PRIVACY POLICY HEMAMANUAL.COM
Effective date: 21/07/2026
This Privacy Policy sets out the rules for processing personal data of users of the website https://vzfq3q2641d.c.updraftclone.com and the online store operated by the Seller.
§1. Data Controller
The controller of personal data is:
Stark Creations Maks Starkowski
Jastrzebsko Stare 28C
64-300 Nowy Tomysl
Poland
Tax ID (NIP): 7882044657
Email: info@hemadeck.com
The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and applicable provisions of Polish law.
§2. Scope of Data Processed
Depending on how the Store is used, the Controller may process the following data:
– Identification data: first and last name, company name, Tax ID (NIP) if applicable.
– Contact data: email address, phone number (if provided).
– Billing data: invoice address, data required by tax regulations.
– Delivery data: delivery address, country, postal code.
– Order data: products ordered, order history, payment status.
– Technical data: IP address, browser type, operating system, cookie identifiers, device information.
§3. Purposes of Processing
Personal data is processed for the purposes of:
– fulfilling orders,
– concluding and performing the sales contract,
– delivering physical products,
– delivering digital products,
– processing payments,
– issuing invoices,
– handling complaints,
– contacting the Customer,
– fulfilling tax and accounting obligations,
– ensuring website security,
– establishing or defending legal claims,
– marketing – only after consent has been obtained.
§4. Legal Basis for Processing
The Controller processes personal data on the basis of Article 6(1) GDPR, in particular:
– point (b) – performance of a contract,
– point (c) – legal obligation,
– point (f) – legitimate interest of the Controller,
– point (a) – consent of the data subject.
§5. WooCommerce
The Store operates on the basis of WooCommerce.
WooCommerce processes data necessary for:
– fulfilling orders,
– calculating taxes,
– calculating shipping costs,
– maintaining order history,
– communicating with the Customer.
§6. WordPress
The website operates on the basis of WordPress.
WordPress may process technical data such as:
– IP address,
– browser information,
– cookies,
– security logs.
Only cookies strictly necessary for the proper functioning of the Store are used (e.g., cart handling, user session management, login panel security). These cookies do not require separate user consent pursuant to Article 173(3) of the Polish Telecommunications Law.
§7. Stripe
Payments may be processed via Stripe.
Stripe processes payment data in accordance with its own privacy policy.
The Controller does not store payment card numbers.
§8. PayPal
The Customer may make payments via PayPal.
PayPal independently processes payment data in accordance with its own privacy policy.
§9. Google Fonts
The website may use Google Fonts.
When fonts are downloaded, Google may receive the user’s IP address and basic technical information.
If the fonts are hosted locally, this data is not transferred to Google.
§10. Newsletter and Mailchimp
The User may voluntarily subscribe to the newsletter by ticking the relevant checkbox during checkout or via the subscription form available on the website. The checkbox is not pre-checked and requires an active action by the User.
Subscription to the newsletter occurs only after the User has given consent, e.g. by ticking a box with the following wording:
“Keep me updated! I’d like to receive the HEMA MANUAL newsletter with new books, digital publications, exclusive content and occasional special offers. I understand that I can unsubscribe at any time. Please see our Privacy Policy.”
Giving consent is voluntary and is not a condition for concluding or performing the sales contract.
To confirm the validity of consent, subscribing to the newsletter may require additional confirmation via an activation link sent to the provided email address (double opt-in), if this feature is active in the Mailchimp system.
Personal data processed in connection with sending the newsletter includes, in particular:
– email address,
– date and time consent was given,
– IP address or other information confirming that consent was given (if recorded),
– information regarding newsletter-related activity, such as message opens and link clicks, if these functions are available and active in the Mailchimp system.
Personal data related to the newsletter is processed on the basis of Article 6(1)(a) GDPR, i.e. the consent of the data subject.
The newsletter is sent via the Mailchimp platform, provided by The Rocket Science Group LLC, part of Intuit Inc. Mailchimp acts as a data processor on behalf of the Controller.
In connection with the use of Mailchimp, personal data may be transferred outside the European Economic Area, in particular to the United States. Data is transferred in accordance with applicable GDPR requirements, based on Mailchimp’s certification under the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, and additionally using the European Commission’s Standard Contractual Clauses (SCC) as an additional safeguard mechanism.
The User may withdraw consent to receive the newsletter at any time by:
– clicking the “Unsubscribe” link included in every newsletter message,
– contacting the Controller at info@hemadeck.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Personal data processed for the purpose of sending the newsletter will be retained until consent is withdrawn or the Controller ceases to provide the newsletter service. Data of subscribers who show no activity (no message opens or link clicks) for a period of 24 months may be deleted or anonymized, in accordance with the data minimization principle under Article 5(1)(e) GDPR.
§11. Google Analytics
The Controller does not currently use Google Analytics or any other analytics tools requiring cookie consent.
Should such a tool be implemented in the future, this Privacy Policy will be updated accordingly, and a mechanism for obtaining user consent prior to the collection of analytics data will be implemented on the website, in accordance with applicable regulations.
§12. Cloudflare
The Controller does not currently use Cloudflare services.
Should this service be implemented in the future, this Privacy Policy will be updated accordingly. Cloudflare could then process IP addresses and technical data necessary to enhance website security, protect against attacks, and improve website performance.
§13. Hosting
The website is maintained on servers provided by an external hosting service provider.
The hosting provider may process data contained in server logs, in particular:
– IP address,
– date and time of connection,
– browser information,
– HTTP requests.
This data is used solely to ensure server security and proper functioning.
§14. Data Recipients
Data may be disclosed only to entities necessary for the performance of the contract, in particular:
– payment operators,
– courier companies,
– postal operators,
– hosting providers,
– IT service providers,
– the accounting office,
– public authorities, where required by law.
The Controller does not sell personal data.
§15. Transfer of Data Outside the European Economic Area
Data may be transferred outside the European Economic Area in connection with the use of services provided by the following entities:
– Stripe – payment processing,
– PayPal – payment processing,
– Mailchimp – newsletter distribution (see §10).
In such cases, data is transferred in accordance with GDPR requirements, using appropriate safeguards such as Data Privacy Framework certification, the European Commission’s Standard Contractual Clauses, or other mechanisms provided for by law. This list will be updated should further services processing data outside the EEA be implemented (e.g., Google Analytics, Cloudflare).
§16. Data Retention Period
Data is retained for:
– the duration of the contract – for the term of the Agreement and until claims arising from it become time-barred,
– the period required by tax and accounting regulations – accounting and tax documents (including invoices) are retained for 5 years, counted from the end of the calendar year in which the tax liability arose,
– the period necessary for pursuing claims – until such claims become time-barred under the Polish Civil Code,
– the validity of marketing consent – until it is withdrawn (see §10 for newsletter-specific details).
§17. Rights of the Data Subject
Every person has the right to:
– access their data,
– rectify their data,
– erase their data (“right to be forgotten”),
– restrict processing,
– data portability,
– object to processing,
– withdraw consent at any time,
– lodge a complaint with the President of the Personal Data Protection Office (PUODO).
To exercise the above rights, please contact the Controller electronically at info@hemadeck.com. The Controller responds to requests without undue delay, no later than one month from receipt.
§18. Data Security
The Controller applies appropriate technical and organizational measures to ensure data security, in particular:
– SSL encryption,
– access control,
– regular software updates,
– antivirus protection,
– backups.
§19. Children’s Data
The website is not intended for persons under 16 years of age.
The Controller does not knowingly collect personal data of children.
If the Controller becomes aware that a child’s personal data under 16 years of age has been processed without the required consent of a legal guardian, the Controller will promptly delete such data.
§20. Changes to the Privacy Policy
The Controller may make changes to this Privacy Policy in the event of changes to the law or the way the website operates.
The current version of the document is always published on the website.
§21. Contact
For matters related to personal data protection, please contact the Controller:
Stark Creations Maks Starkowski
Email: info@hemadeck.com
Website: https://vzfq3q2641d.c.updraftclone.com