Privacy Policy

The controller of personal data is Dominika Grabowska, an entrepreneur entered in the Polish Central Register and Information on Economic Activity under the business name SHIZEN Dominika Grabowska, based in Baligród (38-606), Poland, tax ID (NIP) 6881303926.

You can contact the controller at hollymate.crew@gmail.com or by phone at +48 723 804 330. For day-to-day website matters you may also write to biuro@hollymate.pl.

We process personal data lawfully, fairly and transparently, for specified purposes and only to the extent necessary. We take reasonable steps to keep data accurate, secure and no longer than needed.

• data submitted in forms and correspondence, such as name, email, phone number, company or venue name, tax ID and message content;
• technical data required to operate and secure the website, such as IP address, browser/device information and server logs;
• analytics and statistical data to the extent permitted by consent and the configuration of analytics tools;
• after the store launches — data required to create an account, place and fulfil orders, process payment and delivery, returns, complaints and legal accounting/tax duties.

Data submitted through the contact form, email, phone or social media is used to answer enquiries and handle cooperation, distribution and other matters raised by the user.

The sample request form collects data required to verify a B2B request and contact the business about providing a sample. Providing data is voluntary, but required fields are necessary to handle the request.

Depending on the matter, processing may be based on steps taken at the user's request before entering into a contract, performance of a contract or the controller's legitimate interest in handling correspondence and business relationships.

The website uses Google Tag Manager and Google Analytics 4 to measure traffic, acquisition sources, content performance and conversions. Analytics works with a consent mechanism: without consent, storage of analytics and advertising cookies remains disabled; after consent, analytics storage may be enabled.

The current configuration does not grant ad_storage, ad_user_data or ad_personalization. If advertising, remarketing or additional marketing tools are enabled in the future, consent settings and this policy will be updated before activation.

If Microsoft Clarity is enabled, it will be used to understand website interactions, such as heatmaps and session recordings, and will be configured to respect the user's consent settings.

The website uses technical mechanisms required for its operation and stores the user's analytics preference in local browser storage. After consent, third-party analytics services may use their own identifiers and cookies in accordance with their configuration.

• necessary — website operation, security, forms and the future cart/store;
• analytics — measurement of traffic and website use, activated in line with consent;
• marketing — advertising and remarketing if enabled in the future and the user gives the relevant consent.

Holly Mate plans to launch an online store based on WooCommerce. Until the store is launched, the information below describes the intended processing model and does not mean that store functions are already active.

Once launched, we will process data required for the cart, customer accounts and orders: identification and contact details, billing and shipping address, company details and tax ID, order information, payment status, delivery, returns, complaints and order history. We will not store full payment-card details where payment is handled by an external payment provider.

Order data will be processed to perform the sales contract, comply with legal obligations — including tax and accounting duties — and establish, exercise or defend legal claims. Before sales go live, we will update this policy with the payment providers, delivery partners, account rules and retention periods actually configured in WooCommerce.

WooCommerce allows retention periods to be set for inactive accounts and different order states and supports deletion or anonymisation of personal data. Production settings will be aligned with legal requirements and documented before launch.

Personal data may be entrusted to service providers only to the extent necessary. This currently includes primarily LH.pl hosting and Google analytics services. The WordPress CMS at cms.hollymate.pl currently provides content at build time and is not queried by the visitor's browser to render the public website.

After additional services are activated, recipients may also include Microsoft (Clarity), payment processors, delivery companies or other providers involved in order fulfilment. Their actual names will be added once selected and configured.

Data may also be disclosed to public authorities where required by law.

Using global technology providers such as Google, Microsoft or future e-commerce providers may involve processing outside the European Economic Area. Where this occurs, the provider and controller should use the safeguards required by applicable data-protection law for the relevant service and destination.

Form and correspondence data is retained for as long as necessary to handle the matter and then for a period justified by the protection against claims, unless a valid objection or deletion request applies and no law requires further retention.

Analytics data is retained according to the configured settings of the relevant tools. Once the store launches, transaction data will be retained for periods required by tax, accounting and consumer law and limitation periods; exact periods will be documented after the final store configuration.

Where provided by law, you may request access, rectification, deletion or restriction of processing, data portability, object to processing based on legitimate interests and withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with the Polish President of the Personal Data Protection Office (UODO).

We do not make decisions producing legal effects for a user solely through automated processing. If remarketing, advertising segmentation or personalised advertising is introduced in the future, it will be described here and enabled in line with the user's relevant consent.

We use technical and organisational safeguards appropriate to the website, including HTTPS, form validation and abuse-prevention controls. These safeguards may evolve as the website and store develop.

This policy may be updated when laws, providers, website functions, analytics or the store change. The current version is published on this page with the latest update date.