SOULFUL ENERGY
Privacy policy
How we process data when you visit or order. Version dated 27 September 2026.
Data controller
Mariana Shlapak · działalność nierejestrowana · Waliców 20/218, 00-851 Warszawa, Poland. mrmaryana2594@gmail.com · +48 732 574 184 · @soulfulenergy_shop.
Data and legal bases
For enquiries and orders we receive the details you provide: profile or name, contact details, messages, products, delivery details and payment information needed for settlement. Enquiries and contracts use GDPR Article 6(1)(b); legally required records use (c). Website security, technical logs (including IP address, browser, time and requested address), and establishing or defending claims use our legitimate interests under (f). Optional Google Analytics 4 uses consent under (a). We do not collect payment card details.
Recipients and transfers
We use Netlify (hosting), Supabase (database and files), Google (Gmail and GA4 with consent), Meta/Instagram (contact) and InPost (delivery). Settlement or legal service providers and authorised authorities may receive necessary data. Instagram and the carrier have their own privacy policies. International providers may process data outside the EEA, including the USA, under an applicable adequacy decision or standard contractual clauses. You can request information and a copy of the safeguards from the controller.
Retention
We keep correspondence while handling the matter, and contract and claims data until the applicable limitation period ends. Tax records are retained as legally required, generally 5 years from the end of the year in which the tax payment deadline expired. Logs remain for the period needed to protect and diagnose the service under provider retention; we do not maintain a permanent archive. GA4 retains event data for 2 months and user data for 14 months; new user activity renews the latter period. These settings do not cover aggregated reports. Analytics consent can be withdrawn at any time. Browser storage periods are described on the Cookies page.
Your rights and choices
You may request access, correction, erasure, restriction and portability where GDPR provides, and object to processing based on legitimate interests. Withdrawing consent does not affect earlier lawful processing. You may complain to the President of UODO (uodo.gov.pl). Providing data is voluntary, but contact and delivery details are needed to fulfil an order; settlement details may be legally required. We do not make automated decisions about customers with legal or similarly significant effects.