1. Data controller
The controller of the personal data of EllaThera store customers is MODESTIC Krystyna Zaitseva, registered at MODESTIC Krystyna Zaitseva, ul. Głębocka 5/U10, 03-287 Warszawa, NIP: 8133873866, REGON: 521112715. For data-protection matters contact: info@modestic.pl, tel. +48 733 640 892.
EllaThera is a brand operating within Modestic. The full privacy policy of the umbrella brand is available at modestic.pl - this policy describes the data processed in connection with orders placed in the EllaThera online store.
2. What data we process
In connection with placing and fulfilling orders we process:
- identification data: first name, surname
- contact data: e-mail address, phone number
- delivery data: shipping address or the chosen InPost parcel-locker point
- order data: products ordered, amount, payment status and order identifier
- technical data: IP address, browser information, session identifiers (cookies)
3. Basis and purpose of processing
Data is processed on the basis of:
- Art. 6(1)(b) GDPR - performance of a contract (processing the order, taking payment, shipping the product, handling withdrawals and complaints)
- Art. 6(1)(c) GDPR - legal obligations (e.g. accounting and tax records)
- Art. 6(1)(f) GDPR - the controller's legitimate interest (security, fraud prevention, pursuit of or defence against claims)
4. Order communications
To the e-mail address and phone number provided we send messages related to the order: order confirmation, payment and shipping notifications, and information about withdrawals or complaints. Marketing messages are sent only after separate consent has been given.
5. Retention period
We retain data for the period required to fulfil the order and meet legal obligations - in particular:
- order and accounting documentation: 5 years from the end of the financial year
- data needed to handle withdrawals, complaints and warranty claims: for the duration of those rights and any related claims
- marketing data: until consent is withdrawn, up to a maximum of 3 years
6. Your rights
You have the following rights:
- access to your data and to receive a copy of it
- rectification (correction) of inaccurate data
- erasure of data (where legal obligations do not prevent it)
- restriction of processing
- data portability
- objection to processing
- withdrawal of consent at any time
- lodging a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw)
To exercise any of these rights, write to info@modestic.pl.
7. Data recipients
Data may be transferred to entities supporting the operation of the store: the hosting and infrastructure providers (Supabase, Vercel), the e-mail provider (Resend), the payment provider Stripe (Stripe Payments Europe, Ltd., Ireland - which processes online payments by BLIK, Przelewy24, card, Apple Pay / Google Pay and Klarna, and acts as an independent controller for payment processing under its own privacy policy), the delivery provider (InPost for parcel-locker shipments), and the accounting office - to the extent necessary to provide the services and on the basis of data-processing agreements. Some of these providers (e.g. Stripe) may process data outside the European Economic Area (e.g. the United States) on the basis of standard contractual clauses.
8. Cookies and analytics
The site uses cookies strictly necessary for operation (session, language preference, payment fraud prevention at checkout) - these do not require consent.
With your consent we also use analytics tools that load only after you accept the analytics category in the cookie banner: Google Analytics 4 (Google Ireland Ltd.) for aggregate usage statistics, and Microsoft Clarity(Microsoft Corp.) for heatmaps and session recordings - recordings mask form fields so your contact and payment data are not captured. Google Consent Mode v2 keeps these tools cookieless until you consent. You can change or withdraw consent at any time via the cookie icon at the bottom of the page. Your consent choice is stored in your browser.
With your separate consent (the marketing category) we also use the Meta Pixel (Meta Platforms Ireland Ltd.) to measure advertising performance and show you relevant ads on Facebook and Instagram. It loads only after you accept the marketing category and Consent Mode v2 keeps advertising storage denied until then.
These providers may process data outside the EEA (e.g. the United States) under their standard contractual clauses / data processing terms.
9. Changes to the policy
This policy may be updated periodically. We will inform customers of any material changes via the ellatherapy.eu website.