Privacy Policy

The controller of your personal data is:

For any matters relating to the protection of personal data, you can contact us at the e-mail address above or by post. We also accept returns and complaints regarding Products at the same address.

The Controller has not appointed a Data Protection Officer, as the scope of processing does not require one under Art. 37 GDPR.

We process personal data in accordance with:

• GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
• the Polish Act of 10 May 2018 on the Protection of Personal Data;
• the Polish Act of 18 July 2002 on the Provision of Electronic Services;
• the Polish Electronic Communications Law of 12 July 2024 (cookies).

Whenever this document refers to:

• Website - it means the website and online store available at senti-mentals.com;
• User - a natural person using the Website;
• Payment Operator - PayU S.A. (PayU) or PayPro S.A. (Przelewy24), depending on which of them handles the payment for a given order;
• Personal data - any information relating to an identified or identifiable natural person.

The scope of data we collect depends on how you use the Website.

Data you provide voluntarily:

• e-mail address - when you sign up for the launch notification or the newsletter;
• first and last name, e-mail address, phone number, message content - when you contact us;
• when placing an order - first and last name, e-mail address, phone number, delivery address or selected InPost Parcel Locker and, if you would like an invoice, company name, address and tax ID;
• when purchasing a gift card - if you provide them, the recipient’s first name and e-mail address, as well as the dedication text;
• when creating an Account - login, password (stored in encrypted form) and order history;
• when filing a complaint or withdrawing from a contract - order details, a description of the request, photos of the Product and your bank account number, if the refund is to be made by bank transfer;
• when posting a Product review - your signature (first name or nickname), review text, rating and the order number or e-mail address used to verify the purchase.

Payment data: payments are handled by the Payment Operator - PayU or Przelewy24. We do not have access to your full card details, online banking login or BLIK codes - we only receive information about the payment status, amount, transaction ID and the chosen method.

Data collected automatically:

• IP address and approximate location (country, city);
• browser type and version, operating system, screen resolution;
• date and time of the visit, pages viewed, time spent on the Website;
• referring page address (referrer) and campaign parameters (UTM), e.g. whether you came to us from Facebook, Instagram or TikTok;
• information stored in cookies.

We do not collect special categories of data (so-called sensitive data) referred to in Art. 9 GDPR, nor data relating to criminal convictions.

Each purpose of processing has its own legal ground under the GDPR:

When you sign up for the launch notification, you give us your e-mail address. You do so voluntarily, but without it we will not be able to send you messages.

• We use your e-mail address solely to inform you about the brand launch, new arrivals, offers and Sentimental’s events.
• Together with your address, we record the sign-up date, IP address and traffic source - this serves to demonstrate consent and to protect against abuse.
• We use anti-spam safeguards (including a hidden form field and measuring the time taken to fill in the form) to limit automated sign-ups.
• We do not sell or share e-mail addresses with third parties for marketing purposes.

Unsubscribing: you can unsubscribe at any time by clicking the link in the footer of any message or by writing to kontakt@senti-mentals.com. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Providing data when placing an order is voluntary, but necessary to conclude and perform the sales contract - without it we cannot accept payment or ship the Product.

Payments - PayU and Przelewy24

After placing an order, you are redirected to the website of the Payment Operator available in the order form (if two are available - the one you choose). The Payment Operators on the Website may be:

• We provide the Payment Operator with the data necessary to process the payment: first and last name, e-mail address, phone number, order amount and number.
• With regard to processing payments (card, saved card, online and traditional bank transfer, BLIK, Visa Mobile, Google Pay), PayU S.A. and PayPro S.A. act as independent controllers, in accordance with their own privacy policies available on their websites.
• Saving a card for future payments takes place on the Payment Operator’s side and only with your consent - we do not store card details.
• For instalments and deferred payments, your data is additionally processed by the financing provider you choose, which, as an independent controller, may assess your creditworthiness.
• For refunds (withdrawal from the contract, accepted complaint), the data is passed again to the same Payment Operator in order to make the refund.

Delivery - InPost and DPD

Depending on the delivery method you choose, we provide the carrier with: first and last name, delivery address or the number of the selected Parcel Locker, phone number and e-mail address. This data is needed to deliver the parcel and to send you notifications about its status and the collection code.

• InPost sp. z o.o., ul. Pana Tadeusza 4, 30-727 Kraków, Poland - InPost 24/7 Parcel Lockers and InPost Courier;
• DPD Polska sp. z o.o., ul. Mineralna 15, 02-274 Warsaw, Poland - DPD Courier.

Carriers process the data as independent controllers, in accordance with their own privacy policies available on their websites.

Cookies are small text files saved on your device by your browser. They do not contain programs or viruses and are not used to identify you personally.

Types of cookies we use:

• Necessary - enable the Website to work: session, cart, payment process, remembering your choice in the cookie banner, form protection. They do not require consent.
• Functional - remember your preferences, e.g. language or display settings.
• Analytics - allow us to count visits and understand how you use the Website. Set only after you give consent.
• Marketing - used to show personalised ads, including on third-party websites. Set only after you give consent.

Managing cookies: you can change or withdraw your consent at any time in the cookie banner settings on the Website, as well as in your browser settings:

• Chrome - Settings › Privacy and security › Third-party cookies
• Firefox - Settings › Privacy & Security › Cookies and Site Data
• Safari - Settings › Privacy
• Edge - Settings › Cookies and site permissions

Restricting cookies may affect the availability of some Website features, including the cart and payments.

On the Website we may use the following tools from third-party providers:

• Google Analytics (Google Ireland Limited) - aggregated statistics on traffic and user behaviour. More: policies.google.com/privacy
• Meta Pixel (Meta Platforms Ireland Limited) - measuring the effectiveness of ads on Facebook and Instagram, and remarketing. More: facebook.com/privacy/policy
• TikTok Pixel (TikTok Technology Limited) - measuring the effectiveness of campaigns on TikTok. More: tiktok.com/legal/privacy-policy-eea
• Google Fonts (Google Ireland Limited) - fonts used to display the Website correctly. If fonts are loaded from Google servers, the provider receives your device’s IP address.

Analytics and marketing tools are activated only after you give consent in the cookie banner. The providers of these tools may act as independent controllers to the extent that they process data for their own purposes.

Your data may be shared only with trusted entities that support us in running our business. These are:

• Payment Operators - PayU S.A. based in Poznań and PayPro S.A. based in Poznań (Przelewy24) - depending on which one handles the payment, and, for instalments and deferred payments, also the financing provider you choose;
• carriers - InPost sp. z o.o. (Parcel Lockers and InPost Courier) and DPD Polska sp. z o.o. (DPD Courier);
• the hosting and mail server provider;
• the newsletter delivery system provider;
• the accounting office and the invoicing software provider;
• providers of analytics and advertising tools;
• entities providing technical and IT support for the Website;
• law firms and entities authorised under the law.

With entities that process data on our behalf, we conclude data processing agreements in accordance with Art. 28 GDPR. Payment Operators and carriers process data as independent controllers.

Some of the services we use (e.g. Google, Meta and TikTok tools, as well as Google Pay when you pay with this method) may involve transferring data to countries outside the European Economic Area, primarily the United States and, in the case of TikTok, also other third countries in which the provider operates.

In such cases, the transfer takes place on the basis of:

• a European Commission adequacy decision (Data Privacy Framework), or
• standard contractual clauses approved by the European Commission, together with additional safeguards.

You can obtain a copy of the safeguards applied by contacting us.

In connection with the processing of your data, you have the following rights:

• Access - you can find out what data we process about you and obtain a copy of it (Art. 15 GDPR).
• Rectification - you can correct inaccurate data or complete incomplete data (Art. 16 GDPR).
• Erasure - the so-called right to be forgotten, when the data is no longer needed or you withdraw your consent (Art. 17 GDPR).
• Restriction of processing - you can request that processing be suspended while the data is being verified (Art. 18 GDPR).
• Data portability - you can receive your data in a machine-readable format (Art. 20 GDPR).
• Objection - to processing based on legitimate interest and, in the case of direct marketing, at any time and without giving a reason (Art. 21 GDPR).
• Withdrawal of consent - at any time, without affecting the lawfulness of prior processing (Art. 7(3) GDPR).

To exercise any of these rights, write to kontakt@senti-mentals.com. We reply without undue delay, and in any event within one month of receiving the request. With regard to data processed by the Payment Operators (PayU S.A., PayPro S.A.) or carriers as independent controllers, you can also direct your requests to them directly.

We apply technical and organisational measures appropriate to the risk, including:

• encrypting the connection with an SSL/TLS certificate (HTTPS protocol);
• processing payments only on the secure websites of the Payment Operators - card details never reach our server;
• restricting access to data to authorised persons only;
• regular software updates and backups;
• protecting forms against automated submissions and limiting requests from a single IP address;
• strong passwords and authentication for administration panels.

Despite our utmost care, no method of transmitting data over the internet is completely secure. Keep your passwords confidential and do not share them with third parties.

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

If you choose instalments or deferred payment, the financing provider may decide whether to grant it in an automated way. It does so as an independent controller, under the rules described in its own privacy policy.

We may, however, use profiling for marketing purposes - e.g. to show you ads tailored to your previous activity on the Website. This is based on your consent, and you can object at any time.

We run profiles on social media platforms (including Facebook, Instagram, TikTok and Pinterest). We process the data of people visiting our profiles in order to communicate with them and promote the brand, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

With regard to profile statistics, we are joint controllers together with the operator of the given platform. The rules for data processing by these platforms are set out in their own privacy policies.

The Website may contain links to external websites. We are not responsible for the privacy practices of their owners - we encourage you to read the terms of those websites.

The Website is not directed at persons under the age of 16, and we do not knowingly collect data from such persons. If you are a parent or guardian and believe that a child has provided us with their data, please contact us - we will delete it without delay.

We reserve the right to make changes to this Privacy Policy - for example in connection with the development of the Website, the introduction of new features, a change of Payment Operators or carriers, or changes in the law.

The current version is always available at this address, and the date of the last update can be found at the beginning of the document. We will inform you of any significant changes in advance by e-mail or by a notice on the Website.

Matters not covered by this Policy are governed by the GDPR and Polish law.