This Privacy Policy sets out the principles of processing and protecting personal data provided by users in connection with the use of the mommybag.pl online store. We care about your privacy and the security of your data.
Last updated: January 2026
§1. PERSONAL DATA CONTROLLER
The controller of your personal data is:
Szuuus sp. z o.o. ul. Józefa Mireckiego 13A/7 05-300 Mińsk Mazowiecki Poland
NIP: 8222408059 REGON: 528329412 KRS: 0001099349 District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register
Contact regarding personal data matters: E-mail: info@mommybag.pl Phone: +48 888 776 910 Customer service hours: Monday – Friday, 9:00 AM – 5:00 PM
§2. WHAT DATA WE COLLECT
Depending on the purpose, we process the following categories of personal data:
Identification data: first name, last name, company name (optional)
Invoice data: Tax ID / NIP, company registered address (if you request an invoice for a company)
Transaction data: order history, payment method, order number
Technical data: IP address, browser type, cookie data (details in the Cookie Policy)
§3. PURPOSES AND LEGAL BASES OF PROCESSING
The table below presents the purposes of processing your data, the legal bases, and the retention periods:
Purpose
Scope
Legal basis (GDPR)
Retention period
Order fulfillment
order acceptance, shipping, payment handling
Article 6(1)(b) performance of a contract
Until completion of the order + complaint period
Invoice issuance
accounting documentation, tax obligations
Article 6(1)(c) legal obligation
5 years from the end of the tax year
Returns and complaints handling
withdrawal from contract, statutory liability, warranty
Article 6(1)(b) and (c) performance of a contract / legal obligation
2 years from delivery + 1 year for claims
Contact and customer service
responses to questions, customer support
Article 6(1)(f) legitimate interest
Until the matter is closed + 3 years
Establishment, exercise or defense of claims
legal disputes, debt collection
Article 6(1)(f) legitimate interest
Until the limitation period expires (max. 6 years)
Analytics and statistics
Google Analytics, website improvement
Article 6(1)(a) user consent
Until consent is withdrawn or 26 months (Google Analytics)
Customer account
order history, preferences
Article 6(1)(b) performance of a contract (account service)
Until the account is deleted by the user
§4. DATA RECIPIENTS
Your personal data may be transferred to the following categories of recipients, only to the extent necessary to achieve specific purposes:
Delivery
InPost (Poland), DHL.de (Germany and France), CTT Express (Spain), DHL.nl (Netherlands), PostNL (Denmark), DPD (Austria), Italian Post (Italy) We transfer: first name, last name, delivery address, phone number. Purpose: fulfillment of order delivery.
Payments
Banking institutions handling traditional bank transfers We transfer: data necessary to identify and settle the payment. Purpose: payment settlement and payment confirmation.
Hosting
Hostinger International Ltd. We transfer: all data processed on the website. Purpose: hosting of the website and databases. Servers located in the EEA.
Analytics
Google LLC We transfer: data from analytical cookies (with consent). Purpose: website traffic analysis (Google Analytics). Registered office: USA (transfer — see §5).
Accounting
Accounting office We transfer: invoice data (company data, addresses). Purpose: accounting records, tax settlements. Location: Poland.
Cookie consents
Cybot A/S (Cookiebot) We transfer: cookie preferences. Purpose: management of cookie consents. Registered office: Denmark (EEA).
Data may also be disclosed to public authorities (e.g. tax offices, courts) on the basis of applicable law.
§5. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
In connection with the use of Google LLC services (Google Analytics), your data may be transferred to the United States.
Transfer basis: Google LLC has joined the EU-U.S. Data Privacy Framework, which has been recognized by the European Commission as ensuring an adequate level of personal data protection (implementing decision of 10 July 2023).
Data transfer to Google LLC takes place only if you consent to analytical cookies (via the Cookiebot banner).
§6. YOUR RIGHTS
Under the GDPR, you have the following rights related to the processing of your personal data:
1. Right of access You have the right to obtain confirmation whether we process your data and to access it and receive a copy.
2. Right to rectification You have the right to request correction of inaccurate data or completion of incomplete data.
3. Right to erasure You have the right to request deletion of your data (“right to be forgotten”) if there is no basis for its further processing.
4. Right to restriction You have the right to request restriction of data processing in specific situations (e.g. when you contest the accuracy of the data).
5. Right to data portability You have the right to receive your data in a structured format (e.g. CSV) and transfer it to another controller.
6. Right to object You have the right to object to processing based on the Controller’s legitimate interest.
7. Right to withdraw consent If processing is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.
8. Right to lodge a complaint You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl).
How to exercise your rights: Send a request to the e-mail address info@mommybag.pl or by post to the registered office address. In order to verify your identity, we may ask for additional information.
Response time: We will respond to your request without undue delay, no later than within one month. In the case of complex requests, this period may be extended by another 2 months, of which you will be informed.
§7. VOLUNTARY PROVISION OF DATA
Providing personal data is voluntary, however, in some cases necessary:
Placing orders: Providing data (first name, last name, address, e-mail, phone number) is necessary to complete your order. Without these data, we cannot accept and fulfill the order.
Company invoice: Providing company data (Tax ID / NIP, company name, address) is necessary to issue a VAT invoice for a company.
Contact: Providing contact data (e-mail, phone number) is necessary to respond to your questions.
§8. AUTOMATED DECISION-MAKING AND PROFILING
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. We use only anonymous statistical data (Google Analytics) to analyze website traffic — these data are not used to make decisions concerning specific individuals.
§9. DATA SECURITY
We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or disclosure:
SSL/TLS encryption — all communication with the website is encrypted
Secure payments — payments are made by traditional bank transfer and handled using standard banking security mechanisms
Access control — only authorized persons have access to the data
Regular backups — protection against data loss
Software updates — ongoing security patches
§10. COOKIES
Our website uses cookies. Detailed information about the types of cookies, their purposes, legal bases, and how to manage your preferences can be found in the separate Cookie Policy document available on mommybag.pl.
§11. CHANGES TO THE PRIVACY POLICY
We reserve the right to make changes to this Privacy Policy in the event of changes in the law, introduction of new functionalities, or changes in the manner of data processing. We will inform you about significant changes by displaying an appropriate notice on the website. The current version of the Privacy Policy is always available on mommybag.pl.
CONTACT
For matters related to personal data protection, please contact us:
Szuuus sp. z o.o. ul. Józefa Mireckiego 13A/7, 05-300 Mińsk Mazowiecki E-mail: info@mommybag.pl Phone: +48 888 776 910 Customer service hours: Monday – Friday, 9:00 AM – 5:00 PM
