Privacy Policy of the Herbablast Store

Last updated: September 24, 2026

§ 1. Data Controller

The controller of personal data collected via the online store herbablast.eu is Konrad Siej, operating a sole proprietorship, Tax ID (NIP): 7141984367, REGON: 523848745, registered address: ul. Władysława Łokietka 2, 21-100 Lubartów, Poland (the "Controller").

Contact for matters concerning personal data: hello@herbablast.eu.

§ 2. What Data We Collect and For What Purpose

2.1. Data Provided in the Order Form

When placing an order, we collect the following data:

• first and last name,
• delivery address,
• email address,
• phone number,
• invoicing details (Tax ID / NIP, company name) — only if you select the "I want an invoice for a company" option,
• the content of your order comment — if you choose to add one.

Purpose of processing: concluding and performing the sales contract, including delivery, issuing an invoice (where applicable), handling complaints, and communication regarding the order.

Legal basis: Article 6(1)(b) GDPR (processing necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract).

2.2. Newsletter

If you choose to subscribe to the Store's newsletter, we will process your email address in order to send information about news, promotions, and the Store's offering.

Purpose of processing: sending marketing content electronically (newsletter).

Legal basis: Article 6(1)(a) GDPR (consent of the data subject) — subscribing to the newsletter is done solely through a voluntary, explicit action (opt-in). Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal, e.g. via the unsubscribe link in every message or by contacting the Controller.

2.3. Data Arising from Legal Obligations (e.g. Receipts/Invoices)

If we issue a sales document, we process data to the extent required by tax and accounting regulations.

Legal basis: Article 6(1)(c) GDPR (legal obligation to which the controller is subject).

2.4. Email Correspondence

If you contact us by email (hello@herbablast.eu), we process the data contained in that correspondence in order to respond.

Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller — handling correspondence).

2.5. Recent Order Notifications in the Store

The Store uses a recent-order notification mechanism (so-called social proof). After an order is placed, a brief automated notification in the form "Someone from [city] bought [product name]" may appear on the Store's pages, visible to other visitors browsing the Store at that moment.

The notification contains only the city given in the delivery address and the names of the ordered products. It does not display the first or last name, full address, email address, phone number, order value, or any other data allowing the Customer to be identified. Notifications are shown in real time only — we do not build a public list or archive of them for visitors.

Purpose of processing: informing visitors about current activity in the Store and building trust in the Store.

Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller — building trust in the Store and presenting its current activity).

The scope of information presented in the notification (the city name together with the product name, without any identifying data) does not allow visitors to establish the Customer's identity. This mechanism does not constitute profiling or automated decision-making within the meaning of Article 22 GDPR, and no Customer data is transferred to any external entities in connection with it — the notification is generated and displayed solely within the Store.

The Customer has the right to object to this processing on the terms set out in Article 21 GDPR (§ 7 item 6 of the Policy).

§ 3. Sharing Data with Suppliers Fulfilling Shipments (Dropshipping Model)

The Herbablast Store may operate under a model in which some or all of the ordered products are not stocked by the Controller, but are instead packed and shipped directly by an external supplier/manufacturer of the given product (the "Supplier"). As the Store's offering grows, products may come from various independent Suppliers.

Accordingly, the data necessary to fulfill the shipment — first and last name, delivery address, and phone number — is shared with the relevant Supplier solely for the purpose and to the extent necessary to pack and ship the ordered product.

The Supplier processes the shared data solely for the purpose and to the extent indicated by the Controller, i.e. solely to fulfill the shipment of the order, under a data processing agreement concluded with them in accordance with Article 28 GDPR. The Controller ensures that every Supplier entrusted with data guarantees an appropriate level of protection for it.

Legal basis for sharing data with the Supplier: Article 6(1)(b) GDPR (processing necessary for the performance of the sales contract — fulfilling delivery is part of that contract).

§ 4. Trackers and Analytics/Marketing Tools

The Store uses the following analytics and marketing tools, which may process personal data in the form of device identifiers, IP addresses, and on-site behavioral data:

4.1. Consent-Based Operation

None of the above tools load in the user's browser until they give their consent. On the first visit to the site, the user is shown a banner with three equally weighted options:

• "Accept all" — enables both categories (Analytics and Marketing),
• "Reject" — none of the above tools are activated,
• "Customize" — allows separately enabling/disabling each of the two categories (Analytics, Marketing).

The "Necessary" category (which includes, among other things, remembering the consent choice made and the functioning of the shopping cart) is always active and does not require consent, as it is necessary to provide the service requested by the user.

Legal basis:

• for "Necessary" files — Article 6(1)(f) GDPR (legitimate interest of the controller, i.e. ensuring basic site functionality) in conjunction with Article 173 of the Polish Telecommunications Law (storing information or gaining access to information already stored in the user's telecommunications terminal equipment, where necessary to provide the service),
• for the "Analytics" and "Marketing" categories — Article 6(1)(a) GDPR (consent of the data subject), expressed via the cookie banner.

Consent can be withdrawn at any time by changing the settings in the cookie banner, using the "Cookie Settings" button available in the footer of every page of the Store.

4.2. Transfers of Data Outside the European Economic Area

Google, Meta, and Microsoft are entities affiliated with corporate groups headquartered in the United States. To the extent that data processed by GA4, Meta Pixel, or Microsoft Clarity may be transferred outside the European Economic Area, this takes place on the basis of Standard Contractual Clauses approved by the European Commission, forming part of the Data Processing Terms/Addendum of each of these providers.

§ 5. Data Processors in the Technical Infrastructure

5.1. Supabase (Database)

Order data and the product catalog are stored in a database provided by Supabase, configured in the European region (Frankfurt, Germany). This means this data physically remains within the European Union, which simplifies GDPR compliance — there is no need to rely on Standard Contractual Clauses for transferring data to a third country with respect to data storage itself.

5.2. Vercel (Hosting)

The Store's website is hosted on the Vercel Inc. platform, an entity headquartered in the USA. Transfers of data to the USA to the extent necessary for hosting the site take place on the basis of Standard Contractual Clauses contained within the agreement with Vercel (Vercel Data Processing Addendum).

5.3. Resend (Transactional Emails)

Automated transactional messages sent by the Store from no-reply@herbablast.eu (account registration confirmation, password reset, account deletion request confirmation, order confirmation, order shipped and order delivered notifications, review hidden notification, and the newsletter welcome message) are delivered via the Resend service. For this purpose, Resend processes the recipient's email address and the content of the message — for order-related messages this includes the Customer's first name, delivery address (street, postal code, city), the list of ordered products together with prices, and the discount code, if one was used. Messages sent through the contact form (§ 2.4) to hello@herbablast.eu are also delivered via Resend.

The Store's Resend account is configured in the European region (Ireland). This means that the messages sent and the data they contain remain within the European Union — with respect to the processing and storage of the messages themselves, there is no need to rely on Standard Contractual Clauses for transferring data to a third country. The entrustment of data processing is governed by a Data Processing Agreement concluded with Resend upon creation of the account.

5.4. Przelewy24 (Payments)

Payments for orders are handled by the Przelewy24 service, operated by PayPro S.A. with its registered office in Poznań, Poland (ul. Pastelowa 8, 60-198 Poznań). To process a payment we share your e-mail address, first and last name, and the order amount and number with PayPro S.A. PayPro S.A. processes this data as an independent data controller — to the extent necessary to handle and settle the payment — in accordance with its own privacy policy available at przelewy24.pl. We receive back only the payment status and a transaction identifier; we have no access to your card or bank account details.

§ 6. Data Retention Period

• Data related to order fulfillment (first and last name, address, email, phone) is retained for the period necessary to perform the sales contract and handle any complaints, and thereafter for the period required by tax and accounting law (generally 5 years, counted from the end of the year in which the tax payment deadline related to the transaction fell) — with respect to data contained in sales documents.
• Data processed on the basis of newsletter consent is retained until consent is withdrawn (unsubscription).
• Data collected by analytics and marketing tools is retained according to the default retention periods set by the given provider:
  • Google Analytics 4: event data retained for 2 months, user data for 14 months,
  • Microsoft Clarity: session recordings retained for 30 days, click data and heatmaps for 13 months,
  • Meta Pixel: data retained in accordance with Meta's internal retention policy (typically up to 2 years for advertising data, although some data, e.g. custom audiences, may have shorter, configurable retention periods).

§ 7. Rights of the Data Subject

The Customer has the following rights under the GDPR:

1. Right of access to data — Article 15 GDPR,
2. Right to rectification of data — Article 16 GDPR,
3. Right to erasure of data ("right to be forgotten") — Article 17 GDPR,
4. Right to restriction of processing — Article 18 GDPR,
5. Right to data portability — Article 20 GDPR,
6. Right to object to processing based on legitimate interest — Article 21 GDPR,
7. Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal — applies to the newsletter and the Analytics/Marketing categories in the cookie banner,
8. Right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

To exercise the above rights, please contact the Controller at hello@herbablast.eu.

§ 8. Voluntariness of Providing Data

Providing personal data in the order form is voluntary, but necessary to conclude and perform the sales contract — without it, placing an order is not possible. Providing an email address to subscribe to the newsletter is entirely voluntary.

§ 9. Automated Decision-Making and Profiling

The Controller does not make decisions concerning Customers based solely on automated processing, including profiling, that would produce legal effects concerning the Customer or similarly significantly affect them. Tools such as Meta Pixel may be used to display personalized ads, but this does not constitute automated decision-making within the meaning of Article 22 GDPR. The recent-order notification mechanism described in section 2.5 likewise does not constitute profiling or automated decision-making within the meaning of Article 22 GDPR.

§ 10. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy, in particular in connection with changes in law, changes to the scope of the Store's operations, the launch of new features (e.g. newsletter, Przelewy24 payments), or a change of technical service providers. The current version of this document is always available at herbablast.eu/polityka-prywatnosci.