the registration form. As part of editing your account profile, you may provide further data according to available account options. Furthermore, our account management system logs your IP address used during registration. Data is processed to provide the user account service. Upon account deletion, data is archived for potential establishment, exercise, or defense of legal claims related to the account service. | Art. 6(1)(b) GDPR |
| Order Execution & Contract Performance | When placing an order, you must provide data necessary for its execution as specified in the order form. Providing data is a condition for placing an order. The system used to handle orders logs your IP address used when placing the order. Each order is stored in a database, accompanied by details such as order date and time, order ID, transaction ID, ordered items, price, payment method, and deadline. Data is processed to conclude and perform the contract. Post-execution, data is archived for potential legal claims and transferred to accounting records to comply with tax obligations. | Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR |
| Actions Taken to Complete Orders by Customers | Because some customers begin placing an order but do not finalize it (do not confirm the order or enter into a contract), we may take actions to encourage customers to complete the purchasing process (e.g., sending email notifications about abandoned carts). For these activities, we may process data such as details provided during order initiation, name, email address, cart contents, transaction start date, etc. Legal basis includes pre-contractual steps and our legitimate interest in increasing sales. | Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR |
| Handling Complaints or Contract Cancellations | If you submit a complaint or withdraw from a contract, you provide personal data contained in the complaint or withdrawal statement. Providing data is a condition for processing the cancellation/complaint. Upon completion, data is archived for potential legal claims and stored in accounting documentation for tax compliance. | Art. 6(1)(c) GDPR in conjunction with statutory withdrawal/warranty laws, Art. 6(1)(b) GDPR |
| Newsletter Handling | Subscribing to the newsletter requires providing data specified in the subscription form. Providing data is required to receive the newsletter. The mailing system logs your IP address, approximate location, email client, and tracks actions taken regarding messages (opens, link clicks, etc.). We may segment subscribers based on activity/preferences to tailor message content. Data is processed based on our legitimate interest in marketing. You can unsubscribe at any time via the link in any email or by contacting us. Unsubscribing moves your data to archives to demonstrate compliance and defend against claims. | Art. 6(1)(f) GDPR |
| Contact & Correspondence Handling | When contacting us via available channels (e.g., email, social media messaging), you naturally share personal data included in the correspondence. Providing data is required to establish contact. The system logs your IP address. Data is processed based on our legitimate interest to conduct communication, and is subsequently archived for potential legal claims. | Art. 6(1)(f) GDPR |
| Tax & Accounting Obligations | In connection with contract execution, we fulfill statutory tax and accounting obligations (e.g., issuing invoices, maintaining accounting records). To issue an invoice, we process name, company name, business address, Tax ID (NIP), etc. Providing legally required data is mandatory. | Art. 6(1)(c) GDPR in conjunction with relevant tax laws |
| Creating Archives | We may create physical and digital archives for our operations. Data previously processed in connection with you may be placed in archives to organize and manage data storage, based on our legitimate interest. | Art. 6(1)(f) GDPR |
| Defense, Establishment, or Exercise of Claims | Use of our website or entering into a contract may give rise to legal claims. We are entitled to process personal data connected with a given claim to establish, pursue, or defend claims, based on our legitimate interest in protecting our legal position. | Art. 6(1)(f) GDPR |
| Creating Custom Ad Audiences | Your email address stored in our database may be transmitted to specific advertising systems (e.g., Facebook Ads, LinkedIn Ads) to create custom ad audiences. Email addresses are hashed prior to transmission for matching purposes. The ad platform does not share the email with third parties and deletes it immediately after matching, applying strict security safeguards. This serves our legitimate interest in marketing. | Art. 6(1)(f) GDPR |
| Social Media Management | If you follow our social media profiles or interact with our content, we naturally view public data on your social profile. We process this data solely within the platform to manage the profile (legitimate interest). If you send us a private message, you share personal data (e.g., name, avatar, message content). If we initiate contact to seek potential business collaboration, processing serves our legitimate interest in seeking business partners. Messages are automatically archived by platform tools until deleted by you. | Art. 6(1)(f) GDPR |
| Analytics & Statistics | We conduct analytical and statistical activities using third-party tools. Within these tools, we only access Anonymous Information (aggregated/de-identified stats) to optimize site operations and user experience based on our legitimate interest. | Art. 6(1)(f) GDPR |
| Own Marketing | We carry out marketing activities using external tools, accessing only Anonymous Information to target ads within third-party ad networks for our products/services based on our legitimate interest. | Art. 6(1)(f) GDPR |
| Providing Additional Features via Anonymous Information | We embed video/audio players, social widgets, comment modules, or third-party tools on our site. These tools process Anonymous Information to enable additional functionality on the site based on our legitimate interest. | Art. 6(1)(f) GDPR |
| Fulfilling Data Protection Obligations | As a data controller, we must comply with data protection regulations (e.g., handling data subject rights requests). We process data necessary to fulfill these duties and demonstrate accountability under GDPR. | Art. 6(1)(c) GDPR in conjunction with GDPR provisions, Art. 6(1)(f) GDPR |
| Fulfilling Obligations under the Digital Services Act (DSA) | As an intermediary service provider, we must comply with DSA requirements, such as receiving and processing notices regarding User Content, handling appeals regarding content decisions, providing user info upon valid authority orders, and notifying law enforcement of suspected offenses threatening life/safety. We process necessary data for statutory compliance. | Art. 6(1)(c) GDPR in conjunction with DSA provisions |
| Storage of User Content | When submitting User Content (as defined in our Terms & Conditions), e.g., comments or reviews, you provide required personal data. Our IT system logs your IP address. Content and associated data are published on the website or stored in IT systems to provide electronic services. Published content can be modified/deleted by you. Deleted content is archived for legal claims and accountability. | Art. 6(1)(b) GDPR |
Section 4: What information do we hold about you?
Under each of the purposes described above, we may process a different scope of data — strictly what is necessary to achieve that specific purpose. This includes information such as:
First name and last name
E-mail address
Phone number
IP address
Image / Profile photo
Delivery address
Billing details
Bank account number
Order details
Data stored in the mailing system
Information visible on social media profiles
Information contained in correspondence
Information contained in or accompanying User Content
Anonymous Information
Section 5: What is „Anonymous Information”?
We use tools that collect a range of information about you related to your use of our website. In particular, this involves:
Information about your operating system and web browser
This information is referred to in this Privacy Policy as „Anonymous Information”.
In our view, Anonymous Information does not in itself constitute personal data because it does not allow us to identify you, nor do we combine it with typical personal data collected about you. Nevertheless, considering the strict case law of the Court of Justice of the European Union and differing legal opinions, out of abundance of caution, in the event Anonymous Information is deemed to be personal data, we have included detailed explanations regarding its processing in this Privacy Policy.
We are unable to provide you with access to Anonymous Information concerning you, as we cannot attribute any Anonymous Information to any specific individual user. From the tool interface, we only have access to aggregated statistics and unlinked data.
Processing Anonymous Information allows us to ensure you can use functionalities available on the site. Furthermore, it is used for analytical, statistical, and marketing purposes, such as configuring and targeting advertisements.
Anonymous Information is also processed by tool providers according to their own terms and privacy policies. They may use it to deliver and improve services, manage systems, develop new services, measure ad effectiveness, prevent fraud and abuse, and personalize content and ads across websites and apps. Detailed information can be found in the appendix.
Section 6: Where do we obtain information about you from?
In most cases, you provide it to us yourself. For example, this happens when you register an account, place an order, subscribe to a newsletter, submit a complaint or withdrawal notice, contact us, or use functionalities available on our site or external services (e.g., social networks).
Additionally, part of the information about you may be automatically collected by the tools we utilize. Detailed information regarding external tools can be found in the Appendix to this Privacy Policy.
Section 7: Is the data secure?
We care about the security of your personal data. We have analyzed the risks associated with individual data processing activities and implemented appropriate security and technical protection measures. We continuously monitor our technical infrastructure, train staff, review procedures, and introduce necessary improvements.
Section 8: How long will we store personal data?
We process your personal data for as long as justified under the respective processing purpose, which means storage periods vary. Ending processing for one purpose does not automatically mean total deletion of your data, as the same data set may be processed for another purpose for its corresponding duration. Complete deletion or destruction occurs when all processing purposes are concluded or in other cases specified under GDPR.
Retention periods are summarized in the table below:
| Data Processing Purpose | Data Retention Period |
| User Account | Until the user account is deleted |
| Order & Contract Performance | Until the contract is fully performed |
| Order Completion by Customer | For 6 months from initiating the order |
| Complaints & Contract Withdrawals | Until complaint or withdrawal processing is completed |
| Newsletter | Until unsubscribing from the newsletter |
| Tax & Accounting Obligations | For the period required by statutory provisions |
| Archive | Until the information loses its operational utility |
| Establishment, Defense, or Exercise of Claims | Until the statute of limitations for claims expires |
| Ad Audience Groups | Until the information loses utility or an objection is lodged |
| Social Media | For the duration the information remains available on the platform |
| Analytics & Statistics | Until the information loses utility or an objection is lodged |
| Own Marketing | Until the information loses utility or an objection is lodged |
| Contact & Correspondence | For the duration of active contact between us |
| Additional Tools | Until the information loses utility or an objection is lodged |
| Data Protection Obligations | Until the expiration of the limitation period for controller liability |
| DSA Obligations | Until the expiration of the limitation period for intermediary liability |
| Storage of User Content | Until the User Content is removed |
Section 9: Who are the recipients of personal data?
Modern business relies heavily on third-party services. We also utilize such services, some of which involve processing your personal data. External service providers participating in data processing are listed below:
| Processor / Service Provider | Purpose of Cooperation |
| Hosting Provider | Server data storage |
| Invoicing System Provider | Issuing invoices |
| Mailing System Provider | Handling newsletter distribution |
| Landing Page Provider | Hosting and handling landing pages |
| Cloud Service Provider | Google Cloud services |
| Accounting Office | Accounting services |
| CRM System Provider | Project management and operational efficiency |
| Technical Support | Technical maintenance in areas with personal data |
In the case of physical product orders, your data is shared with shipping carriers to deliver your order.
If necessary, your data may be shared with an attorney or legal counsel bound by professional secrecy to obtain legal assistance requiring access to personal data.
Your personal data may also be disclosed to tax offices to the extent necessary to fulfill tax, accounting, and settlement obligations (including tax returns, reports, and accounting documents).
Furthermore, where legally required, personal data may be shared with authorized public authorities or institutions (e.g., police, security services, courts, prosecutor offices).
Regarding Anonymous Information, tool providers that collect such information have direct access. These providers act as independent controllers and may share data according to their own terms and privacy policies. A list of external tools is provided in the Appendix.
Section 10: Do we transfer data to third countries or international organizations?
Yes, certain processing operations may involve transferring your personal data to third countries outside the European Economic Area (EEA).
| Type of Solution | Provider | Third Country |
| Cloud Infrastructure | USA |
In addition, Anonymous Information collected via tools listed in the Appendix may be transferred to third countries, particularly the USA.
Section 11: Do we use profiling?
We do not make automated decisions about you, including profiling, that produce legal effects or similarly significantly affect you. While we use tools that take actions based on tracking mechanisms (e.g., personalized behavioral advertising), these do not significantly impact your situation as a customer or alter contractual terms.
Using these tools allows us to show personalized ads based on previous website actions or suggest products of interest. We encourage you to learn more about behavioral advertising and privacy management.
Section 12: What are your rights?
Under the GDPR, you have the following rights regarding your personal data:
Right of access to your data and receiving a copy;
Right to rectification (correction) of your data;
Right to erasure („right to be forgotten”);
Right to restriction of processing;
Right to object to processing based on legitimate interests;
Right to data portability;
Right to withdraw consent at any time (if processing was based on consent);
Right to lodge a complaint with a supervisory authority (President of the Personal Data Protection Office – PUODO).
Detailed rules governing these rights are set out in Articles 16–21 GDPR. These rights are not absolute and may be limited under specific statutory conditions. However, the right to lodge a complaint with PUODO is always available.
Section 13: Do we use cookies or other similar technologies and how do they work?
Our website, like almost all websites, uses cookies and similar technologies (such as tracking pixels, Conversion APIs, etc.) to collect information for proper site function, user behavior analytics, and targeted advertising.
Section 14: On what legal basis do we use cookies or other similar technologies?
We use cookies based on your consent, except for strictly necessary cookies required for proper service operation. Non-essential cookies remain blocked until you grant consent via our cookie banner during your first visit.
Section 15: Can you disable cookies or other similar technologies?
Yes, you can manage cookies via browser settings, incognito mode, browser extensions (e.g., Ghostery), or directly through our website’s built-in privacy manager. Note that disabling cookies may affect website functionality.
Section 16: For what purposes do we use cookies or other similar technologies?
Cookies are used to maintain core site functionality (shopping cart, session login, form submission, embedded media, comments) as well as for analytics, statistics, and marketing.
Section 17: What external tools do we use?
A detailed list and description of all external tools utilizing cookies and tracking technologies are set out in the Appendix.
Section 18: Do we track your behavior within the website?
Yes, we use external tools that collect information about user activity on our website, detailed in the Appendix.
Section 19: Do we target you with personalized advertising?
Yes, we use tools to deliver targeted ads based on demographic and behavioral criteria, as described in the Appendix.
Section 20: How can you manage your privacy?
You can manage your privacy through:
Browser privacy settings
Privacy extensions (e.g., Ghostery)
Antivirus / privacy software
Incognito / Private browsing mode
Behavioral ad opt-out platforms (e.g., youronlinechoices.com)
On-site privacy manager mechanism
Social media platform privacy settings
Section 21: Is there anything else you should know?
Data processing and privacy management are complex topics. We strived to provide comprehensive details. If anything remains unclear, feel free to email us at info@olakanofocka.pl.
Section 22: Is this Privacy Policy subject to change?
Yes, this Privacy Policy may be updated to reflect legal or operational changes. Previous versions will be archived and made available upon request.
Appendix – List of External Tools
| Tool Name | Description of Operation & Cookies |
| Google Tag Manager | Provided by Google LLC (USA). Used to manage website tags and script loading. GTM itself does not collect personal info other than operational telemetry, but loads scripts described below. |
| Hotjar | Provided by Hotjar Limited. Captures user session recordings and heatmaps to optimize user experience. Hotjar does not capture form text inputs containing personal data. Tracks via cookies under a pseudonymized user profile. Users can opt-out via Hotjar’s website. |
| Google Analytics | Provided by Google LLC (USA). Tracks site traffic and user behavior in an aggregated, anonymous format to analyze usage and optimize performance. Users can block tracking via Google’s browser add-on. |
| Google Ads | Provided by Google LLC (USA). Uses remarketing cookies to display targeted ads across the Google Display Network based on past visits to our site. Uses Anonymous Information only. Ad settings can be managed at adssettings.google.com. |
| YouTube | Provided by Google LLC (USA). Embedded widgets allow video playback directly on our site. Sets cookies (including DoubleClick) to analyze functionality, security, and ad personalization. Logging out of Google prevents linking session data directly to your account. |
| Vimeo | Provided by Vimeo.com Inc. (USA). Embedded widgets enable video playback, setting operational and performance cookies. |
| Pinterest Tag | Provided by Pinterest, Inc. (USA). Transmits site activity to Pinterest ad system to deliver personalized ads and measure campaign effectiveness based on Anonymous Information. |
| Meta Pixel | Provided by Meta Platforms Inc. (USA). Tracks activity on our site to deliver targeted ads across Meta services (Facebook, Instagram) and measure conversions using Anonymous Information. Meta may link data for its own purposes. |
| Facebook Connect | Provided by Meta Platforms Inc. (USA). Provides social buttons/plugins („Like”, „Share”). Meta collects activity data for product optimization and advertising. |
| LinkedIn Insight Tag | Provided by LinkedIn Ireland Unlimited Company. Tracks visits and conversions to target ads on LinkedIn using Anonymous Information. |
| Disqus | Provided by Disqus, Inc. (USA). Commenting platform that sets cookies for login management and ad personalization. Operates independently under Disqus privacy policies. |
| TradeTracker | Provided by TradeTracker International B.V. Affiliate marketing platform tracking sales referrals using cookie technology based strictly on Anonymous Information. |
| Microsoft Clarity | Provided by Microsoft Corporation. Captures user sessions and heatmaps under pseudonymized profiles to optimize usability. Does not record sensitive form inputs. |
| PayPal | Provided by PayPal. Embedded payment buttons collect necessary telemetry to enable transaction processing. |
| Twitter Conversion Tracking Base Code | Provided by Twitter/X Inc. (USA). Measures ad conversion efficiency and site activity originating from Twitter ads using Anonymous Information. |
| Adobe TypeKit / Adobe Fonts | Provided by Adobe. Delivers web fonts and collects aggregated operational metrics to manage font licenses and performance. |
| TikTok Analytics | Provided by TikTok Inc. (USA). Script tracking site activity to optimize targeted ad campaigns within TikTok using Anonymous Information. |
