Privacy Policy of the Herbablast Store

Last updated: August 4, 2026

§ 1. Data Controller

The controller of personal data collected via the online store herbablast.eu is Konrad Siej, operating a sole proprietorship, Tax ID (NIP): 7141984367, REGON: 523848745, registered address: ul. Władysława Łokietka 2, 21-100 Lubartów, Poland (the "Controller").

Contact for matters concerning personal data: hello@herbablast.eu.

§ 2. What Data We Collect and For What Purpose

2.1. Data Provided in the Order Form

When placing an order, we collect the following data:

• first and last name,
• delivery address,
• email address,
• phone number.

Purpose of processing: concluding and performing the sales contract, including delivery, handling complaints, and communication regarding the order.

Legal basis: Article 6(1)(b) GDPR (processing necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract).

TODO[TO BE CONFIRMED: if the order form collects additional fields beyond those listed above (e.g. order notes, company details for invoicing, postal code as a separate field), update this list before publication so it fully matches the actual form.]

2.2. Newsletter

If you choose to subscribe to the Store's newsletter, we will process your email address in order to send information about news, promotions, and the Store's offering.

Purpose of processing: sending marketing content electronically (newsletter).

Legal basis: Article 6(1)(a) GDPR (consent of the data subject) — subscribing to the newsletter is done solely through a voluntary, explicit action (opt-in). Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal, e.g. via the unsubscribe link in every message or by contacting the Controller.

2.3. Data Arising from Legal Obligations (e.g. Receipts/Invoices)

If we issue a sales document, we process data to the extent required by tax and accounting regulations.

Legal basis: Article 6(1)(c) GDPR (legal obligation to which the controller is subject).

2.4. Email Correspondence

If you contact us by email (hello@herbablast.eu), we process the data contained in that correspondence in order to respond.

Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller — handling correspondence).

§ 3. Sharing Data with Suppliers Fulfilling Shipments (Dropshipping Model)

The Herbablast Store may operate under a model in which some or all of the ordered products are not stocked by the Controller, but are instead packed and shipped directly by an external supplier/manufacturer of the given product (the "Supplier"). As the Store's offering grows, products may come from various independent Suppliers.

Accordingly, the data necessary to fulfill the shipment — first and last name, delivery address, and phone number — is shared with the relevant Supplier solely for the purpose and to the extent necessary to pack and ship the ordered product.

The Supplier processes the shared data solely for the purpose and to the extent indicated by the Controller, i.e. solely to fulfill the shipment of the order, under a data processing agreement concluded with them in accordance with Article 28 GDPR. The Controller ensures that every Supplier entrusted with data guarantees an appropriate level of protection for it.

Legal basis for sharing data with the Supplier: Article 6(1)(b) GDPR (processing necessary for the performance of the sales contract — fulfilling delivery is part of that contract).

§ 4. Trackers and Analytics/Marketing Tools

The Store uses the following analytics and marketing tools, which may process personal data in the form of device identifiers, IP addresses, and on-site behavioral data:

4.1. Consent-Based Operation

None of the above tools load in the user's browser until they give their consent. On the first visit to the site, the user is shown a banner with three equally weighted options:

• "Accept all" — enables both categories (Analytics and Marketing),
• "Reject" — none of the above tools are activated,
• "Customize" — allows separately enabling/disabling each of the two categories (Analytics, Marketing).

The "Necessary" category (which includes, among other things, remembering the consent choice made and the functioning of the shopping cart) is always active and does not require consent, as it is necessary to provide the service requested by the user.

Legal basis:

• for "Necessary" files — Article 6(1)(f) GDPR (legitimate interest of the controller, i.e. ensuring basic site functionality) in conjunction with Article 173 of the Polish Telecommunications Law (storing information or gaining access to information already stored in the user's telecommunications terminal equipment, where necessary to provide the service),
• for the "Analytics" and "Marketing" categories — Article 6(1)(a) GDPR (consent of the data subject), expressed via the cookie banner.

Consent can be withdrawn at any time by changing the settings in the cookie banner, using the "Cookie Settings" button available in the footer of every page of the Store.

4.2. Transfers of Data Outside the European Economic Area

Google, Meta, and Microsoft are entities affiliated with corporate groups headquartered in the United States. To the extent that data processed by GA4, Meta Pixel, or Microsoft Clarity may be transferred outside the European Economic Area, this takes place on the basis of Standard Contractual Clauses approved by the European Commission, forming part of the Data Processing Terms/Addendum of each of these providers.

§ 5. Data Processors in the Technical Infrastructure

5.1. Supabase (Database)

Order data and the product catalog are stored in a database provided by Supabase, configured in the European region (Frankfurt, Germany). This means this data physically remains within the European Union, which simplifies GDPR compliance — there is no need to rely on Standard Contractual Clauses for transferring data to a third country with respect to data storage itself.

5.2. Vercel (Hosting)

The Store's website is hosted on the Vercel Inc. platform, an entity headquartered in the USA. Transfers of data to the USA to the extent necessary for hosting the site take place on the basis of Standard Contractual Clauses contained within the agreement with Vercel (Vercel Data Processing Addendum).

5.3. Resend (Transactional Emails)

TODO[TO BE COMPLETED after implementation: the email address no-reply@herbablast.eu will send automated transactional messages (order confirmations) via the Resend service. Resend processes the Customer's email address and message content for this purpose. The location of Resend's servers should be verified and, if necessary, a data processing agreement/DPA should be concluded with them.]

5.4. Przelewy24 (Payments)

TODO[TO BE COMPLETED after implementation: once the Przelewy24 payment operator is integrated, data necessary to process payments will be shared with PayPro S.A. (the operator of Przelewy24) as an independent data controller with respect to payment settlement, in accordance with its own privacy policy.]

§ 6. Data Retention Period

• Data related to order fulfillment (first and last name, address, email, phone) is retained for the period necessary to perform the sales contract and handle any complaints, and thereafter for the period required by tax and accounting law (generally 5 years, counted from the end of the year in which the tax payment deadline related to the transaction fell) — with respect to data contained in sales documents.
• Data processed on the basis of newsletter consent is retained until consent is withdrawn (unsubscription).
• Data collected by analytics and marketing tools is retained according to the default retention periods set by the given provider:
  • Google Analytics 4: event data retained for 2 months, user data for 14 months,
  • Microsoft Clarity: session recordings retained for 30 days, click data and heatmaps for 13 months,
  • Meta Pixel: data retained in accordance with Meta's internal retention policy (typically up to 2 years for advertising data, although some data, e.g. custom audiences, may have shorter, configurable retention periods).

§ 7. Rights of the Data Subject

The Customer has the following rights under the GDPR:

1. Right of access to data — Article 15 GDPR,
2. Right to rectification of data — Article 16 GDPR,
3. Right to erasure of data ("right to be forgotten") — Article 17 GDPR,
4. Right to restriction of processing — Article 18 GDPR,
5. Right to data portability — Article 20 GDPR,
6. Right to object to processing based on legitimate interest — Article 21 GDPR,
7. Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal — applies to the newsletter and the Analytics/Marketing categories in the cookie banner,
8. Right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

To exercise the above rights, please contact the Controller at hello@herbablast.eu.

§ 8. Voluntariness of Providing Data

Providing personal data in the order form is voluntary, but necessary to conclude and perform the sales contract — without it, placing an order is not possible. Providing an email address to subscribe to the newsletter is entirely voluntary.

§ 9. Automated Decision-Making and Profiling

The Controller does not make decisions concerning Customers based solely on automated processing, including profiling, that would produce legal effects concerning the Customer or similarly significantly affect them. Tools such as Meta Pixel may be used to display personalized ads, but this does not constitute automated decision-making within the meaning of Article 22 GDPR.

§ 10. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy, in particular in connection with changes in law, changes to the scope of the Store's operations, the launch of new features (e.g. newsletter, Przelewy24 payments), or a change of technical service providers. The current version of this document is always available at herbablast.eu/polityka-prywatnosci.