Privacy policy

Version 1.3 of 10 November 2026. In force from 10 November 2026.

Download (PDF): Privacy-Policy-MaLuna-1.3.pdf

This policy explains how we process personal data in the MaLuna online shop at www.mymaluna.pl and www.mymaluna.com (the “shop”). Both addresses are one shop. The policy applies to individual customers, contact persons of businesses, sole traders, visitors to the shop and people who write to us or call us.

This policy is for information only. The shop Terms and Conditions (regulamin) describe the rules for accounts (including business accounts), the shop's electronic services and sales to consumers. The Trade Terms (ogólne warunki handlowe, OWH) describe the approval of business accounts and purchases by businesses.

1. Controller

The controller of your personal data is:

ZOYA GROUP Sp. z o.o.

ul. Szafarnia 11 lok. F8, 80-755 Gdańsk

District Court for Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register (Sąd Rejonowy Gdańsk-Północ w Gdańsku, VII Wydział Gospodarczy Krajowego Rejestru Sądowego)

KRS 0000876118, NIP 5833416299, REGON 387816925

share capital PLN 10,000.00

The MaLuna shop is run by ZOYA GROUP Sp. z o.o. Orders from the shop are handled by the ZOYA GROUP team. It is the same controller, not a different company.

2. Contact on personal data matters

For any matter about personal data, write to us or call us:

• by e-mail: sklep@mymaluna.pl,
• by telephone: +48 784 211 680,
• by post: ZOYA GROUP Sp. z o.o., ul. Szafarnia 11 lok. F8, 80-755 Gdańsk, marked “dane osobowe” (personal data).

If you have a business account, you can also write to sales@mymaluna.com. We will then pass the personal data matter to the team at sklep@mymaluna.pl.

We have not designated a data protection officer.

3. What has changed in the shop

• Previously the shop was a wholesale shop for businesses. Prices were visible only to signed-in accounts.
• From 9 November 2026 the shop also sells to consumers. Retail prices are visible to everyone. Businesses buy in the trade area under the Trade Terms, from the day they enter into force. Access to the trade area is given by a business account after verification of the NIP (Polish tax identification number) or EU VAT number (section 7).

An account created when the shop was a wholesale shop stays — you do not need to do anything to keep it. You will see and accept the shop Terms and Conditions when you place your first order or accept your first made-to-order offer (Terms and Conditions § 16(5)). If you buy as a business, you will see trade prices after verification of your NIP or EU VAT number (section 7). If your account does not contain this number, enter it in your account details or write from your account e-mail address to sales@mymaluna.com. You can delete your account at any time (Terms and Conditions § 3(4)(4)).

We may delete an account because its e-mail address has not been confirmed only after a reminder sent by e-mail to the account address; a reminder that comes back as undelivered is not enough. The reminder gives notice of the deletion and states its date — not earlier than the day after the end of 90 days from sending the reminder. If you confirm the address at the latest on the day before that date — by the link in the e-mail or by replying to the reminder from the account address — we will not delete the account (Terms and Conditions § 3(4)(6)).

4. Where we get your data from

1. From you — when you create an account, place an order, subscribe to the newsletter or to a product availability notification, write to us (by e-mail, by text message (SMS) or through the contact form on the “Contact” page) or call us, make a complaint or withdraw from a contract. The shop Terms and Conditions describe the shop's electronic services and the terms for using them (§ 3(1)).

2. From public registers — when you create a business account with a NIP. We check this number in three registers:

• Statistics Poland (Główny Urząd Statystyczny, GUS) — REGON register,
• Ministry of Finance — list of VAT taxpayers (the “white list”, biała lista),
• European Commission — VIES system (VAT numbers of businesses from other EU countries).

These registers are publicly accessible. We obtain from them: company name, REGON number, VAT status, type of entity, PKD activity codes, the date the business ceased or was suspended (if any) and, from VIES, whether the EU VAT number is valid and the company name. We do not store the business address from the registers.

3. From the payment operator — whether and when payment for the order was made (applies to online payments, once they are switched on).

4. From your device — through cookies and similar technologies, if you consent, and technical data needed for the shop to work (section 13).

5. From the business you work for or with — when the business names you as a contact person or as the person collecting a delivery (first name, surname, e-mail, telephone, job title).

For a sole trader, data from the registers are personal data.

5. What data we process

• Account data: first name and surname, e-mail address, password, address, telephone number if you give it, account language, account type (private person or business).
• Business data: company name, NIP or EU VAT number, country, data from public registers (point 4.2), price group of the account.
• Data of business contact persons: first name and surname, e-mail, telephone and job title of the person whom the business named as a contact person or as the person collecting a delivery (point 4.5).
• Order data: products, sizes, quantities, prices, net and gross value, delivery address and phone number for delivery, delivery and payment method, order status, the initials embroidery option and its text.
• Invoice data: first name and surname or name, address, NIP.
• Complaint and withdrawal data: description of the matter, photos you attach, bank account number for the refund, if you give it.
• Correspondence data: e-mail address and content of the message.
• Phone call and text message data: the phone number you call or text us from or give us for contact, the date and time of the call or text message and the information you give us during the call or in the text message, for example the design and size to be made to order (Terms and Conditions § 5a). We do not record calls.
• Availability notification data: e-mail address and the product whose availability we are to notify you about.
• Technical data: IP address, device and browser identifiers, information about your use of the shop — to the extent described in section 13.

We do not ask for children's data. If you order embroidery, you give initials (up to 3 characters); they may be a child's initials. We use them only to fulfil the order.

6. Purposes, legal bases and retention periods

Abbreviations: “GDPR” = Regulation (EU) 2016/679 (General Data Protection Regulation); “Article 6(1)(a)/(b)/(c)/(f)” = legal basis under the GDPR; “PKE” = Electronic Communications Law of 12 July 2024 (ustawa z 12.07.2024 – Prawo komunikacji elektronicznej); “KC” = Civil Code (Kodeks cywilny).

Our legitimate interests (Article 6(1)(f)):

• row 6: we want to be sure that only the account of an active business gets trade prices and terms, and for this purpose we check which new accounts have a NIP;
• rows 9 and 10: we want to be able to show that you gave consent, and to protect ourselves in a dispute;
• row 11: we want to respond to your message or call and keep a record of the matter in case you come back to it;
• row 15: we want to protect the shop and customer data against attacks, errors and loss;
• row 16: we want to conclude and perform the contract with the business that named you as a contact person or as the person collecting a delivery.

Where the same type of data serves several purposes, we keep it until the end of the longest of these periods. When the period ends, we delete or anonymise the data.

7. Verification of business accounts and checks of wholesale orders

A person from our team whom we have authorised to do so verifies business accounts and checks wholesale orders manually. The rules are:

1. Who it applies to. We check business accounts in which a NIP or an EU VAT number has been provided, and accounts for which a business asks by e-mail for access to the trade area. We do not check other accounts in the registers and do not change their group.

2. What the person checks. The person sends the NIP from the account data to the registers listed in point 4.2. For a business from Poland, they check whether the business is an active VAT taxpayer and whether it is active in the REGON register kept by GUS. For a business from another EU country, they check whether the EU VAT number is valid in VIES.

3. Positive result. Where the registers confirm the business, we assign the account to the trade group. The account then sees trade prices.

4. Any other result. Where the registers do not confirm the business, a person authorised by us reviews the matter. A difference in the spelling of the company name, where the number is confirmed, does not stop approval; a person authorised by us may check it later. If the check shows that the account indicates a different business from the one with that NIP, or another case in which the Trade Terms allow approval to be refused (Trade Terms § 3(6)), a person authorised by us may withdraw approval of the business account (Trade Terms § 3(8a)). The account then loses the trade group and trade prices; orders already accepted will be fulfilled. We inform you of this by e-mail with reasons; you can present your point of view (point 6). Only a person authorised by us makes a refusal. We decide no later than on the working day following the day on which the NIP or EU VAT number was provided (Trade Terms § 3(4)). A number provided before the Trade Terms enter into force is treated as if it had been provided on the day they enter into force.

5. Minimum check. We check whether a business's first order meets the threshold in the Trade Terms. If it does not, the order gets the status “to be completed” (do uzupełnienia) and we inform you of this by e-mail. If a pre-order exceeds the piece limit in the Trade Terms, we inform you by e-mail how many pieces we can accept (Trade Terms § 5(7)). We do not cancel orders automatically.

6. Your rights. If you disagree with the result or with the withdrawal of approval of the business account (point 4), write to sales@mymaluna.com. A person authorised by us will review the matter. You can present your point of view and contest the decision.

We do not make decisions based solely on automated processing, including profiling. Approval of a business account and assignment of the group (point 3), refusal and withdrawal of approval (point 4) and a change of order status (point 5) are decided by a person from our team. We do not use profiling for marketing purposes.

8. Who we share data with

8.1 Entities that process data on our behalf (processors)

They use the data only on our instructions and only for the purpose for which we provided them.

8.2 Entities that process data as controllers for their own purposes

• Payment operators — when you pay online, the payer's data are processed by the operator shown when the payment method is chosen. Bank transfer to the bank account given in the order confirmation e-mail or in the made-to-order offer does not go through a payment operator and remains available after online payments are switched on. The online payment operators are Autopay S.A., based in Sopot (national payment institution, reg. no. IP17/2013), within Shoper Płatności, and Stripe. Autopay S.A. processes the payer's data as a separate controller. Stripe processes the payer's data on our behalf when it carries out the payment, and as a controller for its own purposes, in particular when it detects and prevents fraud, mitigates losses and security risks, complies with legal obligations (for example anti-money laundering) and analyses and develops its products and services, including its fraud prevention models. The operators' privacy policies describe the rules (Stripe: https://stripe.com/privacy).
• cyber_Folks S.A. — for the analytics of the shop software provider, if you consent to it in the banner (section 13). Otherwise cyber_Folks S.A. processes data on our behalf (point 8.1).
• Banks holding our accounts for transfer payments (in Polish zloty and in euro) — for transfer payments and refunds.
• Courier companies and postal operators — they deliver orders by the delivery method chosen in the basket or stated in the made-to-order offer. They receive the first name and surname, delivery address, telephone and e-mail needed for delivery.
• Law firm — where needed for the establishment, exercise or defence of legal claims.
• Public authorities — where the law requires it, for example tax authorities.

8.3 Public registers to which we send the NIP

When you create a business account, we send the NIP or EU VAT number to: Statistics Poland (REGON register), the Ministry of Finance (list of VAT taxpayers) and the European Commission (VIES). We send only the number. These registers are also the source of data about the business (point 4.2).

8.4 Providers of tools on the shop website

9. Transfers of data outside the European Economic Area

The providers listed in points 8.1 and 8.4 and the payment operators (point 8.2) may use servers or subcontractors outside the European Economic Area (EEA). This applies in particular to Google (tools on the shop website, point 8.4 and section 13) and Stripe (point 8.2): their services may involve a transfer of data to the United States. Google's privacy policy describes how Google processes data: https://policies.google.com/privacy.

If a provider or operator listed above transfers data outside the EEA, it may do so only with the safeguards required by the GDPR, in particular on the basis of a European Commission decision finding an adequate level of protection (for the United States — the EU-U.S. Data Privacy Framework, for organisations that have joined it) or of standard contractual clauses adopted by the European Commission.

When you order delivery to a country outside the EEA, the data needed for delivery (point 8.2) go to that country through the carrier, because the parcel cannot be delivered otherwise. If the European Commission has not found an adequate level of protection for that country, the transfer is necessary for the performance of the contract with you (Article 49(1)(b) GDPR) and, where another person collects the parcel, for the performance of a contract concluded in that person's interest (Article 49(1)(c) GDPR).

On request sent to sklep@mymaluna.pl we will tell you which providers transfer data outside the EEA and on what basis, and we will give you a copy of the safeguards (for example, the text of the clauses).

10. Your rights

You have the right:

• of access to your data and to receive a copy of them (Article 15 GDPR),
• to rectification of your data (Article 16 GDPR),
• to erasure of your data (Article 17 GDPR) — for example where they are no longer needed or you have withdrawn consent; we will not erase data that we must keep, for example data from invoices,
• to restriction of processing (Article 18 GDPR),
• to data portability (Article 20 GDPR) — for data you provided on the basis of a contract or consent,
• to object (Article 21 GDPR) — section 11,
• not to be subject to a decision based solely on automated processing, and to ask for a human to review the matter (Article 22 GDPR) — section 7,
• to withdraw consent at any time — for example through the “unsubscribe” link in the newsletter, in the account settings or in the cookie banner. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

When we rectify or erase your data, we will tell the recipients to whom we disclosed them. On request, we will tell you who these recipients are.

We reply to requests without undue delay and at the latest within one month. In complex cases we may extend this period by two months. We will inform you of the extension and the reasons for it within the first month. The reply is free of charge. Where we have reasonable doubts about your identity, we may ask for additional information.

Complaint to a supervisory authority. If you consider that we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, www.uodo.gov.pl. You can also lodge a complaint with the supervisory authority in the EU country where you live or work.

11. Right to object

You can object at any time, on grounds relating to your particular situation, to processing of your data based on our legitimate interest (Article 6(1)(f) GDPR). This applies to rows 6, 9 (proof of consent), 10, 11, 15 and 16 of the table in section 6. After an objection, we will stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds for the processing which override your interests, or grounds for the establishment, exercise or defence of legal claims.

An objection to direct marketing is always effective. We do not carry out marketing based on legitimate interest. We send the newsletter only with consent.

Send your objection to sklep@mymaluna.pl. Send an objection to the cyber_Folks S.A. analytics (section 6, row 13) to bok@shoper.pl (section 13).

12. Do you have to provide data

Providing data is voluntary. However, without some data we cannot conclude or perform a contract:

• without an e-mail address and a password you cannot create an account;
• without an e-mail address you cannot sign up for the newsletter or for a product availability notification;
• without your first name and surname, delivery address and e-mail address we cannot fulfil an order and, for a made-to-order product, also without a phone number for the carrier (Terms and Conditions § 5a(2));
• without an e-mail address we cannot send a made-to-order offer or conclude that contract (Terms and Conditions § 5a); you do not have to call us — you can ask by e-mail;
• without a NIP we cannot open a business account or show trade prices;
• invoice data are a statutory requirement if you want to receive an invoice — VAT law sets out what an invoice must contain;
• consent to the newsletter and to analytics cookies is voluntary. You can buy in the shop without it.

13. Cookies and similar technologies

What they are. Cookies are small files stored in your browser. Browser storage (local storage) works in a similar way. Without your consent we store only what is necessary for the shop to work and for the service you ask for (for example the basket, signing in, remembering your choice in the banner).

Tools in the shop:

For the software provider analytics category (on mymaluna.pl: “Analityczne dostawcy oprogramowania”) the controller is cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, KRS 0000685595. It keeps the data for 90 days or until it upholds an objection, whichever comes first. The legal basis is the legitimate interest of cyber_Folks S.A. (Article 6(1)(f) GDPR) — send any objection to bok@shoper.pl; you can withdraw consent to cookies in this category in the banner. The data may also be processed by entities outside the European Union, on the basis of standard contractual clauses. The rules are described in the cyber_Folks S.A. privacy policy for visitors to online shops (in Polish): https://www.shoper.pl/regulamin/polityka-prywatnosci-dla-osob-odwiedzajacych-sklepy-internetowe/ (contact: bok@shoper.pl).

On request sent to sklep@mymaluna.pl we will give you a list of the cookies used in the shop, with their names and retention periods.

Other resources. The shop loads fonts from its own server. On the order summary and payment pages, the shop connects to the platform operator's payment service (appstore-bridge.prod.shoper.cloud). When you choose delivery to an InPost parcel locker (Paczkomat) in the basket, the shop shows the InPost parcel locker map and search — your browser then loads them from the servers of InPost sp. z o.o. (point 8.4).

How to manage consent. On your first visit to the shop we show the banner “We respect your privacy” (on mymaluna.pl: “Szanujemy Twoją prywatność”). You can accept all cookies, accept only the necessary ones or customise your consents (on mymaluna.pl the buttons are “Zaakceptuj wszystkie”, “Zaakceptuj tylko niezbędne” and “Dostosuj zgody”). You can change your choice at any time through the link to the cookie settings in the shop footer. You can also delete or block cookies in your browser settings. Blocking necessary cookies may make shopping difficult.

14. Changes to the policy

We change the policy when the law, the way the shop works or the list of providers changes. We publish the new version on this page with the date from which it applies. We inform you by e-mail, before they take effect, about changes to this policy made after it comes into force that concern your account or your newsletter subscription. We make previous versions available on request.