Privacy and cookie policy
This English translation is provided for your convenience. Only the Polish version of this policy is legally binding.
Who processes your data in the nagori shop, why, on what legal basis and for how long. Effective from 15 October 2026.
1. Data controller
The controller of your personal data is Desta Biuro Rachunkowe Anna Frąckowiak, ul. Żubrowa 16, 86-005 Trzciniec, tax ID (NIP) 9532571297, statistical number (REGON) 362629157, a business registered in the Central Register and Information on Economic Activity (CEIDG). Contact: kontakt@nagori.pl, phone +48 737 475 744. The nagori shop is a brand of this business.
For all matters concerning personal data, write to kontakt@nagori.pl or by post to the address above. We have not appointed a data protection officer, because at our scale this is not required by Article 37 GDPR.
2. What data we process, why, on what legal basis and for how long
| When | Data | Purpose and legal basis | How long |
|---|---|---|---|
| Order | full name, email, phone, delivery address or parcel locker code, invoice details, order contents | concluding and performing the sales contract (Art. 6(1)(b) GDPR); tax and accounting obligations (Art. 6(1)(c) GDPR) | 5 years from the end of the year in which the accounting document was issued. Unpaid and cancelled orders are anonymised after 90 days. |
| Complaint, return, pursuing claims | data from the order and correspondence | handling complaints and withdrawals (Art. 6(1)(c) GDPR), defending against claims (Art. 6(1)(f) GDPR) | until the limitation periods for claims expire |
| Reservation before sales start | first name, email, optionally phone, town and comments | steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) | cancelled: 30 days; others: up to 18 months from submission |
| Subscription sign-up | first name, email, optionally town and comments, chosen option | steps taken before entering into a contract (Art. 6(1)(b) GDPR) | cancelled: 30 days; others: up to 18 months from sign-up |
| Mailing list (new harvests, pre-orders, offers) | email, optionally first name, wording and date of consent | direct marketing based on your consent (Art. 6(1)(a) GDPR and Article 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej)) | until you withdraw your consent; after that only a record that you unsubscribed, so that we do not add you again |
| Review request after delivery | email, order number | a single message, only if you tick the consent box when ordering (Art. 6(1)(a) GDPR) | together with the order data |
| Product review | the name you sign it with (entered by you), rating, text | publishing the review you add yourself (Art. 6(1)(a) GDPR); if you withdraw your consent, we delete the review | until you withdraw your consent or the product is removed |
| Find your tea | answers to questions about taste, habits, time of day you drink tea, equipment and budget, an optional description of your dream tea, traffic source and device type; email address only if you ask for your result by email. No IP address. | preparing the match and sending the result at your request (Art. 6(1)(b) GDPR), planning our range based on aggregated results (Art. 6(1)(f) GDPR) | answers: 26 months; email address: 12 months |
| Business enquiry (gift boxes, tea for cafés) | company, tax ID (NIP), full name, email, phone, message | replying and preparing an offer (Art. 6(1)(b) and (f) GDPR) | 12 months from the enquiry, unless we enter into a contract |
| Email correspondence | address and content of the message | replying (Art. 6(1)(f) GDPR) | until the matter is dealt with and any claims become time-barred |
| Visit statistics | pages visited, traffic source (e.g. Instagram, a campaign link), device type, browser and operating system. No IP address. | knowing which content and channels work (Art. 6(1)(f) GDPR). The data is pseudonymous and counted on our own server, without third-party companies. | 26 months |
| Security | a one-way hash of the IP address (the address cannot be read from it) | limiting login attempts and form spam (Art. 6(1)(f) GDPR) | from 24 hours to 30 days |
| Sending a form (mailing list sign-up, reservation, subscription, business enquiry, Find your tea result by email) | IP address, browser header (User-Agent), connection and browser parameters checked by the Cloudflare Turnstile captcha | protection against spam and submissions sent by bots (Art. 6(1)(f) GDPR). Cloudflare does not see the content of the form; only the result of the check comes back to us. | we do not store this data; Cloudflare keeps it in line with its privacy policy |
Providing your data is voluntary, but without the data needed for delivery and contact we cannot fulfil an order or reservation. We do not make automated decisions and do not profile you within the meaning of Article 22 GDPR. Find your tea matches teas to your answers only at your request and has no legal effects.
3. Who we share data with
We do not sell data. We share it only with those without whom we could not run the shop:
- server, database and email hosting: MyDevil (a Polish hosting provider), under a data processing agreement;
- mailing list delivery: UAB “MailerLite” (Lithuania), only if you have signed up to the list, under a data processing agreement;
- payments: PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań. PayU processes payment data as a separate controller, under its own privacy policy;
- delivery: InPost sp. z o.o., ul. Pana Tadeusza 4, 30-727 Kraków (full name, phone, email, address or parcel locker). On the order page, the parcel locker map loads from InPost servers;
- form protection: Cloudflare, Inc. (USA), Turnstile captcha. On forms it checks whether a human is sending them, based on the IP address and browser data;
- public authorities: when required by law (e.g. the tax office).
Cloudflare (captcha on forms) may transfer data to the USA. The legal basis is the European Commission decision on the EU-US Data Privacy Framework or standard contractual clauses.
4. Your rights
- access to your data and a copy of it (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20);
- objection to processing based on legitimate interest, including statistics (Art. 21 GDPR);
- withdrawal of consent at any time, without affecting the lawfulness of processing before the withdrawal. You can unsubscribe from the mailing list using the link in every email or by writing to us; you can change your cookie consent with the “Cookie settings” button in the page footer;
- a complaint to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl), if you believe we are processing your data unlawfully.
We respond to requests within one month. To avoid disclosing data to an unauthorised person, we may ask you to confirm that the email address belongs to you.
5. Security
The site works over an encrypted connection (HTTPS). Passwords to the admin panel are stored as hashes, the panel is protected by a limit on login attempts, and only the people who handle orders have access to the data. We do not see payment card details: payment takes place on the PayU site.
6. Cookies and browser storage
Cookies are small files that a website saves in your browser. We save essential cookies without asking, because the shop does not work without them (Article 399(3) of the Electronic Communications Law (Prawo komunikacji elektronicznej)). We do not use any other cookies.
| Name | Type | Purpose | Expiry |
|---|---|---|---|
ngr | essential, ours | session: cart contents, protecting forms against abuse (security token), discount code in the cart. Within the same visit we also count page views for the statistics described in section 2, without linking visits to each other. | until you close the browser |
ngr_lang | essential, ours | remembering the site language (Polish or English) you choose with the PL/EN switch. Set only when you change the language yourself: it is necessary for the function you have asked for. | 12 months |
nagori-consent | essential, browser storage | remembering your decision in the cookie window | 12 months |
cf_clearance, cf_chl_rc_i, cf_chl_rc_ni | essential, Cloudflare | only on pages with a form: the Turnstile captcha may save them to confirm that a human is sending the form | briefly, according to Cloudflare's rules |
You can also delete or block cookies in your browser settings. If you block essential cookies, the cart and forms will stop working.
7. Changes to this policy
When we change how we process data, we will update this page and the date at the top. We will email people on the mailing list about significant changes that affect them.