Privacy policy

NOVINSKA Privacy Policy

Version of 13 October 2026

1. Controller and contact

The controller of data related to the operation of the novinska.com store is HANDBAGS BAO BAO Maria Nowińska-Ślązak, ul. Ogrodowa 8E/40, 05-500 Józefosław, Poland, tax ID (NIP) 9511916420, REGON 140261203, registered in CEIDG. For personal data matters, contact us at contact@novinska.com.

2. What data we process and why

Purchases and order handling: name, email, phone number, delivery and billing address, company details for invoices, and order and payment data. Legal basis: performance of a contract and steps taken before entering into it (Art. 6(1)(b) GDPR).
Accounting and legal obligations: data required for tax and accounting records and for handling customers' statutory rights (Art. 6(1)(c) GDPR).
Correspondence, security and claims: data provided in messages and technical information needed to protect the store, prevent abuse and establish, pursue or defend claims. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR) and, where correspondence concerns the conclusion or performance of a contract, also point (b).
Newsletter: email address and any data provided voluntarily, based on consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in any message or by contacting us.
Analytics and online marketing: cookie identifiers, information about your device, browser, pages visited and purchase events, in line with the consents given (Art. 6(1)(a) GDPR).

Providing data is voluntary, but data marked as required is needed to handle the order or the service. Not consenting to the newsletter, analytics or advertising does not prevent you from making a purchase.

3. Service providers and recipients

We share data to the extent necessary to provide our services: with providers of the store platform and hosting, IT support, payments, shipping and accounting, and with entities authorised by law. Payment operators and carriers may also act as independent controllers.

Shopify: store platform, checkout and order handling. More: Shopify policy.
MailerLite: newsletter and marketing communication. More: MailerLite policy.
Google Analytics 4: measuring use of the store and purchase events. More: Google policy.
Meta (Facebook and Instagram): the pixel and Conversions API are used to measure marketing effectiveness and tailor ads in line with your consent settings. More: Meta policy.

Using international providers may involve transferring data outside the European Economic Area. The safeguards used include European Commission adequacy decisions or standard contractual clauses with the required protections, depending on the recipient and transfer. Information on safeguards is available from the controller and in the relevant provider's documentation.

4. Cookies and consent

The store uses cookies that are necessary for it to work, including for the cart, security and remembering your privacy choices. Other analytics and marketing technologies are only activated in line with your consent. You can accept or reject optional categories in the privacy banner. You can change your settings in the store's privacy settings, and you can also delete or block cookies in your browser.

Session cookies expire at the end of the session; persistent cookies remain until the period set for the cookie expires or until you delete them. Details of providers' technologies are set out in their policies. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. How long we keep data

We keep order data for the duration of the contract and then for the period required by tax and accounting law and until claims become time-barred. Correspondence data is kept for as long as needed to handle the matter and any related claims. Data used on the basis of consent is kept until consent is withdrawn or the purpose ends; limited information confirming consent or objection may be kept to demonstrate compliance and respect your choices. The retention period for analytics data also depends on the settings of the tool and the validity of identifiers.

6. Your rights

Under the GDPR you have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interest, and to direct marketing at any time. You may withdraw consent at any time. You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl) or with the data protection authority in your country.

Advertising tools may group users by activity and interests to tailor ads. You can limit such processing through the store's consent settings and the privacy settings of Google and Meta services.

This English text is a translation. In the event of any discrepancy, the Polish version prevails.