Last updated: 29 September 2026. This policy explains what personal data Nonsensia collects when you visit nonsensia.pl or place an order, why, who receives it and what rights you have. It describes the shop as it actually works — the services listed below are the ones this website really uses.
1. Who is responsible for your data
The controller of your personal data is Nonsensia, ul. Marszałkowska 80, 00-517 Warszawa, Poland (“Nonsensia”, “we”). Contact for all privacy matters: [email protected], WhatsApp +48 506 848 838 (Monday to Saturday, 8:00–19:00 Polish time).
2. What we collect and why
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Processing and delivering your order, including e-mails about it: order confirmation with payment details, payment reminders for unpaid orders, “payment received” and “shipped” messages | name, delivery and billing address, e-mail, phone number, ordered products, chosen shipping and payment method, selected parcel locker, tracking number | Art. 6(1)(b) – performance of the contract |
| Accounting and tax records | order and payment data, invoices | Art. 6(1)(c) – legal obligation |
| Answering your messages (e-mail, WhatsApp, contact form) | the data you send us; messages sent through the contact form are stored in our website database | Art. 6(1)(b) or 6(1)(f) – our legitimate interest in replying |
| One invitation to review your order on Trustpilot, sent about 10 days after dispatch | e-mail address, order number | Art. 6(1)(f) – legitimate interest; we only send you a link, we do not pass your data to Trustpilot |
| Website statistics (see section 5) | pseudonymous usage data, cookie identifiers | Art. 6(1)(f) – legitimate interest in understanding how the shop is used |
| Security of the website and prevention of abuse | IP address, technical request data | Art. 6(1)(f) – legitimate interest |
Providing order data is voluntary but necessary to buy from us. We do not use your data for automated decision-making or profiling with legal effects, and we do not sell it.
3. Payments
- Bank transfer – you pay directly into our account at Revolut Ltd (EUR) or PKO Bank Polski (PLN), or to our Revolut tag. The banks process the payment data under their own terms.
- BLIK to a phone number – processed by your bank and ours; we match the payment using the order number and the phone number.
- Cryptocurrency – you send the payment directly to our wallet. Blockchain transactions are public by design. To confirm your payment automatically, our payment verification service receives only the order number and order key, the coin, our wallet address, the crypto amount and the order total with its currency — never your name, address or e-mail.
4. Who receives your data
- Carriers – InPost, Polish Post (Poczta Polska) or the parcel-locker operator you choose at checkout receive your name, delivery address or locker, phone number and e-mail to deliver the parcel.
- Hosting – the website and its database run on servers of Hetzner Online GmbH in Germany.
- Content delivery and protection – Cloudflare, Inc. passes all traffic to the website and protects it against attacks.
- E-mail delivery – our e-mail hosting provider sends and stores the messages we exchange with you.
- Statistics and translation – Google (Analytics), Ahrefs (website analytics) and GTranslate (language switcher), see section 5.
- Authorities – only when the law requires it.
Some of these providers (Google, Cloudflare, Ahrefs) may process data outside the European Economic Area. Such transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.
5. Cookies and statistics
| Cookie / tool | What it does | Provider |
|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | keep your cart and checkout working; set only when you add something to the cart | this website |
wordpress_logged_in_* and related | keep you signed in, if you use an account | this website |
_ga, _ga_* | Google Analytics 4 – anonymous statistics about visits and pages | Google Ireland Ltd / Google LLC |
| Ahrefs Analytics | website traffic statistics | Ahrefs Pte. Ltd. |
googtrans | remembers the language you chose in the translation switcher | GTranslate |
Cloudflare security cookies (e.g. __cf_bm), if set | may be set to distinguish people from automated traffic | Cloudflare, Inc. |
Our own first-party statistics work without cookies. You can block or delete cookies in your browser at any time; the shop works without statistics cookies, but the cart needs its own cookies. You can also block Google Analytics with Google’s opt-out browser add-on.
6. How long we keep your data
- Order and accounting records – for the period required by Polish accounting and tax law (5 years from the end of the year in which the order was settled).
- Unpaid orders are cancelled automatically after the payment deadline stated in our e-mails; the record of the cancelled order is kept with our order history.
- Messages and contact-form entries – as long as needed to handle your request and any related claims.
- Statistics – according to the retention settings of the respective tool.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object to processing based on our legitimate interest. Write to [email protected] — we answer within one month. You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl), or with the authority in your country of residence.
8. Security
The whole website is served over an encrypted connection (HTTPS). The website is protected by a firewall and by Cloudflare’s protection against automated attacks.
9. Changes
When the shop starts using a new service that processes personal data, we update this page and the date at the top. Our shop rules are available at nonsensia.pl/rules/.