PRIVACY AND COOKIE POLICY
OVA online store — www.ova.com.pl
In force from 28 July 2026.
1. Who processes your data
On the www.ova.com.pl website there are two separate entities. Below we explain who is responsible for what — this matters, because it determines who you address your questions and requests to.
1.1. Controller of Store Customers' data
The controller of your personal data processed in connection with purchases in the Store — orders, payments, delivery, complaints, the customer account and customer service — is:
LAYAR Konrad Grochulski
ul. Gruszkowa 13
72-003 Wołczkowo, Poland
NIP: 8512979959
REGON: 320482385e-mail: hello@layarpmu.com
tel.: +48 510 113 730
For matters concerning data related to the fulfilment of orders you may contact LAYAR directly at hello@layarpmu.com. The joint point of contact for all other matters concerning your data — including changes to your account and deletion of data — is office@ova.com.pl.
Administrator has not appointed a data protection officer. The person responsible for matters relating to personal data protection on the Controller's side is Konrad Grochulski — kontakt: hello@layarpmu.com, tel. +48 510 113 730.
1.2. Controller of data relating to the brand and the website
The owner of the website www.ova.com.pl and of the OVA brand is:
OVA Magdalena Mazurek
ul. Katowicka 11/B2
61-131 Poznań, Poland
NIP: PL9482480309
REGON: 141307060e-mail: office@ova.com.pl
tel.: +48 883 773 111
This entity has likewise not appointed a data protection officer. The person responsible for matters relating to personal data protection is Magdalena Mazurek — kontakt: office@ova.com.pl, tel. +48 883 773 111.
This entity is the controller of data in respect of:
- running and maintaining the website and its security,
- running the OVA brand newsletter — as the sole controller of the subscriber database; subscribing to the newsletter is voluntary and requires separate consent, and you may unsubscribe at any time using the link in the message,
- contact on matters relating to the brand, commercial cooperation and distribution,
- performing the function of the responsible person for cosmetic products within the meaning of Regulation (EC) No 1223/2009 — in particular as regards receiving and handling reports of adverse effects of products.
Both entities are JOINT CONTROLLERS of your data within the meaning of Article 26 GDPR. Below — in accordance with Article 26(2) GDPR — we make available the essence of the arrangement between them.
Division of responsibilities:
| Za co odpowiada | Kto |
|---|---|
| Sales, order fulfilment, payments, delivery | LAYAR |
| Complaints, returns, withdrawals from the contract | LAYAR |
| Accounting and tax documentation | LAYAR |
| Information obligation when placing an order | LAYAR |
| Technical maintenance of the site, security, access management | OVA |
| Analysis of sales and product range for the development of the brand | oba podmioty |
| Reporting any personal data breach to the President of the UODO | LAYAR |
Point of contact in all matters concerning your data — including changes to your account, rectifications and deletion of data: office@ova.com.pl, tel. +48 883 773 111 (OVA Magdalena Mazurek).
Matters concerning solely the fulfilment of orders, invoices and complaints may be addressed directly to the Seller: hello@layarpmu.com, tel. +48 510 113 730.
Important: irrespective of the above division you may exercise all your rights against each of the joint controllers — both against LAYAR and against OVA (Article 26(3) GDPR). Neither will refuse to consider your request by invoking the internal division of responsibilities.
Time limit of joint controllership. The above applies to orders placed from 28 July 2026 Data concerning orders placed earlier remains under the sole administration of OVA Magdalena Mazurek — LAYAR Konrad Grochulski has no access to them and has never been their controller. This data is stored for the period required by tax and accounting regulations and until the limitation periods for claims expire.
Joint controllership does not cover:
- the OVA brand newsletter — its sole controller is OVA Magdalena Mazurek, on the basis of consent granted separately by you;
- reports concerning the safety of cosmetic products — in this respect OVA Magdalena Mazurek acts as an independent controller, performing the duties of the responsible person within the meaning of Regulation (EC) No 1223/2009;
- accounting and tax documentation — in this respect LAYAR is an independent controller, on the basis of its own statutory obligations.
2. Where we get your data from
The data comes directly from you — you provide them when placing an order, creating an account, subscribing to the newsletter, completing the contact form, submitting a complaint or contacting us. Some data is collected automatically while you use the site (see the section on cookies).
3. Why and on what basis we process data
| Cel przetwarzania | Podstawa prawna | Okres przechowywania |
|---|---|---|
| Conclusion and performance of the sales contract, order fulfilment, delivery | Article 6(1)(b) GDPR — necessary for the performance of a contract | For the duration of the contract, and thereafter until the limitation periods for claims expire |
| Prowadzenie konta klienta | art. 6 ust. 1 lit. b RODO | Until the account is deleted |
| Issuing and storing accounting documents | Article 6(1)(c) GDPR — legal obligation (the Accounting Act, the Tax Ordinance) | 5 years from the end of the tax year |
| Handling complaints and withdrawals from the contract | Article 6(1)(c) GDPR — legal obligation | Until the limitation periods expire |
| Defence against claims and the pursuit of claims | art. 6 ust. 1 lit. f RODO — prawnie uzasadniony interes | Until the limitation periods expire |
| Sending the OVA brand newsletter (administrator: OVA Magdalena Mazurek) | art. 6 ust. 1 lit. a RODO — zgoda | Do wycofania zgody |
| Marketing of our own products | art. 6 ust. 1 lit. f RODO — prawnie uzasadniony interes | Do wniesienia sprzeciwu |
| Handling enquiries through the contact form | art. 6 ust. 1 lit. f RODO — prawnie uzasadniony interes (udzielenie odpowiedzi) | Until the correspondence is concluded, then for up to 12 months |
| Publikacja opinii o produktach | art. 6 ust. 1 lit. a RODO — zgoda | Until consent is withdrawn or the review is deleted |
| Verifying that a review comes from a Customer who purchased the Goods — cross-checking reviews against the order history on the Account | Article 6(1)(c) GDPR — legal obligation (ensuring the reliability of the reviews presented) | Until the review is deleted |
| Sending a request to leave a review of purchased Goods | art. 6 ust. 1 lit. f RODO — prawnie uzasadniony interes | Up to 6 months after the order is completed |
| Analityka i statystyka odwiedzin | art. 6 ust. 1 lit. a RODO — zgoda (cookies analityczne) | Zgodnie z okresami cookies — patrz sekcja 9 |
| Ensuring the security of the site and preventing abuse | art. 6 ust. 1 lit. f RODO | Up to 12 months |
| Handling reports of adverse effects of cosmetics | Article 6(1)(c) GDPR — obligation under Regulation 1223/2009 | In accordance with the requirements of the Regulation |
4. What data we process
- Identification and contact data: first name and surname, delivery address, billing address, e-mail address, telephone number.
- Business data (for business Customers): company name, address, VAT ID.
- Transaction data: order history, amounts, chosen payment and delivery methods.
- Account data: login, encrypted password.
- Technical data: IP address, browser and device type, operating system, referral source, cookie identifiers.
Providing the data is voluntary but necessary to conclude a contract, create an account or receive the newsletter. Without them we cannot fulfil an order.
We do not process special categories of data (so-called sensitive data) — unless you yourself provide them to us in the content of a report concerning an adverse effect of a cosmetic product. In that case the basis for processing is Article 9(2)(i) GDPR (public interest in the area of public health).
5. Who we share data with
Your data may be shared with the following categories of recipients:
- carriers and courier companies — DPD — to the extent necessary to deliver the parcel,
- the supplier of the order management system — BaseLinker (Base.com),
- the electronic payment operator — Krajowy Integrator Płatności S.A. (tpay), plac Andersa 3, 61-894 Poznań — which is a separate controller of the data provided to it in connection with the payment,
- the hosting and site maintenance provider,
- the accounting office — in respect of accounting documents,
- the supplier of the newsletter sending tool — MailerLite Limited — whereby this tool is used solely by OVA Magdalena Mazurek as the controller of the newsletter database,
- Google Ireland Limited — in respect of the service reCAPTCHA, which protects the forms against abuse (see section 9.4),
- law firms and debt collection companies — only in the event of a dispute,
- public authorities — where required by law,
- the person responsible for cosmetic products (OVA Magdalena Mazurek) — solely in respect of reports concerning product safety.
Recipients process the data solely to the extent necessary to perform the tasks entrusted to them, on the basis of data processing agreements concluded with them — with the exception of the payment operator and the courier company, which are separate controllers.
6. Transfers of data outside the European Economic Area
Some of the tools used (for example analytics or marketing service providers) may transfer data outside the EEA. In such a case the transfer takes place on the basis of standardowych klauzul umownych approved by the European Commission, or of a decision finding an adequate level of protection.
You can obtain a copy of the safeguards by contacting us at office@ova.com.pl.
At present such a transfer may occur in connection with the use of the service Google reCAPTCHA (Google Ireland Limited, established in Ireland, with the possibility of transferring data to Google LLC in the United States) and from the newsletter sending tool MailerLite. Transfers take place on the basis of standard contractual clauses and of the European Commission decision finding an adequate level of data protection under the EU–US Data Privacy Framework.
7. Your rights
You have the right to:
- access do swoich danych i otrzymania ich kopii (art. 15 RODO),
- rectification data that is incorrect or incomplete (Article 16 GDPR),
- deletion danych — „prawo do bycia zapomnianym” (art. 17 RODO),
- restriction of processing (art. 18 RODO),
- data portability do innego administratora (art. 20 RODO),
- objection wobec przetwarzania opartego na prawnie uzasadnionym interesie, w tym wobec profilowania (art. 21 RODO) — in the case of direct marketing the objection is unconditional and results in processing ceasing immediately,
- withdrawal of consent at any time — without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR),
- lodging a complaint do organu nadzorczego:
the President of the Personal Data Protection Office
ul. Stawki 2, 00-193 Warszawa
www.uodo.gov.pl
To exercise these rights, write to office@ova.com.pl. We respond without delay and no later than within month from receipt of the request.
8. Automated decision-making
Twoje dane are not used for automated decision-making, including profiling which produces legal effects concerning you or similarly significantly affects you.
9. Cookies
9.1. What they are
Cookies are small text files saved on your device while you use the site.
9.2. Which ones we use
| TYPE | What they are for | Podstawa |
|---|---|---|
| Necessary | Basket functionality, logging in, session, security, remembering the choice of language and currency | No consent required — Article 173(3) of the Telecommunications Act |
| Functional | Remembering the user's preferences | Agreement |
| Analytics | Visit statistics, how the site is used | Agreement |
| Marketing | Dopasowanie reklam, remarketing | Agreement |
9.2b. Detailed list of cookies
Necessary — no consent required:
| Nazwa | Pochodzenie | Do czego | Czas |
|---|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart |
WooCommerce | basket contents | sesja |
wp_woocommerce_session_* |
WooCommerce | linking the basket to the session | 2 dni |
woocommerce_recently_viewed |
WooCommerce | recently viewed products | sesja |
wordpress_logged_in_*, wp-settings-*, wp-settings-time-* |
WordPress | maintaining the logged-in user's session | do 1 roku |
trp_language |
TranslatePress | remembering the chosen language | 1 rok |
woocommerce_currency |
currency switcher | remembering the chosen currency | 1 month |
wfwaf-authcookie-* |
Wordfence | protection against unauthorised access | sesja |
Security:
| Nazwa | Pochodzenie | Do czego | Czas |
|---|---|---|---|
_GRECAPTCHA |
Google reCAPTCHA | ochrona formularzy przed automatami | approx. 6 months |
The list reflects the configuration of the site as at 28 July 2026 and is updated whenever the tools used change.
9.3. Google reCAPTCHA
The forms on the site (including the newsletter sign-up and the contact form) are protected by the service Google reCAPTCHA, supplied by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The service analyses the way the site is used in order to distinguish a human from a machine. For this purpose, information including your IP address, details of your browser and device, and data about your behaviour on the site is transmitted to Google. reCAPTCHA sets its own cookies.
The basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR) in protecting the site against spam and abuse. Using the forms without this protection is not possible.
The rules on how Google processes data are set out in its privacy policy: https://policies.google.com/privacy
9.4. Managing cookies
You give consent to cookies other than the necessary ones through the cookie banner on your first visit. You may change or withdraw it at any time in the cookie settings on the site and in your browser settings.
Restricting cookies may affect the operation of some features of the site — in particular the basket and logging in.
9.5. Country detection (currency)
In order to show you prices in the right currency — zloty for Poland, euro for other countries — the site establishes your country from your IP address. The check takes place entirely on our own server, using a locally stored country database. Your IP address is not passed to any external party for this purpose.
We store only the two-letter country code, in the server's temporary memory, for 7 days. The basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR) in presenting prices correctly. You can change the currency manually at any time using the currency switcher — your choice then takes precedence.
Country database: IP Geolocation by DB-IP (licencja CC BY 4.0).
10. Data security
We apply technical and organisational measures appropriate to the risk, in particular:
- encryption of the connection with a certificate SSL,
- control of access to data — access only for authorised persons,
- protection against unauthorised access (the Wordfence security system),
- regularne kopie zapasowe,
- confidentiality undertakings for people with access to the data.
11. Children
The site is not intended for people under 16 years of age. We do not knowingly collect the data of such people.
12. Changes to the Policy
We may update this Policy — in particular where the regulations, the scope of our services or the tools we use change. We will announce significant changes on the site, and will notify account holders electronically.
The current version is always available at www.ova.com.pl/polityka-prywatnosci/