1. Data Controller
The controller of your personal data is Hoshimi Sanjari, operating a sole proprietorship under the business name Digiteria Solutions Hoshimi Sanjari, registered address: ul. Wołoska 44 lok. 6, 02-583 Warsaw, Poland, Tax ID (NIP): 5214088779, Business Registry Number (REGON): 529866431, registered in the Central Registration and Information on Business (CEIDG) (“ANORA”, “we”, “us”, “the Controller”). The ANORA brand operates as part of this business activity.
For matters related to the protection of personal data, you can contact us:
- e-mail: hello@anorashop.pl
- phone: +48 517 976 466
2. What data we collect and for what purpose
| Purpose of processing | Scope of data | Legal basis (GDPR) |
|---|---|---|
| Fulfilling your order and the sales contract | first and last name, delivery address, e-mail address, phone number, order contents | Art. 6(1)(b) — performance of a contract |
| Processing online payments | data necessary to process the payment, transferred directly to PayU S.A. | Art. 6(1)(b) and (c) |
| Creating and managing a customer account | first and last name, e-mail, password (encrypted), order history | Art. 6(1)(b) |
| Issuing invoices and tax/accounting obligations | data required on the invoice | Art. 6(1)(c) — legal obligation |
| Newsletter and marketing communication (Brevo) | e-mail address, first name (optional), engagement with messages (opens, clicks) | Art. 6(1)(a) GDPR — consent, in conjunction with Art. 10 of the Polish Act on Providing Services by Electronic Means |
| Website traffic analysis (Google Analytics, Microsoft Clarity) | device data, approximate location, on-site behaviour, cookies | Art. 6(1)(a) GDPR — consent, in conjunction with Art. 402 of the Polish Electronic Communications Law |
| Advertising and conversion measurement (Meta/Facebook Pixel, TikTok Pixel) | device data, interactions with ads, cookies | Art. 6(1)(a) GDPR — consent, in conjunction with Art. 402 of the Polish Electronic Communications Law |
| Handling enquiries and complaints | correspondence content, contact details | Art. 6(1)(b) — performance of a contract, and Art. 6(1)(f) — legitimate interest of the Controller, consisting in handling customer requests, responding to enquiries, and defending against potential claims |
Providing your data is voluntary, but necessary to conclude and perform the sales contract, create an account, or subscribe to the newsletter — without it we will not be able to provide the relevant service.
Profiling. As part of our analytics and advertising tools (Google Analytics, Meta Pixel, TikTok Pixel, Microsoft Clarity), we may analyse your behaviour on the website to better tailor content and advertising. The Controller does not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
3. Recipients of data
We may share your data with the following categories of recipients, only to the extent necessary for the purposes indicated:
- PayU S.A. — with its registered office in Poznań, ul. Grunwaldzka 186, 60-166 Poznań, a national payment institution supervised by the Polish Financial Supervision Authority, entered in the register of payment service providers under number IP1/2012, National Court Register (KRS): 0000274399, NIP: 779-23-08-495, REGON: 300523444 — acting as an independent controller with respect to payment processing. We encourage you to review PayU’s own privacy policy.
- Hostinger — hosting provider on whose servers our store operates.
- Brevo (Sendinblue SAS) — provider of our newsletter and e-mail communication tool.
- Google LLC — in connection with Google Analytics (traffic analysis) and Google Ads (if advertising campaigns are run).
- Meta Platforms Ireland Limited — as the data processor in Europe for Meta/Facebook Pixel (advertising and conversion measurement); in certain cases data may also be processed by Meta Platforms, Inc., its US parent company.
- TikTok Technology Limited (Ireland) / TikTok Pte. Ltd. — in connection with the TikTok Pixel (advertising and conversion measurement) [implementation planned].
- Microsoft Ireland Operations Limited — in connection with Microsoft Clarity (analysis of user behaviour on the site) [implementation planned].
- InPost S.A. and DHL Parcel Polska Sp. z o.o. — in connection with order delivery.
- Public authorities, where disclosure is required by law.
4. Transfers of data outside the European Economic Area
The servers on which our store operates, as well as our backups, are located within the European Economic Area (server: Germany; backups: France), so hosting of the store (Hostinger) does not involve any transfer of data outside the EEA.
Some of our other providers (including Google, Meta, TikTok, Microsoft), however, may process data on servers located outside the EEA, in particular in the United States. In such cases, the transfer is based on legal mechanisms provided for under the GDPR — in particular the provider’s participation in the EU-U.S. Data Privacy Framework (where the provider holds a current certification at the time of processing) or Standard Contractual Clauses approved by the European Commission. The current certification status of individual providers under the Data Privacy Framework can be verified at dataprivacyframework.gov.
5. Data retention periods
- Order and invoicing data: for the period required by tax and accounting law (generally 5 years, counted from the end of the calendar year in which the tax obligation arose).
- Customer account data: until the account is deleted by the user or by ANORA at the user’s request.
- Data processed on the basis of consent (newsletter, analytical/advertising cookies): until consent is withdrawn.
- Customer service correspondence: for the period necessary to handle the matter and for the limitation period of any potential claims (generally 3 years from the date the claim became due, under the Polish Civil Code).
6. Your rights
Under the GDPR you have the right to:
- access your personal data,
- rectify (correct) your data,
- erasure of your data (“the right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on Art. 6(1)(f) GDPR (legitimate interest),
- object at any time, without giving any reason, to the processing of your data for direct marketing purposes — including profiling to the extent it is related to such marketing (Art. 21(2) GDPR). Once you object, we will stop processing your data for this purpose,
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland), if you believe that the processing of your data violates the GDPR.
To exercise the above rights, please contact us at hello@anorashop.pl or by phone: +48 517 976 466.
7. Customer accounts and guest purchases
Our store allows you either to create a customer account or to place an order as a guest (without registration). In both cases, the scope of data processed is as described in Section 2, and the data is retained in accordance with the periods indicated in Section 5.
8. Cookies
Our website uses cookies to ensure it functions properly, to analyse traffic (Google Analytics, Microsoft Clarity), and to display personalised advertising (Meta/Facebook Pixel, TikTok Pixel). Cookies other than those strictly necessary for the site to function are used only after obtaining your consent, in accordance with Art. 402 of the Polish Electronic Communications Law. Detailed information about the types of cookies used and how to manage your consent can be found in our Cookie Policy [PLACEHOLDER — requires implementation of a cookie consent banner (e.g. Complianz, CookieYes, or Cookiebot) and a separate Cookie Policy before GA/Meta Pixel/TikTok Pixel/Clarity begin collecting data].
9. Data security
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction, including, among others, an encrypted connection (SSL/TLS), restricted access to data, and regular software updates for the store.
10. Changes to the Privacy Policy
We reserve the right to make changes to this Privacy Policy, in particular in connection with changes in the law or the scope of services provided. The current version of the Policy is always available on this page, together with the date of its last update.
Last updated: [publication date]
Note: this is a working translation of the Polish-language Privacy Policy for reference and internal review purposes. If ANORA sells to customers outside Poland and this English version will be published as the binding text for those customers, it should be reviewed by a lawyer for accuracy — including the exact legal terminology, since some references (e.g. the Polish Electronic Communications Law, Polish Civil Code limitation periods) are specific to Polish law and may need to be paired with the correct equivalent framework depending on which jurisdiction’s consumers you are serving.