GDPR Information Clause – mommybag.pl

Effective from July 21, 2025

§1. Personal Data Controller

The controller of your personal data is Szuuus sp. z o.o., ul. Józefa Mireckiego 13A/7,
05-300 Mińsk Mazowiecki, VAT ID (NIP): 8222408059, National Court Register (KRS): 0001099349,
e-mail: info@mommybag.pl, tel.: +48 888 776 910.

§2. Purposes, Scope, and Legal Basis of Data Processing

Personal data is processed for the following purposes:

• fulfilling orders and providing services electronically (account setup and management, order acceptance and execution, payment processing, product shipping, handling complaints, returns, and exchanges),
• conducting marketing activities (newsletter distribution, offer personalization – with consent),
• compiling statistics and analyzing site traffic (Google Analytics, Facebook Pixel, Google Ads),
• meeting obligations arising from legal provisions (accounting, taxes),
• contacting the customer (responding to inquiries, handling forms),
• collecting product reviews and publishing comments,
• conducting remarketing activities and profiling users for advertising purposes (with consent).

The legal basis for processing data is:

• necessity for concluding and performing a contract or providing electronic services (Art. 6(1)(b) GDPR),
• fulfillment of legal obligations of the controller (Art. 6(1)(c) GDPR),
• legitimate interest of the controller (Art. 6(1)(f) GDPR) – e.g., compiling statistics, contacting the customer, direct marketing, pursuing claims, defending against claims, profiling,
• user consent (Art. 6(1)(a) GDPR) – e.g., for newsletter distribution, marketing activities, cookies, publishing reviews or comments.

§3. Scope of Processed Data

The controller processes the following personal data of users:

• first name, last name, residential/delivery address, e-mail address, phone number,
• invoice details (company name, VAT ID, address),
• order, payment, and return information,
• bank account number (in case of refunds),
• data regarding the use of the service (IP address, cookies, device identifiers),
• content of reviews and comments,
• age – for underage users (we recommend usage under adult supervision).

§4. Data Recipients

Personal data may be shared with the following categories of recipients:

• InPost S.A. courier company (delivery),
• DPD courier company (delivery),
• DHL courier company (delivery),
• GLS courier company (delivery),
• Stripe payment operator,
• Revolut Bank payment operator,
• AutoPay S.A. payment operator,
• the controller’s accounting office,
• IT service providers (including hosting, SkyShop store software),
• analytics and advertising service providers (Google Ireland Ltd., Meta Platforms Ireland Ltd.),
• government authorities authorized under legal provisions.

These entities process data on the basis of appropriate data processing agreements or in the scope of providing a service (e.g., delivery, payment, accounting).
Data may be transferred outside the European Economic Area only in connection with the use of Google, Meta/Facebook tools, in compliance with GDPR provisions (e.g., EU standard contractual clauses).

§5. Data Retention Period

Personal data is stored for the period necessary to achieve the purposes for which it was collected, namely:

• for contract execution – for the duration of the contract and until the expiry of the statute of limitations for claims (at least 6 years),
• for customer accounts – until the account is deleted,
• for marketing purposes – until consent is withdrawn,
• for accounting and tax requirements – for the period specified in the law (minimum 5 years),
• for reviews and comments – for the duration of publication or until a deletion request is submitted.

§6. Rights of Data Subjects

You have the following rights regarding the processing of your personal data:

• the right to access your data,
• the right to rectify (correct) your data,
• the right to delete data (“right to be forgotten”),
• the right to restrict processing,
• the right to transfer data to another controller,
• the right to object to data processing,
• the right to withdraw consent at any time (without affecting the lawfulness of processing before its withdrawal),
• the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

To exercise your rights regarding personal data, please contact the controller at:
info@mommybag.pl, tel.: +48 888 776 910.

§7. Voluntary Provision of Data and Consequences of Non-Provision

Providing personal data is voluntary but necessary to fulfill an order, create an account, or receive a newsletter.
Failure to provide data may prevent the use of certain store functionalities.

§8. Automated Processing and Profiling

In the store mommybag.pl, automated decision-making, including profiling of users (e.g., ad personalization, remarketing), may occur – only based on the expressed consent for marketing/analytical cookies or marketing activities (in accordance with the Cookie Policy).
Profiling does not produce legal effects on the user or significantly affect their situation.
The user has the right to object to profiling or withdraw consent at any time.