Miriam May

…

Privacy policy

Last updated: 14 June 2026

1. Data controller

The Polish-language version of this policy is binding; this is a courtesy translation.

The controller of your personal data is Iwona Miecznikowska, conducting business under the name PRAMATKA Iwona Miecznikowska, ul. Leśna 117B, 05-083 Wyględy, Poland, NIP: 5272173349, REGON: 015161131 (the „Controller”). For data matters: [email protected].

2. What data we process

The scope depends on how you use the website:

Account: e-mail, first name (optionally surname), password (stored only as an encrypted hash), preferred language, optionally an avatar.
Orders and payments: order data, invoice details (name, address, tax ID), purchase and access history. Payments are handled by Stripe — we do not store payment-card data.
Technical and security data: IP address, browser and device type, device identifier (to protect the account against unauthorised sharing), sign-in events, cookies.
Correspondence: the content of messages sent via the contact form or e-mail.

3. Purposes and legal basis

providing services, running the account and fulfilling orders — Art. 6(1)(b) GDPR;
legal obligations (settlements, complaints, accounting) — Art. 6(1)(c) GDPR;
security of the website and accounts, abuse prevention (device verification, error detection) and establishing/defending claims — Art. 6(1)(f) GDPR;
statistics and marketing (cookies) — Art. 6(1)(a) GDPR (your consent).

We use cookies and similar technologies in three categories: necessary (sign-in, security, cart, remembering consent), statistics and marketing. Statistics and marketing cookies run only after you give consent (Google Consent Mode).

For analytics we use Google Analytics 4 and Google Tag Manager (Google) and Microsoft Clarity (Microsoft) — loaded only after consent to „statistics”. For stability and security we use an error-tracking tool (Sentry) that does not profile users.

You can manage consent at any time in „Cookie settings” (site footer). We record the fact of consent (date, scope, version, anonymised identifier/IP) as proof that it was given.

5. Data recipients

We entrust data to trusted processors, only to the extent necessary and under data processing agreements:

Stripe — payment processing;
Amazon Web Services — e-mail delivery (EU region);
Google — statistics (Analytics, Tag Manager) — after consent;
Microsoft — statistics (Clarity) — after consent;
Cloudflare — content delivery network and website protection;
the hosting provider and providers of IT tools supporting the website.

Questions? Write to: [email protected]

6. Transfers outside the EEA

Some recipients (e.g. Stripe, Google, Microsoft, Cloudflare) may process data outside the European Economic Area, including in the USA. This takes place under appropriate safeguards: the EU Standard Contractual Clauses and — where applicable — the EU-US Data Privacy Framework.

7. Retention period

account data — until the account is deleted or an effective objection is raised;
order data and accounting documents — for the period required by law (incl. tax);
security logs — for the time necessary for security purposes and claims;
data processed based on consent — until consent is withdrawn;
cookie-consent records — for the period necessary to demonstrate accountability.

8. Your rights

You have the right to: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise your rights, write to [email protected].

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

9. Data security

We apply technical and organisational measures appropriate to the risk, including: encrypted connections (HTTPS), storing passwords only as hashes, account protection through verification of new devices (one-time e-mail code), and monitoring of errors and abuse.

10. Voluntariness and changes

Providing data is voluntary but necessary to create an account and fulfil orders. We may update this policy — the version published on the website applies; we will announce material changes on the website or by e-mail. For purchases and services, see the Terms of service.

On-site activity

For logged-in users and for devices previously linked to an account, we record the pages visited, the time spent on them and the entry source. Purpose: analysing how the service is used, user support and improving the service. The legal basis is the controller's legitimate interest (Art. 6(1)(f) GDPR). We keep this data for up to 365 days, after which it is deleted automatically. Identification is based on a device cookie. You have the right to access, object to the processing of, and erase this data — write to the contact address provided on the site.