Privacy Policy - www.fromgreytoglitter.pl -

effective from 29.06.2026

What does the Policy cover and what is its purpose?

Our aim in preparing and providing you with this document is to enable you to easily review how we process your data, to what end, and what legal basis we rely on. Please be assured that we treat your personal data and its protection with the utmost responsibility.
Our Privacy Policy will provide you with up-to-date information. We always publish the latest version on our website. Please note that we may amend it. Should any changes occur that could affect our mutual rights and obligations, we shall inform you of this.
In order to ensure transparency in the processing of your personal data, we endeavour to provide you with clear information about what happens to your personal data when you use our services and why.
This section provides details of the tools we use on our website and the recipients of your personal data (i.e. the parties who have access to your data).
We process your personal data in our capacity as data controller or joint controller (in relation to our social media profiles), i.e. an entity that has access to your data in connection with our relationship with you. We are responsible for ensuring that your data is properly protected and managed in accordance with our arrangements.

✦ExampleWhenever you buy a product from our shop, we hold your personal data as this is necessary for the performance of the sales contract.

You can be assured that we process your personal data on an appropriate legal basis and for the appropriate period of time.

✦ExampleWe process your personal data, which you provide upon placing an order and entering into a contract with us, for the purpose of performing the contract and issuing a proof of payment in accordance with our legal obligations. We retain this data within our company until any potential claims expire, for the period specified by law.

The GDPR grants you several rights in relation to our processing of your personal data, and we respect these rights.
You can always quickly access our Privacy Policy on our website. You have the option to view and save it (at the end of the document you will find a link to the PDF file, which you can download).

The entities we work with ensure a high level of protection for the personal data they process, and we use trusted tools within our company.

IMPORTANT!Whenever we use the following terms in our Privacy Policy:
You, your – we are referring to you as a user of our website, a customer or a subscriber;We, our, us – this refers to us as the controller of your personal data (the seller, the entity responding to your enquiry about an offer), namely Aleksandra Górska, trading as Aleksandra Górska – From Grey to Glitter, under the registered address: ul. Piotrkowska 27/18, 80-180 Gdańsk, NIP 8442165392, REGON 200752060.Our website, the Website, the Shop – refers to https://fromgreytoglitter.com/.
We have not appointed a Data Protection Officer and carry out this role ourselves.

Our contact details:

Please get in touch with us if you have any questions; we’ll reply and explain any issues that are important to you,
email address: info@fromgreytoglitter.com
Telephone number: +48 608293999; customer service office opening hours: 11.00 to 16.00 (CET/CEST).

We have divided the Privacy Policy into six sections. To help you quickly find the information you are looking for, we have divided some sections into chapters.

Key information:

What data do we process, for what purpose and on what legal basis?
Do you have to provide us with your personal data?
What rights do you have under the GDPR?
How long do we process your data for?
Do we profile your data?
Data recipients:
Who has access to your data?
Social media

Social media
Satisfaction survey

What social media accounts do we run?
Do we carry out a satisfaction survey?
Do we send out satisfaction surveys to our customers or potential customers?
Website content
What sort of content can you find on our website?

What sort of content can be found on our website?
Do we use artificial intelligence?
Cookies and tools implemented on the website
Cookies
Tools implemented on the website

Cookies
What are cookies and what purpose do they serve?
Are you required to accept all the cookies used on our website?
What tracking technologies do we use on our website?
What tools have we implemented on the website?
What should you know about Google Consent Mode?
What should you know about Google Site Kit?
What should you know about Google Analytics?
What should you know about Weglot Translate?
What should you know about the META Piksel tool?
What should you know about server logs?
Final provisions
Archive
Key information

What data do we process, for what purpose and on what legal basis?

This is one of the most important parts of this document. It is here that we explain what personal data we receive from you and from other people, and how we process that data.
Our website may contain links to external websites. Please note that we accept no responsibility for the data processing practices or privacy policies of these external websites.
We also set out the legal basis for our access to your data, in order to make it clear how the law governs our relationship.

DATA PROCESSING PURPOSE	SCOPE OF DATA	LEGAL BASIS
Communication with you	– email address (first name and surname), details contained in the body of the message- telephone number- other details provided by you in the correspondence	We process your data in accordance with Article 6(1)(a) of the GDPR, which allows us to process data on the basis of consent in order to reply to your message. We also rely on Article 6(1)(f) of the GDPR, which allows us to pursue our legitimate interest, namely ensuring smooth and effective communication between the website controller/seller and the user/customer.
Placing and fulfilling an order for products/services	first name and surnameaddressemail addresshome addresstelephone numberimageIn addition:TAX IDENTIFICATION NUMBER (NIP)details regarding your business activitiesYou are providing this information voluntarily, but please note that it is essential for us to process your order.	We process your data on the basis of Article 6(1)(b) of the GDPR, which permits the processing of data for the purposes of entering into a contract and fulfilling an order.If you provide us with your image for the purposes of the Consultation, we process it on the basis of your consent, i.e. Article 6(1)(a) of the GDPR.
Invoicing and fulfilling legal and tax obligations	business datafirst name and surnameaddressNIP	We process your data on the basis of Article 6(1)(c) of the GDPR in conjunction with tax legislation, including the Value Added Tax (VAT) Act, which covers the obligation to issue an invoice, archiving it and submitting it to the National e-Invoice System (KSeF). If you are a consumer, we do not issue an invoice to KSeF.
✦ Important: If you are a business owner, your details on the invoice will be sent to the National e-Invoice System (KSeF) in accordance with the statutory requirement. If you are making a purchase as a consumer (a private individual), your invoice will not be sent to the KSeF system, and we will process the data solely within our internal accounting system. In all cases, your data is protected and processed in accordance with the law.
Complaint handling and contract withdrawal	email addressfirst name and surnamedata contained within the complaintbank account numberhome addresstelephone number	We process your data on the basis of Article 6(1)(b) of the GDPR, which permits the processing of personal data where this is necessary for the performance of a contract or for taking steps to enter into a contract. We also rely on Article 6(1)(c) of the GDPR, which permits the processing of personal data where this is required by a legal obligation to which the controller is subject.
Archival and evidential purposes, in order to safeguard information that may serve to establish facts	All the data listed in the table relating to our data processing	We process your data on the basis of Article 6(1)(f) of the GDPR, which permits us to do so where it is in our legitimate interests (in this case, our interest as the data controller is to hold personal data that confirms facts relating to the use of the website, the performance of a contract, and the processing of data in accordance with the law).
Establishing, investigating or defending against claims	all the information listed above	We process your data on the basis of Article 6(1)(f) of the GDPR, which permits us to do so where it is in our legitimate interests (in this case, our legitimate interest is to hold personal data that will help us to establish claims, pursue claims or defend ourselves against claims made by users of the website, third parties or customers).
Website management, use of tools designed to improve the website and analyse data relating to its use	IP addressbehaviour on the website	We process your data on the basis of Article 6(1)(f) of the GDPR, which permits us to do so where it is in our legitimate interests (in this case, our legitimate interest is to optimise the website, including the content displayed on it, to tailor it to users’ needs and to improve our offering).
Use of cookies on the website	IP addressuser behaviour on the website	We process your data on the basis of Article 6(1)(a) of the GDPR, which allows us to process personal data with your consent. You give your consent during your first visit to the website and you can withdraw it at any time.
Managing our social media profiles	user behaviour on the website; data relating to the use of a particular social media platform	We process your data on the basis of Article 6(1)(f) of the GDPR, namely our legitimate interest in managing a profile on a given platform, and on the basis of your consent (Article 6(1)(a) of the GDPR), which you give, for example, when you join a group created by us on a given platform.
Compliance with personal data protection obligations (e.g. the obligation to keep registers and records)	The scope of the data is determined by law and varies depending on the nature of the specific legal obligation that applies to us	We process your data on the basis of Article 6(1)(c) of the GDPR, that is, on the basis of legal provisions requiring the processing of personal data.
Posting comments/reviews on the website	first nameemail address	We process your data on the basis of Article 6(1)(a) of the GDPR, i.e. your consent, which you give when you post a comment or review on our website.
Research into preferences regarding services and products, and analysis of business processes through the use of questionnaires	the data provided in the questionnaire and in the answers to the questionnaire’s questions	The legal basis for processing the data you have provided in the survey or in your responses to the survey questions is your consent (Article 6(1)(a) of the GDPR). Taking part in the survey and providing us with your data is entirely voluntary. The data provided will subsequently be processed by us for archiving purposes and to defend against any claims (Article 6(1)(f) of the GDPR).

Do you have to provide us with your personal details?

Providing personal data is usually voluntary and depends on your decision, however there are situations in which it is required, for example if you purchase a service or product from us.

✦ Example.When you place an order for a product, you must provide us with your personal data so that we can process the order and issue a payment receipt.When you request through our contact form that we get in touch with you, you must provide your contact details so that we can send you a message or call you.When you request through our contact form that we get in touch with you, you must provide your contact details so that we can send you a message or call you.

What rights do you have under the GDPR?

You may write to us at any time at the email address provided, or contact us by other means, to obtain information about how we process your data.
As a data controller, we are obliged to carry out our duties without delay, and no later than within one month. Should this not be possible, we will inform you as to whether we are processing your data. If necessary, we may extend the time limit for responding to your request by up to two further months. Please be assured that we shall endeavour to respond to you as soon as possible.
The GDPR grants you the following rights in relation to the processing of personal data:

The right of access to information and disclosure obligation – this means that you have the right to know how your personal data is being processed.
The right of access to personal data – this means that once we, as the controller of your data, receive a request from you to access your data, it is our legal obligation to provide you with that information.
The right to rectify personal data – this means that if you consider your data to be incorrect, you may request that we rectify it, or request that we complete any incomplete data.
Right to delete personal data, the right to be forgotten – this means you may demand that we, as the controller of your personal data, delete your data and inform any third parties to whom we have disclosed your data of such deletion. You also reserve the right to request that your data, which we have made public, should be deleted by other data controllers as well. We are also obliged, at your request, to inform you to which data recipients we have disclosed your data subject to deletion.
The right to restrict the processing of personal data – this means that you may request that the processing of your personal data be restricted. This is the case, for example, if you dispute the accuracy of the data being processed or if you consider that we no longer need the data for the purposes of processing.
The right to object to the processing of personal data – this means that you may object to us processing your data.
The right to data portability – this means that, subject to certain conditions, you may request the transfer of your data directly to another controller of your choice.
The right of complaint – this means that as soon as you consider that our processing of your data infringes the law, you may lodge a complaint with the President of the Office for Personal Data Protection.
The right to withdraw consent – this means that where we process your data on the basis of your consent, you may withdraw that consent at any time.

d) Please bear in mind that you will not always be entitled to all of these rights in every circumstance. This is not a sign of ill will, but a consequence of the law.

e) Should you withdraw your consent to the processing of your data, such withdrawal will not affect the lawfulness of the data processing we carried out on the basis of your consent prior to its withdrawal.

✦ExampleYou are giving your opinion on our product and granting permission for its publication. After some time, you may wish for us to delete it. In that case, we shall delete your review. The deletion of your review does not alter the fact that it was previously published lawfully, up until the moment you requested its deletion and for the time it takes us to delete it.

How long do we process your data for?

In accordance with the applicable provisions of law, the processing of your data is limited to the period necessary to achieve the specified purpose of such processing. After this period, we shall irrevocably delete or destroy your personal data. The additional year of processing personal data collected for the purposes of performing a contract is due to the fact that you may submit requests to exercise your rights to us just before the expiry of the limitation period.
We process your personal data for varying periods, depending on the basis (purpose) of its processing. To explain this clearly, we have prepared a simple summary in the table below.

PROCESSING PERIOD	LEGAL BASIS (PURPOSE) OF PROCESSING
3 or 6 years + 1 year	in the case of personal data collected for the purpose of establishing, pursuing or defending legal claims; the choice between 3 and 6 years depends on whether both parties are businesses or not;
until a valid objection is lodged or the purpose of processing is achieved,	in the case of personal data processed on the basis of the controller’s legitimate interests;
until the data becomes outdated or loses its usefulness,	in the case of personal data processed primarily for the purposes of administering the website;
until consent is withdrawn or the data loses its usefulness,	in the case of personal data processed on the basis of your consent, unless we have expressly stated otherwise at the time you gave your consent.
10 years from the end of the tax year in which the invoice was issued in the National e-Invoice System	Data contained in structured invoices sent to the National e-Invoice System (KSeF) is stored there for a period of 10 years, in accordance with the requirements of the Goods and Services Tax Act.

Do we profile your data?
We do not use your data for automated decision-making that could affect your legal position or have other similarly significant consequences for you.

This means that the automated systems we use in the course of our business cannot, for example, automatically decide not to enter into a contract with you on the basis of your individual characteristics. If using a tool that relies on automation could have a negative impact on our relationship, we analyse the situation by introducing the ‘human factor’ – in other words, someone from our team checks whether the automation is working correctly in that particular case.

The tools used on our website may track user behaviour in order to improve the site and tailor the content displayed. In this case, we analyse anonymous data (location, age, interests), unless you consent to the use of tools that collect other data (i.e. you consent to the use of specific cookies).
Like every website, we use cookies and analytics tools. Later in this Privacy Policy, we explain how cookies work and how this affects you.

Data recipients
Who has access to your data?

We may share your personal data with third parties whose services we use in connection with the operation of the website www.fromgreytoglitter.com and our social media profiles.
We assure you that we carefully select the organisations with which we collaborate or whose services we use, and we always ensure that data is adequately protected.
Below you will find a list of all the organisations whose services we use and which may have access to your data in connection with our working relationship. We specify the target audience and the extent to which we work with them.
We have divided our audience into two groups: the first group consists of entities that process data within the European Economic Area, and the second group consists of entities that process data outside the European Economic Area (e.g. in the USA).
Where personal data is transferred outside the European Economic Area, the entities carrying out such processing shall ensure an adequate level of data protection in line with EU standards, inter alia by using the standard contractual clauses adopted by the European Commission.

Data processors in the European Economic Area:
LH.PL SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Poznań, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000503852, Poznań – Nowe Miasto and Wilda District Court in Poznań, 8th Commercial Division of the National Court Register, with its registered office and address for service at: ul. Pl. Wolności 6/4, 61-738 Poznań, with share capital of: 37,000 PLN, Tax Identification Number (NIP): 7831711517, REGON: 302693647	A service provider offering IT system maintenance and hosting (data storage on a server)
PayNow, owned by mBank S.A., ul. Prosta 18, 00-850 Warsaw, entered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000025237, NIP: 526-021-50-88; REGON: 001254524	Provider of fast online payments
Polish Ministry of Finance (National e-Invoice System – KSeF)	A public authority authorised to collect and process data contained in structured invoices in accordance with the applicable tax legislation. This applies to invoices issued to businesses (B2B) and, in the case of invoices for consumers (B2C), only where the functionality of the invoicing system we use permits or requires this.
Weglot, 7 Cité Paradis, 75010 Paris, registered with the Paris Trade and Companies Registry under number 818 164 964.	A tool for automatically translating a webpage.

Data processors outside the European Economic Area:
META Inc.	Marketing tools.
Google LLC	A marketing tool.

Social media
What social media accounts do we run?

We run profiles on social media platforms, and our website features plugins that link to them.
We are the profile administrator on this platform, and we process your data (first name, surname, username, and any other information you have provided on your profile) primarily for the purposes of managing our profile, building a community and interacting with our followers.
The provider of a given social media platform sets out the rules governing the platform and the rules governing the processing of data for its own purposes. We therefore encourage you to familiarise yourself with the terms and conditions and privacy policy of each platform. We do not process data collected by social media platforms for our own purposes.
Together with the platform provider, we jointly control data relating to our profile on the platform as part of the pursuit of our shared business objectives (marketing activities, compiling statistics), such as, amongst other things, processing data relating to visits to our profile and the display of our profile via the plugin available on our website. The key terms of the agreements between us and the administrator of a given platform, e.g. Meta Platforms Ireland Ltd., are set out directly in the privacy policies of those websites, which we refer to in this Policy.
The widgets linking to our profiles allow you to access our profile directly by clicking on the platform icon. A social media platform may be able to detect that you are using our website, particularly if you are logged in as a user of that platform.
If you do not want social media platforms to collect information about your activity, we recommend that you log out of your accounts and use your browser in incognito mode.
On our website, you will find links redirecting you to our profiles on the platforms listed below; we also provide links to the platforms’ privacy policies to make it easier for you to familiarise yourself with them:

Facebook: https://www.facebook.com/profile.php?id=61590508037010

The Platform’s privacy policy: https://www.facebook.com/privacy/explanation

Instagram https://www.instagram.com/fromgreytoglitter

The platform’s privacy policy: https://help.instagram.com/519522125107875?helpref=page_content

Do we carry out a satisfaction survey?

We are constantly striving to improve, and your help in this regard is invaluable!

Do we send out surveys to gauge our customers’ satisfaction or gather their feedback?

We want our products and services to be as good as possible, which is why you may receive a survey from us asking questions about our services or products.
We do not require a response – completing the survey is voluntary and, in most cases, anonymous. We would be grateful if you could share your thoughts and feedback on our product or services with us.
If you don’t complete the survey, nothing will happen. You can also choose not to complete it at any time.

Website content
What sort of content can be found on our website?
We publish content on our website by ourselves.

Do we use artificial intelligence?

Yes. As part of the operation of our website (e.g. when creating content), we may use modern technologies, including artificial intelligence (AI)-based tools provided by third parties (e.g. OpenAI, Gemini, Canva).
We ensure that no users’ personal data or content that could directly identify a specific individual is fed into the AI models.
We use AI tools solely for auxiliary and technical support purposes. We do not use artificial intelligence algorithms to make any decisions about you that would have legal consequences or otherwise significantly affect you.
All key processes, responses to enquiries and decisions relating to our interactions with you are ultimately supervised and verified by a human.
Whenever you are interacting directly with an AI-based system, we will clearly indicate this so that you are always aware when you are communicating with an automated system.
In any situation where your enquiry or case is handled automatically (e.g. by AI), you have every right to request to speak to a ‘real’ person. You may do this at any time by emailing us at the address given at the start of this Privacy Policy, and our team will personally review your case and reply to your message.

Cookies and tools implemented on the website
Cookies

We come across cookies every day on the internet. Our website uses them too.

What are cookies and what purpose do they serve?

Cookies are small text files stored on the device you use when browsing websites. They may be read by us (‘first-party cookies’, which we use to ensure this website functions correctly and to improve our offering), as well as by systems belonging to other organisations whose services we use (‘third-party cookies’).
We use our own and third-party cookies on our website (as does every website).
You can find more information about cookies in Cookie Policy available on our website.
Are you required to accept all the cookies used on our website?

No. The first time you visit our website, we display a banner informing you about the cookies used on our site. You can decide which actions you allow. We have indicated which cookies are essential for the functioning of our website (essential cookies), and we have categorised the others into appropriate groups to help you decide how they should be managed in line with your preferences. We have set this out in our Cookie Policy.
Please note that you have the right to change your cookie settings in your browser or to delete them.
If you do not want our website to collect cookies, you can use your browser in incognito mode – please remember to log out of any websites that collect information about your online activity independently of us.

What tracking technologies do we use on our website?

social media plugins that redirect to our social media profiles, as mentioned in more detail above,
analytical and marketing tools, such as: META Piksel, Google Site Kit, Google Analytics, Weglot Translate.
What tools have we implemented on the website?

We have implemented Google Consent Mode, the META Pixel, Google Site Kit, Google Analytics and Weglot Translate.
Below, we provide information about the tools used on our website.
What should you know about Google Consent Mode?

We use tools provided by Google on our website.
Google has required us to provide it with information on whether users of our website consent to the processing of their personal data collected via Google cookies, using the so-called Google Consent Mode, which has been implemented on our website.
Once you have consented to the use of Google cookies, we may use them for marketing purposes (including remarketing and analysing the effectiveness of adverts, i.e. their conversion rates).
On our website, Google Consent Mode operates in its advanced version. Google tags are triggered without your consent and transmit information about whether consent has been given or refused. In the meantime, until you consent to the use of Google cookies, we only pass on anonymous information to Google.
You can read more about the consent process under Google Consent Mode at: https://support.google.com/google-ads/answer/10000067?hl=pl.
We recommend that you familiarise yourself with the provisions set out above.
What should you know about the Google Site Kit tool?

We use Site Kit by Google, which integrates our website with selected Google services. This tool enables us to analyse how the website is used, monitor its performance and the effectiveness of our marketing activities, and gather statistics on visits and user activity.
As part of the Site Kit feature, data may be transferred to Google in accordance with the settings for the Google services we use and the consents given by the user via the cookie management tool.

What should you know about Google Analytics?

We use Google Analytics – an analytics tool provided by Google that helps us understand how users interact with our website. Thanks to it, we can analyse, amongst other things, the number of visits, traffic sources, how visitors navigate the site, the time spent on individual pages, and the effectiveness of our marketing activities.
Google Analytics uses cookies and similar technologies to collect information about users’ activity on the website. This data helps us to develop the website, improve its functionality and better tailor the content to users’ needs.

What should you know about the Weglot Translate tool?

We use the Weglot Translate tool, which enables the automatic translation of the content available on our website into various languages. This allows users to browse the website comfortably in their chosen language.
In order to provide the translation service, Weglot may process information relating to your use of the website, such as your chosen language, IP address and technical details about your device and browser. This data is used only to the extent necessary for the translation service to function properly.

What should you know about the META Piksel tool?

It is an analytical tool, a piece of code embedded on the website.
It allows us to target our marketing activities at people who have visited our website or are interested in what we do.
The data collected by the tool is anonymous (location, gender, age, online activity); however, the provider may combine it with data it has collected about you through your use of its platform.
It helps us gauge the effectiveness of our adverts, reach a specific audience and shows us how they respond to our campaigns.
You can read more about the tool on the supplier’s website:
https://pl-pl.facebook.com/business/help/742478679120153?id=1205376682832142.

What should you know about server logs?

Using our website involves sending requests to the server on which our website is hosted.
We record every query sent to the server in the server logs. These provisions include, amongst other things:

IP address (the number that identifies your device on the network),
the date and time of the call,
information about the web browser,
information about the operating system you are using.

We do this to ensure the security of our services and to better understand how you use them.

c) We do not link the data recorded in the server logs to specific individuals using the website, and we use it solely as supporting material for administrative purposes.

(d) We do not disclose the contents of the server logs to anyone other than those authorised to administer the server.

Final provisions

Our materials. The content published on our website and on our social media profiles may be protected by copyright. Please do not use them for any purpose other than browsing our website, unless we expressly state otherwise.
Do you have any questions? If you have any doubts regarding the legal status of the content provided (or how you can use it without risk), please send us a message (you will find our email address at the beginning of this document), and we shall be happy to reply. Using the content we provide beyond the scope of permitted personal use (i.e. for private purposes) and without our consent may result in legal consequences (including the risk of criminal and civil liability).
Nature of the content. Please bear in mind that the content we provide is for educational purposes only and is not a substitute for individual expert advice.
Changes to the Privacy Policy. The content of this Privacy Policy may change, for example, if we change our service provider or the range of features on the website.
Date updated. For your convenience, we have included the date on which the Privacy Policy was last updated at the beginning of this document.

Thank you for your time!

Archive

Privacy Policy effective from 29.06.2026