Privacy Policy

Alta Saska sp. z o.o. operates this online sweet shop and is the controller of the personal data described here. Registered office: Kamienna 2, 30-001 Kraków, Poland. Registered in the National Court Register (KRS) under number 0000427509, EUID PLKRS.0000427509. Contact: [email protected].

• Order data — first and last name, email address, delivery address, the items ordered and the chosen delivery and payment method.
• Account data — email address and a securely hashed password if you create an account during checkout.
• Messages — anything you send us through the contact form or by email.
• Device and usage data — IP address, browser type and pages viewed, collected through cookies and server logs.
• Local storage — your basket, wishlist and cookie choice are stored in your own browser, not on our servers, until you place an order.

• To process and deliver your order and to contact you about it — performance of a contract (Art. 6(1)(b) GDPR).
• To create and maintain your account and answer your questions — contract and legitimate interests.
• To keep the shop secure and prevent fraud and abuse — legitimate interests (Art. 6(1)(f) GDPR).
• To keep accounting and tax records — legal obligation (Art. 6(1)(c) GDPR).
• For optional analytics and marketing emails — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We share data only with service providers who help us run the shop: hosting and database providers, delivery carriers, payment and banking providers, and email delivery services. They act on our instructions under a data-processing agreement. We never sell your personal data, and we never share it for third-party advertising.

Where a provider processes data outside the European Economic Area, the transfer is protected by an adequacy decision or by the EU Standard Contractual Clauses.

Order and invoice data is kept for the retention period required by Polish and EU accounting and tax law. Account data is kept until you delete your account. Contact messages are deleted within 24 months. Analytics data is kept for a maximum of 14 months.

You have the right to access, correct, delete and port your data, to restrict or object to processing, and to withdraw consent at any time. Write to [email protected] and we will respond within one month. You may also lodge a complaint with your local data protection authority or with the President of the Personal Data Protection Office (UODO) in Poland.

Traffic is encrypted with TLS, passwords are stored only as salted hashes, and access to order data is limited to the people who need it. No system is perfectly secure, so please use a unique password for your account.

The shop is intended for adults. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.

We may update this policy as the shop changes. The date at the top always shows the current version, and material changes will be announced on this page.