Privacy policy
Version effective from 01.06.2026
What is the privacy policy?
We would like to familiarize you with the details of how we process your personal data, to give you full knowledge and comfort in using our website.
As we operate in the online industry ourselves, we know how important the protection of your personal data is. Therefore, we make special efforts to protect your privacy and the information you provide to us.
We carefully select and apply appropriate technical measures, especially those of a programming and organizational nature, ensuring the protection of processed personal data. Our website uses encrypted data transmission (SSL), which ensures the protection of data identifying you.
In our Privacy Policy, you will find all the most important information regarding the processing of your personal data by us. We ask you to read it and we promise it will not take you more than a few minutes.
Who is the administrator of the malita.design website?
The administrator of the website is Elżbieta Malita-Stępień, conducting business activity under the company MALITA Elżbieta Malita-Stępień, entered into the register of entrepreneurs of the Central Register and Information on Economic Activity kept by the minister competent for economy at the address ul. Jesionowa 58, 56-321 Bukowice, NIP 9121824549, REGON 363832660 (i.e.: us).
Personal data
What legal act regulates the processing of your personal data?
Your personal data is collected and processed by us in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), commonly known as: GDPR.
To the extent not regulated by GDPR, the processing of personal data is regulated by the Personal Data Protection Act of May 10, 2018.
Who is the administrator of your personal data?
The administrator of your personal data is Elżbieta Malita-Stępień, conducting business activity under the company MALITA Elżbieta Malita-Stępień, entered into the register of entrepreneurs of the Central Register and Information on Economic Activity kept by the minister competent for economy at the address ul. Jesionowa 58, 56-321 Bukowice, NIP 9121824549, REGON 363832660, phone: +48 669380068, e-mail: info@malita.design.
You can contact us regarding your personal data using:
- electronic mail: info@malita.design,
- traditional mail: ul. Jesionowa 58, 56-321 Bukowice,
- telephone: +48 669380068.
How do we process your personal data that you provide to us?
What personal data do we process and for what purposes do we process it?
On our website, we offer you many different services, for which purposes we process various personal data, based on different legal grounds.
| Purpose | Personal data | Legal basis for processing | Data retention period |
|---|---|---|---|
| conclusion and performance of the contract | name, surname, correspondence address, NIP, e-mail address, phone number, bank account number, payment card number | Art. 6(1)(b) GDPR, i.e., processing for the purpose of taking action at your request, before concluding a contract, and processing necessary for the performance of a contract to which you are a party | until the expiry of the limitation period for claims related to the performance of the contract |
| account creation and management | name, surname, e-mail address | Art. 6(1)(b) GDPR, i.e., processing for the purpose of taking action at your request, before concluding a contract, and processing necessary for the performance of a contract to which you are a party | until the expiry of the limitation period for claims related to the performance of the contract |
| newsletter | email address, name | Art. 6(1)(a) GDPR, i.e., processing based on your consent to the processing of your personal data | until the consent to the processing of personal data is withdrawn |
| contact form | name, surname, e-mail address, phone number | Art. 6(1)(f) GDPR, i.e., processing for the purpose of pursuing our legitimate interest, consisting in maintaining communication continuity and enabling contact with us regarding our business activities | until an objection to the processing of personal data is raised |
| analysis of traffic on the online store website | name, place of residence, IP address, browser data | Art. 6(1)(f) GDPR, i.e., processing for the purpose of pursuing our legitimate interest consisting in analyzing customer traffic on the store's website | until an objection to the processing of personal data is raised |
| direct marketing of our own goods and services, including remarketing | name, place of residence, IP address, browser data | Art. 6(1)(f) GDPR, i.e., processing for the purpose of pursuing our legitimate interest consisting in direct marketing of our own services, including remarketing | until an objection to the processing of personal data is raised |
| establishment, assertion and enforcement of claims and defense against claims in proceedings before courts and other state authorities | first name, last name, residential address, PESEL number, NIP, REGON, e-mail address, phone number, IP address, bank account number, payment card number | Art. 6(1)(f) GDPR, i.e., processing for the purpose of pursuing our legitimate interest, consisting in the establishment, assertion and enforcement of claims and defense against claims in proceedings before courts and other state authorities | until the expiry of the limitation period for claims related to the performance of the contract |
| fulfillment of legal obligations arising from legal provisions, in particular tax and accounting regulations | first name, last name, company name, PESEL number, NIP or REGON, e-mail address, phone number, correspondence address, payment card number | Art. 6(1)(c) GDPR, i.e., processing is necessary for the fulfillment of legal obligations incumbent upon us, arising from legal provisions, in particular tax and accounting regulations | until the expiry of the legal obligations incumbent upon the Controller, which justified the processing of personal data |
Voluntary provision of personal data
The provision of the required personal data by you is voluntary but is a condition for us to provide services to you (e.g., account creation).
Recipients of personal data
You can find the current list of entities to whom we disclose your personal data here.
Automated decision-making (including profiling)
We use tools through which we direct personalized advertisements to you. Based on your actions in the Store, in particular the selection of content viewed and the time spent on subpages of the Store, we adapt and display marketing content tailored to you.
Thanks to such profiling, we can direct marketing messages that are more desired by you, which is a benefit for both us and you, as we thus limit marketing messages concerning goods and services that are not of interest to you.
Will your personal data be transferred outside the EEA or to an international organization?
In order to use Google's tools, your personal data may be transferred to the United States, where Google LLC's servers are located.
Google LLC is listed among the entities participating in the Data Privacy Framework program (link: https://www.dataprivacyframework.gov/s/participant-search), and therefore the protection of personal data is adequate in relation to the regulations in force in the European Union, in accordance with Commission Implementing Decision (EU) C(2023) 4745 of 10 July 2023 on an adequate level of personal data protection pursuant to the EU-USA Data Privacy Framework (link: https://commission.europa.eu/system/files/2023-07/Adequacy%20decision%20EU-US%20Data%20Privacy%20Framework.pdf).
In order to use Facebook's tools, your personal data may be transferred to the United States, where Meta Platforms Inc.'s servers are located.
Meta Platforms Inc. is listed among the entities participating in the Data Privacy Framework program (link: https://www.dataprivacyframework.gov/s/participant-search), and therefore the protection of personal data is adequate in relation to the regulations in force in the European Union, in accordance with Commission Implementing Decision (EU) C(2023) 4745 of 10 July 2023 on an adequate level of personal data protection pursuant to the EU-USA Data Privacy Framework (link: https://commission.europa.eu/system/files/2023-07/Adequacy%20decision%20EU-US%20Data%20Privacy%20Framework.pdf).
What rights do you have in connection with our processing of your personal data?
Based on GDPR, you have the right to:
- requests for access to your personal data,
- requests for rectification of your personal data,
- requests for erasure of your personal data,
- requests for restriction of processing of personal data,
- objecting to the processing of personal data,
- requests for portability of personal data.
If you submit any of the above requests to us, we will respond without undue delay – and in any event within one month of receipt of the request – with information on the actions taken in response to your request.
If necessary, we may extend the one-month period by a further two months due to the complex nature of the request or the number of requests.
In any case, we will inform you within one month of receiving the request about the extension of the deadline and provide you with the reasons for the delay.
Right of access to personal data (Art. 15 GDPR)
You have the right to obtain information as to whether we process your personal data. If we process your personal data, you have the right to:
- access to personal data,
- obtain information about the purposes of processing, categories of personal data processed, recipients or categories of recipients of such data, the planned period of storage of your data or the criteria for determining this period, the rights you have under the GDPR and the right to lodge a complaint with the President of the Personal Data Protection Office, the source of this data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of this data outside the European Union;
- obtain a copy of your personal data.
If you wish to request access to your personal data, submit your request to: info@malita.design.
Right to rectification of personal data (Art. 16 GDPR)
If your personal data is incorrect, you have the right to request immediate rectification of your personal data from us. You also have the right to request that we supplement your personal data. If you wish to request rectification or supplementation of your personal data, submit your request to: info@malita.design.
Right to erasure of personal data, the so-called „right to be forgotten” (Art. 17 GDPR)
You have the right to request the erasure of your personal data when:
- Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- you have withdrawn your consent, to the extent that personal data were processed based on your consent;
- Your personal data have been processed unlawfully;
- you have objected to the processing of your personal data for direct marketing purposes, including profiling, to the extent that the processing of personal data is related to direct marketing;
- you have objected to the processing of your personal data in connection with processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of the legitimate interests pursued by us or by a third party.
Despite the request for erasure of personal data, we may continue to process your data for the purpose of establishing, pursuing or defending claims, about which you will be informed.
If you wish to request the deletion of your personal data, submit your request to: info@malita.design.
Right to request restriction of personal data processing (Art. 18 GDPR)
You have the right to request the restriction of the processing of your personal data when:
- you contest the accuracy of your personal data – in such a case, we will restrict the processing of your personal data for a period enabling us to verify the accuracy of this data;
- the processing of your data is unlawful, and instead of deleting personal data, you request the restriction of the processing of your personal data;
- your personal data are no longer needed for the purposes of processing, but they are required for the establishment, exercise, or defense of legal claims;
- you have objected to the processing of your personal data – until it is determined whether our legitimate interests override the grounds indicated in your objection.
If you wish to request the restriction of the processing of your personal data, submit your request to: info@malita.design.
Right to object to the processing of personal data (Art. 21 GDPR)
You have the right to object at any time to the processing of your personal data, including profiling, in connection with:
- processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of the legitimate interests pursued by the data controller or by a third party;
- processing for direct marketing purposes.
If you wish to object to the processing of your personal data, submit your request to: info@malita.design.
Right to request data portability (Art. 20 GDPR)
You have the right to receive your personal data from us in a structured, commonly used, machine-readable format and to transmit it to another data controller.
By default, we will provide you with your personal data in CSV format. If you prefer the data to be provided in a different format, please indicate your preferred format in your request. We will endeavor to provide you with the data in your preferred format whenever possible.
You may also request that we transmit your personal data directly to another controller (if technically feasible).
If you wish to request the transfer of your personal data, please submit your request to: info@malita.design.
Can you withdraw your consent to the processing of personal data?
You may withdraw your consent to the processing of your personal data at any time. Withdrawal of consent to the processing of personal data does not affect the lawfulness of processing carried out by us based on your consent before its withdrawal.
If you wish to withdraw your consent to the processing of your personal data, please submit your request to: info@malita.design.
If you wish to withdraw your consent to the processing of personal data for the „Newsletter” service, you can unsubscribe here.
Complaint to a supervisory authority
If you believe that the processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
In Poland, the supervisory authority within the meaning of GDPR is the President of the Office for Personal Data Protection, who replaced GIODO on May 25, 2018.
More information can be found here.
Cookies„
General Information
While browsing the Online Store websites, „cookies” are used, hereinafter referred to as Cookies, which are small text information that is saved on your end device in connection with the use of the Online Store. Their use is intended to ensure the proper functioning of the Online Store websites.
These files allow us to identify the software used by you and to customize the Online Store individually to your needs.
Cookies usually contain the domain name from which they originate, the time they are stored on the device, and an assigned value.
Security
The Cookies used by us are safe for your devices. In particular, it is not possible for viruses or other unwanted or malicious software to get onto your devices through Cookies.
Types of Cookies
We use two types of Cookies:
- Session Cookies: are stored on your device and remain there until the end of the current browser session. The saved information is then permanently deleted from your device's memory. The session cookie mechanism does not allow for the download of any personal data or any confidential information from your device.
- Persistent Cookies: are stored on your device and remain there until they are deleted. The end of the current browser session or the shutdown of the device does not cause their deletion from your device. The persistent cookie mechanism does not allow for the download of any personal data or any confidential information from your device.
Purposes
We also use third-party Cookies for the following purposes:
- configuration of the Online Store;
- creating statistics that help understand how users of the Online Store use the websites, which allows for improving their structure and content through Google Analytics analysis tools, administered by Google Ireland Ltd. with its registered office in Ireland. Google's privacy policy is available at the following link: https://policies.google.com/privacy?fg=1;
- determining the Customer's profile in order to display tailored content in advertising networks, using the Google Ads online advertising tool, administered by Google Ireland Ltd. with its registered office in Ireland. Google's privacy policy is available at the following link: https://policies.google.com/privacy?fg=1;
- collecting information about User behavior using the Facebook Pixel tool, administered by Meta Platforms Ireland Limited, with its registered office in Ireland. Facebook's privacy policy is available at the following link: https://www.facebook.com/help/cookies/.
To learn about the rules for using Cookies, we recommend reading the privacy policies of the aforementioned companies.
Cookies may be used by advertising networks, in particular the Google network, to display ads tailored to your preferences. For this purpose, information about how you navigate the web or the time you spend on the website may be stored.
To view and edit information about your preferences, collected by the Google advertising network, you can use the tool located at the link https://www.google.com/ads/preferences/.
Using your web browser settings or service configuration, you can independently and at any time change the settings regarding Cookies, defining the conditions for their storage and access by Cookies to your device. You can change these settings to block automatic handling of Cookies in your web browser settings or to inform you about their placement on your device each time.
Detailed information about the possibilities and methods of handling Cookies is available in the settings of your software (web browser).