Privacy policy

This is an English translation of the Privacy Policy provided for convenience. In the event of any discrepancy, the Polish version prevails.

---

Wispy Kiki Store Privacy Policy
https://wispykiki.com 
(the “Store”)

 Privacy Policy dated 16.10.2026.

Dear User,

We care about your privacy and want you to feel comfortable when using our services. That is why below we present the most important information on how we process your personal data and on the cookies used by our Store. This information has been prepared in line with the GDPR, i.e. the General Data Protection Regulation.

PERSONAL DATA CONTROLLER

Klaudia Sadowska, an entrepreneur running a business under the name Kiki Corp Klaudia Sadowska, entered in the Central Register and Information on Economic Activity (CEIDG) maintained by the minister responsible for the economy, NIP (tax ID) 5632448401, REGON 521953254, ul. Polki 1A/10, 02-826 Warszawa, Poland; BDO: 000668217.

If you would like to contact us regarding the processing of your personal data, please write to us at: service@wispykiki.com.

YOUR RIGHTS

You have the right to request:

• access to your personal data, including a copy of your data (Art. 15 GDPR or - where applicable - Art. 13(1)(f) GDPR),
• rectification of your data (Art. 16 GDPR),
• erasure of your data (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• transfer of your data to another controller (Art. 20 GDPR).

You also have the right to:

• object at any time to the processing of your data:
  • on grounds relating to your particular situation - to the processing of your personal data based on Art. 6(1)(f) GDPR (i.e. on our legitimate interests), including profiling (Art. 21(1) GDPR);
  • where personal data is processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing (Art. 21(2) GDPR).
• withdraw your consent at any time, where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).

Contact us if you would like to exercise your rights. You can change or withdraw your consent to the use of cookies (described below) at any time using the “Cookie preferences” link in the Store footer.

If you believe that your data is processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO).

PERSONAL DATA AND PRIVACY

Below you will find detailed information on how we process your data depending on the actions you take.

1. Placing an order in the Store

For what purpose?
fulfilling your order
On what legal basis?
the sales contract (Art. 6(1)(b) GDPR)	a legal obligation, in particular relating to accounting, product safety and product compliance with legal requirements, which requires us to process your personal data (Art. 6(1)(c) GDPR)
For how long?
for the term of the above contract	until our legal obligations expire
in addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us (more information on this can be found in the last table of this section)
What happens if you do not provide your data?
you will not be able to place an order

2. Creating an account in the Store

For what purpose?
performance of the contract for the provision of the Store account service
On what legal basis?
the services contract (Art. 6(1)(b) GDPR)
For how long?
for the term of the above contract
in addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us (more information on this can be found in the last table of this section)
What happens if you do not provide your data?
you will not be able to create an account and use its features, such as viewing your order history or checking the status of an order

3. Contacting us (e.g. to ask a question)

For what purpose?
handling your enquiries or requests
On what legal basis?
a contract or steps taken at your request prior to entering into it (Art. 6(1)(b) GDPR) - where your enquiry or request concerns a contract to which we are or may become a party	our legitimate interest in processing your data in order to communicate with you (Art. 6(1)(f) GDPR) - where your enquiry or request is not related to a contract
For how long?
for the term of the contract binding us or - if no contract is concluded - until the expiry of the limitation period for claims - see the last table of this section*	until the expiry of the limitation period for claims - see the last table of this section - or until we accept your objection to the processing*
in addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us (more information on this can be found in the last table of this section)
What happens if you do not provide your data?
we will not be able to respond to your enquiry or request

* whichever applies in the given case

4. Consenting to marketing cookies

For what purpose?
direct marketing consisting of displaying personalised advertisements and measuring their effectiveness (read more in the “Profiling” and “Cookies” sections of the Privacy Policy)
On what legal basis?
your consent (Art. 6(1)(a) GDPR)
For how long?
until you withdraw your consent or the cookies used for marketing purposes expire*
What happens if you do not provide your data?
you will not receive suggestions of products or services that may interest you

* whichever applies in the given case

5. Consenting to analytics cookies

For what purpose?
analysing how you use and navigate the Store website in order to improve its functionality (read more in the “Analytics” and “Cookies” sections of the Privacy Policy)
On what legal basis?
your consent (Art. 6(1)(a) GDPR)
For how long?
until you withdraw your consent or the cookies used for analytics purposes expire*
What happens if you do not provide your data?
we will not take into account how you use and navigate the Store website when developing it

* whichever applies in the given case

6. Consenting to receive marketing content from us (e.g. information about special offers)

For what purpose?
sending marketing information, in particular special offers	analysing the effectiveness of the messages we send in order to establish general rules for effective mailings in our business (read more in the “Analytics” section of the Privacy Policy)
On what legal basis?
your consent to our marketing activities (Art. 6(1)(a) GDPR)	our legitimate interest in processing data for the above purpose (Art. 6(1)(f) GDPR)
For how long?
until you withdraw your consent - remember, you can withdraw your consent at any time. Processing of data until you withdraw your consent remains lawful.	until we accept your objection to the processing
in addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us (more information on this can be found in the last table of this section)
What happens if you do not provide your data?
you will not receive our marketing materials, including information about our special offers

7. Subscribing to the newsletter

For what purpose?
sending the newsletter	analysing the effectiveness of the content we send in order to establish general rules for effective mailings in our business (read more in the “Analytics” section of the Privacy Policy)
On what legal basis?
the contract for the provision of the newsletter service (Art. 6(1)(b) GDPR)	our legitimate interest in processing data for the above purpose (Art. 6(1)(f) GDPR)
For how long?
until you unsubscribe from our newsletter	until we accept your objection to the processing
in addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us (more information on this can be found in the last table of this section)
What happens if you do not provide your data?
you will not be able to receive information about the Store and our services

8. Using services (other than those listed above), such as browsing our website or using other features available on it - where they require data processing

For what purpose?
performance of the contract concluded between us
On what legal basis?
the services contract (Art. 6(1)(b) GDPR)
For how long?
for the term of the above contract
in addition, your data will be processed until the expiry of the period in which claims may be pursued - by you or by us (more information on this can be found in the last table of this section)
What happens if you do not provide your data?
you will not be able to use the features that require data processing

9. Taking an action or omission that may give rise to claims relating to the Store or our services

For what purpose?
establishing, pursuing or defending possible claims relating to a concluded contract or services provided
On what legal basis?
our legitimate interest in processing personal data for the above purpose (Art. 6(1)(f) GDPR)
For how long?
until the expiry of the limitation period for claims or until we accept your objection to the processing*
What happens if you do not provide your data?
inability to establish, pursue or defend claims

* whichever applies in the given case

PROFILING

We carry out profiling in the Store - in your case this will only happen if you allow it. Profiling consists of an automated assessment of which products or services may interest you, based on information about the content you view. As a result, ads for products or services displayed in the online services you use will be better tailored to you and your needs.

The profiling we carry out does not result in decisions that produce legal effects concerning you or similarly significantly affect you.

ANALYTICS

We carry out analytics on the Store website to make it more intuitive and accessible - in your case this will only happen if you allow it. As part of the analysis, we take into account how you navigate the Store, e.g. how much time you spend on a given page or where in the Store you click. This allows us to optimise the layout, design and content of the Store when developing it, in order to improve its functionality.

In addition, if you choose to receive marketing messages or the newsletter from us, we may analyse the effectiveness of our mailings. For example, we may check whether and how a mailing affected activity in our Store. This helps us establish general rules for sending such messages in our business - e.g. the best sending times or how to write effective content.

DATA SECURITY

When processing your personal data, we apply organisational and technical measures in line with the applicable laws, including encryption of the connection with an SSL/TLS certificate.

COOKIES

Like most websites, our Store uses cookies. These files:

• are stored in the memory of your device (computer, phone, etc.);
• do not change the settings of your device.

In this Store, we use the following categories of cookies:

• necessary - remembering your session and providing Store features,
• preferences - remembering your settings,
• analytics,
• marketing.

Necessary cookies are always used. We use preferences, analytics and marketing cookies only after you give your consent in the cookie banner displayed during your first visit to the Store. You can change or withdraw your choice at any time using the “Cookie preferences” link in the Store footer.

In addition, you can manage cookies in your browser, including disabling them. You can use your browser's help file. You can find information on this by pressing F1 in your browser. You will also find relevant guidance on the following pages, depending on the browser you use:

• Google Chrome
• Opera
• Safari
• Mozilla Firefox
• Microsoft Edge

We will not process cookies for longer than 24 months from your last visit to the Store.

Using the relevant options of your browser, you can at any time:

• delete cookies,
• block the use of cookies in the future.

In such cases, we will no longer process them.

EXTERNAL SERVICES / DATA RECIPIENTS

We use the services of external entities that support us in running our business. We entrust them with the processing of your data - these entities process data only on our documented instructions.

Below you will find a list of the recipients of your data:

ACTION	DATA RECIPIENTS	TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION
any action related to the Store	e-commerce software provider	yes - United States of America, Canada **
consenting to analytics cookies	entities providing website analytics	yes - United States of America **
consenting to marketing cookies	entities providing advertising services, including Meta Platforms Ireland Limited (see the “Joint controllership with Meta” section), and the email software provider	yes - United States of America **
subscribing to the newsletter or consenting to receive marketing content	email software provider	yes - United States of America **
creating an account in the Store	Bot protection (hCaptcha)	yes - United States of America **
placing an order in the Store	payment provider (Shopify Payments)	yes - United States of America, Canada **
	PayPro S.A. based in Poznań (operator of Przelewy24)	does not apply
	warehousing and shipping service provider (order fulfilment, handling returns and complaints)	does not apply
	the entity delivering the product to you	does not apply
	email software provider (e.g. a request to review a purchased product)	yes - United States of America **
	business software provider (e.g. accounting software)	does not apply
	standard office software provider (including email inbox)	does not apply
	accounting office	does not apply
	Bot protection (hCaptcha)	yes - United States of America **
your use of services provided to us in connection with the Store by social media platforms	social media platforms	yes - United States of America **
taking part in a satisfaction survey about our services or products	entities enabling reviews of the Store or products to be posted and compared	yes - United States of America **
contacting us (e.g. asking a question)	standard office software provider (including email inbox)	does not apply
	Bot protection (hCaptcha)	yes - United States of America **
ensuring website security and spam protection	Bot protection (hCaptcha)	yes - United States of America **

In addition:

the relevant public authorities, to the extent we are required to disclose data to them.

JOINT CONTROLLERSHIP WITH META

If you consent to marketing cookies, we use Meta tools (Meta Pixel and Conversions API). For the collection of your data in the Store and its transmission to Meta, we are a joint controller together with Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Any further processing of this data by Meta takes place under its own terms.

The terms of this cooperation are set out in the Meta Controller Addendum, and information on how Meta processes data can be found in the Meta Privacy Policy. You may exercise your rights both against us and against Meta.

TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION

** As a result, your personal data may also be processed by entities outside the European Union. An adequate level of protection of your data, including through appropriate safeguards, is ensured by:

• the participation of these entities in the Data Privacy Framework, a programme established by an implementing decision of the European Commission as a set of rules guaranteeing adequate protection of your privacy - for entities from the United States of America, and for entities not participating in that programme - standard contractual clauses approved by the European Commission
• European Commission Decision 2002/2/EC on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act