Privacy policy
Privacy Policy
1. General Information
This Privacy Policy sets out the principles for the processing of personal data by the entrepreneur conducting business under the name GRUPA SILESIA Aleksandra Bałon, who operates the online store 4kidspoint (hereinafter: the “Store”).
This Privacy Policy applies to the website https://4kidspoint.com and to the processing of personal data in connection with sales within the European Union.
The Controller processes personal data in accordance with:
• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR);
• the national data protection provisions applicable in the Member States of the European Union, in particular the Polish Act of 10 May 2018 on the Protection of Personal Data;
• Directive 2002/58/EC (ePrivacy Directive) and the national provisions implementing it in the Member States (with regard to cookies), in particular the Polish Electronic Communications Law of 12 July 2024.
2. Controller
The controller of personal data is:
GRUPA SILESIA Aleksandra Bałon
ul. A. Brody 79, 43-450 Ustroń, Poland
VAT ID: PL5482585928
In matters concerning the protection of personal data, the Controller can be contacted at info@4kidspoint.com, stating “Personal data” in the subject line.
The Controller has not appointed a data protection officer, as it is not obliged to do so under Article 37 GDPR.
3. Categories of Personal Data
Depending on the purpose of processing, the Controller may process the following categories of personal data:
3.1 Identification data
• first name and surname
3.2 Contact data
• e-mail address
• telephone number
• correspondence / delivery address
3.3 Order data
• information on ordered products
• purchase history
• order number
3.4 Accounting data
• data required to issue an invoice, including the VAT identification number of business customers
• data required under tax regulations
3.5 Technical and analytical data
• IP address
• browser and device data
• cookie identifiers
• data on activity on the website
3.6 Marketing data (after consent has been given)
• data used for sending the newsletter
• data used for remarketing
• data used within Shopify Audiences
3.7 Loyalty programme data
• data on participation in the loyalty programme, collected points and benefits
3.8 Voluntarily provided data (after consent, where required)
• data contained in the contact form
• data transmitted via chat (Shopify Inbox or similiar)
• data transmitted via the review system
4. Purposes of Processing and Legal Bases
4.1 Performance of the contract of sale
Purpose: acceptance of the order, delivery, payment processing, handling of withdrawals and complaints. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
4.2 Customer account
Purpose: registration, login and management of the user account. Legal basis: Art. 6(1)(b) GDPR.
4.3 Compliance with legal obligations
Purpose: issuing invoices, keeping accounting and tax records. Legal basis: Art. 6(1)(c) GDPR.
4.4 Newsletter and marketing communication
Purpose: sending commercial information, offers and promotions. Legal basis: Art. 6(1)(a) GDPR (consent). Consent may be withdrawn at any time.
4.5 Abandoned cart
Purpose: reminder of an uncompleted order. Legal basis: Art. 6(1)(a) GDPR (consent). Abandoned cart messages are limited in time and contain the option to withdraw consent to further marketing communication (unsubscribe link).
4.6 Enquiries and chat (Shopify Inbox)
Purpose: answering enquiries submitted via the form or chat. Legal basis: Art. 6(1)(b) GDPR (where the contact concerns the conclusion or performance of a contract) and Art. 6(1)(a) GDPR (consent, insofar as data is processed for marketing purposes).
4.7 Loyalty programme
Purpose: managing participation in the loyalty programme, crediting and redeeming benefits. Legal basis: Art. 6(1)(b) GDPR.
4.8 Trusted Shops review system
Purpose: enabling the submission of a review of the purchase. Legal basis: Art. 6(1)(a) GDPR (consent).
4.9 Behavioural marketing, personalisation of advertising and conversion measurement
The Controller uses tools that make it possible to tailor advertising to users’ interests and to analyse the effectiveness of advertising campaigns, in particular:
• Shopify Audiences
• Shopify Network Intelligence
• Google Ads
• Google Enhanced Conversions
• Meta Pixel
• TikTok Pixel
• Pinterest Tag
• Microsoft Ads
Within these tools, the following may be processed: technical data (IP address, cookie identifiers), information on activity on the website, purchase data and the e-mail address in encrypted form (hash) for conversion measurement. Hashed data is processed in pseudonymised form, and the Controller transmits only the data necessary for conversion measurement and campaign optimisation. Legal basis: Art. 6(1)(a) GDPR (consent given via the cookie banner). Profiling does not produce legal effects and does not significantly affect the user’s situation.
4.10 Website traffic analysis
Purpose: analysing how the website is used and improving its functionality. Tools used: Google Analytics, Microsoft Clarity. Legal basis: Art. 6(1)(a) GDPR (consent to analytical cookies).
4.11 Establishment, exercise or defence of legal claims
Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller).
4.12 Order processing and operational systems
To ensure proper processing of orders, the Controller uses systems supporting sales, logistics, customer service and accounting. Data is processed to the extent necessary for executing the order, customer service and keeping accounting records. Legal basis: Art. 6(1)(b) and (c) GDPR.
4.13 Obligation to provide data
Providing the personal data necessary to execute the order is a prerequisite for concluding the contract of sale; without it, the order cannot be executed. Providing data for marketing purposes, including newsletter subscription and consent to analytical and marketing cookies, is voluntary and does not affect the possibility of making a purchase.
5. Retention Period
Personal data is not stored longer than necessary to achieve the purposes for which it was collected, taking into account the applicable legal provisions.
5.1 Data related to the performance of the contract of sale is stored for the duration of the contract and thereafter for the period necessary for the establishment, exercise or defence of claims (generally up to 6 years) and for compliance with tax and accounting obligations (generally 5 years from the end of the tax year).
5.2 Accounting data is stored for the period required by tax and accounting regulations, i.e. at least 5 years from the end of the tax year.
5.3 Data processed on the basis of consent (newsletter, marketing, remarketing, Shopify Audiences, analytical and marketing cookies, abandoned cart messages) is stored until consent is withdrawn or the purpose of processing ceases to apply.
5.4 Data processed for direct marketing on the basis of the Controller’s legitimate interest is stored until an objection is lodged.
5.5 Data related to the user account and the loyalty programme is stored for as long as the account or participation exists. After deletion, data may only be stored to the extent necessary to comply with legal obligations or to defend against claims.
5.6 Data processed within analytical and marketing systems (Google Analytics, Microsoft Clarity, Google Ads, Meta Pixel, TikTok Pixel, Pinterest Tag, Microsoft Ads) is stored in accordance with the settings of these tools, but no longer than until consent is withdrawn or the retention period set in the respective system expires.
5.7 Data submitted via the contact form or chat is stored for the period necessary to respond and for the time required for any defence against claims.
6. Recipients of Data and Processors
Personal data may be disclosed to entities cooperating with the Controller to the extent necessary to achieve the purposes of processing.
6.1 E-commerce platform and IT infrastructure
• Shopify International Ltd. / Shopify Inc. – store platform, Shopify Email, Shopify Inbox, Shopify Audiences, Shopify Network Intelligence
• Cloudflare Inc. – CDN services and security solutions
These entities act as processors on the basis of data processing agreements.
6.2 Operational and accounting systems
The Controller uses providers of IT systems supporting sales, logistics, customer service and accounting. These entities process data exclusively to the extent necessary for executing orders, customer service and keeping accounting records, on the basis of data processing agreements.
6.3 Payment service providers
• Shopify Payments
• PayPal
• Klarna
• Apple Pay
• Przelewy24 (PayPro S.A.)
Payment service providers act as independent controllers in the context of payment processing.
6.4 Logistics companies
• Paxy
• DPD
• InPost
These entities act as independent controllers in the context of delivery and return shipments.
6.5 Marketing, analytics and reviews
• Google LLC (Google Ads, Google Analytics, Google Enhanced Conversions, YouTube) – https://policies.google.com/privacy
• Meta Platforms (Meta Pixel) – https://www.facebook.com/privacy/explanation
• Shopify Inc. – https://www.shopify.com/legal/privacy
• TikTok Technology Limited (TikTok Pixel) – https://www.tiktok.com/legal/privacy-policy
• Pinterest Europe Ltd. (Pinterest Tag) – https://policy.pinterest.com/privacy-policy
• Microsoft Corporation (Microsoft Ads, Microsoft Clarity) – https://privacy.microsoft.com
• Trusted Shops GmbH – https://www.trustedshops.com/imprint/
Depending on the service, these entities act as independent controllers or as processors on the basis of the agreements concluded. Details of their roles and responsibilities can be found in their privacy policies and terms of use. For some services, data may be transferred to third countries in accordance with Section 7.
7. Transfer of Data to Third Countries (outside the EEA)
When using the services of technology and marketing providers, personal data may be transferred to third countries, in particular to the United States of America (USA). This concerns in particular services provided by Shopify (Shopify International Ltd./Shopify Inc.), Google LLC, Meta Platforms, Microsoft Corporation, TikTok Technology Limited and Cloudflare Inc.
Data is transferred on the basis of an adequacy decision of the European Commission (EU–US Data Privacy Framework) or of standard contractual clauses (SCC) approved by the European Commission, supplemented by technical and organisational measures such as encryption of data transmission and limiting the data transferred to the necessary minimum. For providers not covered by the EU–US Data Privacy Framework, standard contractual clauses are applied. Information on the legal basis of the transfer for a specific provider can be provided on request.
8. Cookies and Consent Management
8.1 Types of cookies
a) Necessary cookies ensure the proper functioning of the website (e.g. shopping cart, login, security). They do not require the user’s consent.
b) Functional cookies store user settings (e.g. language preferences). They are only set after consent, unless they are necessary for a service expressly requested by the user.
c) Analytical cookies serve to analyse traffic and improve the website. Tools used: Google Analytics, Microsoft Clarity. They are not activated before consent is given.
d) Marketing cookies serve to personalise advertising and measure the effectiveness of campaigns. Tools used: Shopify Audiences, Shopify Network Intelligence, Google Ads, Google Enhanced Conversions, Meta Pixel, TikTok Pixel, Pinterest Tag, Microsoft Ads. They are only set after consent.
8.2 Consent management
The user can at any time give consent to selected categories of cookies, refuse consent or withdraw consent previously given via the consent management panel available on the website. Refusing consent to analytical and marketing cookies does not affect the possibility of using the Store.
Cookies and similar technologies that are not strictly necessary are used exclusively on the basis of the user’s consent. Where the national provisions of the user’s country of residence implementing the ePrivacy Directive contain additional requirements, these are observed.
9. Rights of Data Subjects
9.1 Right of access (Art. 15 GDPR) – to obtain confirmation as to whether personal data is being processed and, if so, access to the data and a copy of it.
9.2 Right to rectification (Art. 16 GDPR) – to demand the rectification of inaccurate personal data or its completion without delay.
9.3 Right to erasure (“right to be forgotten”, Art. 17 GDPR) – where one of the grounds set out in Art. 17 GDPR applies, in particular where the data is no longer necessary for the purposes for which it was collected.
9.4 Right to restriction of processing (Art. 18 GDPR) – in the cases set out in Art. 18 GDPR.
9.5 Right to data portability (Art. 20 GDPR) – to receive the data provided in a structured, commonly used and machine-readable format and to transmit it to another controller, where processing is based on consent or a contract and carried out by automated means.
9.6 Right to object (Art. 21 GDPR) – to processing based on the Controller’s legitimate interest, including processing for direct marketing purposes. In the event of an objection to direct marketing, the data will no longer be processed for this purpose.
9.7 Right to withdraw consent – where processing is based on consent, it may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
9.8 Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR), including profiling, which produces legal effects or similarly significantly affects the user. The Controller does not make such decisions in the operation of the Store.
10. Supervisory Authority and Right to Lodge a Complaint
The user has the right to lodge a complaint with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement if they consider that the processing of personal data infringes the GDPR. A list of all EU data protection supervisory authorities is available on the website of the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
The lead supervisory authority within the meaning of Article 56 GDPR for the Controller’s activities is:
Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office)
ul. Stawki 2, 00-193 Warszawa, Poland
www.uodo.gov.pl
In accordance with the “one-stop-shop” principle, a supervisory authority of another Member State may also be competent in the case of cross-border processing.
11. Age Restrictions
The Store is not intended for persons under the age of 16 without the consent of their legal representative. The Controller does not knowingly process children’s data without the required consent.
12. Changes to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy, in particular in the event of changes in legal provisions, in the manner of data processing, the introduction of new services, tools or technologies, or changes in the scope of business. The current version is published on the Store’s website. In the event of material changes affecting users’ rights, the Controller may additionally inform users by e-mail or by a notice on the website. Where changes require new consent, the Controller will obtain it before processing data in the new scope.
This Privacy Policy is effective from the date of its publication.
Date of last update: 17.10.2026