Privacy Policy
Privacy and Cookie Policy
Poppyhead online store
The poppyhead.pl online store attaches particular importance to protecting the privacy of users of the website. This privacy policy sets out the rules for processing personal data and using cookies.
- Personal data controller.
The controller of your personal data is:
E-Commerce Solutions Sp. z o.o.
ul. Serocka 10, lok. II piętro
04-333 Warszawa
Poland
Contact in matters concerning personal data: hello@poppyhead.pl
- Data Protection Officer.
The controller has appointed a Data Protection Officer.
Contact with the Officer: hello@poppyhead.pl
- Legal bases for data processing.
Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
Grounds for processing data:
- Article 6(1)(b) GDPR - performance of the sales agreement
- Article 6(1)(c) GDPR - legal obligations (e.g. accounting)
- Article 6(1)(f) GDPR - legitimate interest of the controller (e.g. pursuing claims, direct marketing)
- Article 6(1)(a) GDPR - the user's consent (e.g. marketing)
- Scope of the data collected.
Depending on how you use the poppyhead.pl store, we may process the following data:
- Data given by the user: first and last name, e-mail address, telephone number, delivery address, billing address, company details (if applicable)
- Order-related data: order history, payment method, transaction details, delivery information
- Data collected automatically: IP address, browser type, operating system, device information, date and time of the visit, subpages visited
- Purposes of data processing
Personal data may be processed for the purpose of:
- processing orders in the poppyhead.pl store
- handling the user account
- processing payments and delivery
- handling complaints and returns
- contact with the customer
- carrying out marketing activities
- carrying out statistical analyses
- ensuring the security of the website
- pursuing claims
- fulfilling obligations arising from provisions of law
- Store platform.
The poppyhead.pl online store runs on the Shopify platform, provided by Shopify Inc.
Shopify provides the technical infrastructure enabling online sales and order handling. Personal data may be processed by Shopify to the extent necessary to run the store and process orders.
- Data recipients.
Your personal data may be transferred to entities cooperating with the controller, in particular:
- payment operators
- courier and logistics companies
- IT and hosting service providers
- providers of marketing and analytics tools
- providers of the Shopify sales platform
- law firms
- accounting firms
- Data may be transferred only to the extent necessary to provide the services.
- Payment operators.
Where payments are made, data may be transferred to payment operators.
Tpay
Krajowy Integrator Płatności S.A. (Tpay)
Plac Władysława Andersa 3, 61-894 Poznań, Poland
KRS: 0000412357, NIP: 7773061579
Data is transferred only to the extent necessary to process the payment. As part of payment processing, data may be processed by entities cooperating with Shopify to the extent necessary to handle the transaction.
- Analytics and marketing tools.
The poppyhead.pl website may use analytics and marketing tools such as:
Google Analytics
- Google Ads
- Meta Pixel (Facebook / Instagram)
- TikTok Pixel
These tools make it possible to analyse traffic on the website and carry out marketing activities.
- Transfer of data outside the European Economic Area.
In connection with the use of services of technology providers (e.g. Google, Meta, TikTok, Shopify), data may be transferred outside the European Economic Area. In such cases the transfer takes place in accordance with the GDPR and with appropriate legal safeguards, such as standard contractual clauses.
- Data retention period.
Personal data is stored for the period necessary to achieve the purpose of the processing.
In particular:
- order-related data - up to 5 years (accounting obligations)
- marketing data - until consent is withdrawn
- claim-related data - up to 6 years
- User rights.
You have the right to:
- access your data
- rectify your data
- erase your data
- restrict processing
- data portability
- object to processing
- withdraw consent
You also have the right to lodge a complaint with the supervisory authority:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stanisława Moniuszki 1a, 00-014 Warszawa
- Profiling.
The controller may use profiling for marketing purposes, consisting in the analysis of the user's behaviour on the website and their purchase history.
Profiling serves to match offers and marketing content to the user's preferences.
- Cookies.
The poppyhead.pl website uses cookies, that is small text files saved on the user's device. Cookies are used for the purpose of:
- ensuring the correct operation of the website
- remembering the user's preferences
- keeping statistics
- carrying out marketing activities
- Types of cookies.
The following types of cookies may be used on the website:
- necessary cookies - they enable the website to work
- analytics cookies - they enable traffic analysis
- functional cookies - they remember the user's settings
- marketing cookies - they enable ads matched to the user to be displayed
- Cookie management.
The user can manage cookies through: internet browser settings, the settings of the cookie banner available on the website. Limiting the use of cookies may affect some functionalities of the website.
- Data security.
The controller applies appropriate technical and organisational measures ensuring the protection of personal data. Communication between the user and the server is secured with the SSL protocol.
- Changes to the privacy policy.
The controller may introduce changes to this privacy policy. The current version of the document is published on the website of the poppyhead.pl store
Date of last update: 21 March 2026.
