Last updated: 20 August 2026 — Wersja polska
In short
We collect what we need to send you your order, issue an invoice and answer you if something goes wrong. We keep invoices for as long as tax law requires and delete the rest when we no longer need it. We never sell your data. You can ask us at any time for a copy of your data, or ask us to delete it — free of charge, answered within one month. Write to [email protected].
1. Who we are
The controller of your personal data is “JOLLY-HEAP” Svitlana Sapunova, Aleja Led 4, 55-020 Rzeplin, Poland, NIP 8992772832, REGON 362440030 — the same company that runs this shop and sells you the blocks.
Questions about your data: [email protected] or +48 575 935 005. We have not appointed a Data Protection Officer, so your message goes straight to the people who run the shop.
2. What we collect and why
Your order
What we collect: your name, billing address, delivery address, e-mail address, phone number, your VAT ID if you buy as a business, and the items, prices and currency of your order.
Why: to accept your order, arrange delivery, issue an invoice, and handle returns, complaints and warranty claims.
Legal basis: performance of our contract with you — Art. 6(1)(b) GDPR. For invoices and accounting records, compliance with a legal obligation — Art. 6(1)(c) GDPR. For defending or pursuing claims, our legitimate interest — Art. 6(1)(f) GDPR.
How long: invoices and accounting records for 5 years from the end of the calendar year in which the tax became due (Polish tax law). Order records for as long as claims can still be raised — as a rule 6 years for consumers and 3 years for business customers.
Your phone number is optional and only makes delivery faster — the courier may need to call if they cannot find the door. Your VAT ID is needed only if you want a business invoice; we check it against the European Commission’s VIES database to apply the correct VAT.
Payments
We accept card payments and Revolut Pay through Revolut. Your full card number never reaches us and we never store it — you enter it on the provider’s own secure page, and we only see whether the payment succeeded. Revolut decides for itself how it handles that data, so its own privacy notice applies alongside ours.
Legal basis: performance of our contract — Art. 6(1)(b) GDPR.
When you write to us
If you use our contact form or write us an e-mail, we keep your message and your contact details so we can answer and, if needed, come back to the matter later. Legal basis: our legitimate interest in answering you — Art. 6(1)(f) GDPR, or performance of the contract if your message concerns an order. How long: up to 2 years after the conversation ends.
If you subscribe to news from us
If you enter your e-mail address in our subscription form, we use it only to send you news about JollyHeap. Legal basis: your consent — Art. 6(1)(a) GDPR, together with Art. 398 of the Polish Electronic Communications Law. Every message has an unsubscribe link, and unsubscribing takes effect immediately; it does not stop e-mails about orders you have already placed, because those we have to send. Subscribing is entirely voluntary and changes nothing about your ability to buy from us. How long: until you unsubscribe.
3. Who we share your data with
We do not sell your data, and we do not share it with anyone we have not named here.
- Payment provider — Revolut, to process your payment. It acts as an independent controller of that data.
- Carriers — DPD Polska sp. z o.o. and, depending on your region, other carriers we use. They receive your name, delivery address and phone number, and use them to deliver your parcel. They too act as independent controllers.
- Hosting — OVH SAS (France), where this shop and its database physically run, on our instructions.
- E-mail delivery — Google Ireland Limited, which delivers the e-mails this shop sends you (order confirmations and similar).
- Accounting — our accounting office and invoicing system, for issuing and storing invoices.
- Analytics and reviews — Google and Microsoft, as described in sections 5 and 6.
- Public authorities — tax and other authorities, where the law requires us to hand data over.
4. When your data leaves the European Economic Area
Some of the providers listed above process data outside the EEA, mainly in the United States — this concerns Google and Microsoft. Those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Write to [email protected] and we will tell you which safeguard applies to which provider.
5. Cookies, analytics and session recording
Some cookies are needed for the shop to work at all — they remember what is in your basket and keep you logged in. Others are used for analytics and marketing. You can review and change your choices at any time through the cookie settings button in the corner of every page, where the categories are listed separately (necessary, functional, analytics, performance, advertisement).
Google Analytics 4 and Google Tag Manager
We use Google Analytics 4, loaded through Google Tag Manager, to understand how people find and use our shop so we can fix what does not work. It collects the pages you view, events such as adding an item to the basket, your approximate location, device and browser type, and where you came from. Google Analytics 4 does not log or store IP addresses. We keep this data for 14 months, after which it is deleted automatically. Google Tag Manager itself sets no cookies — it only loads the tools named in this policy. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as an independent controller. You can also install the Google Analytics Opt-out Browser Add-on.
Microsoft Clarity — session recording
We use Microsoft Clarity to see how our pages actually behave: it records interactions — mouse movements, clicks, scrolling and navigation — and replays them as anonymised recordings and heatmaps, which we use to find and fix usability problems. Anything you type into a form field is masked and never transmitted. Recordings are kept for 30 days, and a small sample for up to 9 months.
Microsoft is not acting on our instructions here: under the Microsoft Clarity terms, Microsoft and we are independent controllers, and Microsoft may use this data for its own purposes, including improving its products and advertising. See the Microsoft Privacy Statement.
Legal basis for both tools: your consent — Art. 6(1)(a) GDPR. You can withdraw it at any time in the cookie settings, without affecting what was processed before.
6. Google Customer Reviews
We take part in the Google Customer Reviews programme, so that customers can tell others what our blocks are really like. When your order is confirmed, our confirmation page loads a Google module, and we pass Google your order number, e-mail address, delivery country and the estimated delivery date, so that Google can invite you to rate your purchase. Whether you take part is entirely your choice — if you do not opt in, Google does not send you the survey.
In connection with this programme Google and other third parties may place and read cookies on your browser or use web beacons and similar technologies, and Google may receive information about transactions carried out on our site. Google acts as an independent controller and processes this data under the Google Privacy Policy. You can manage or delete these cookies at any time through our cookie settings or your browser settings.
7. Profiling and automated decisions
We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Our payment provider may automatically decline a card transaction on the basis of its own fraud checks — in that case you can contact the provider and ask for a human review.
8. How long we keep your data — summary
- Invoices and accounting records — 5 years from the end of the calendar year in which the tax became due.
- Order records — until claims can no longer be raised (as a rule 6 years for consumers, 3 years for business customers).
- Customer support e-mails and form messages — up to 2 years after the conversation ends.
- Analytics data (Google Analytics 4) — 14 months.
- Session recordings (Microsoft Clarity) — 30 days, a small sample up to 9 months.
- Subscription list — until you unsubscribe.
9. Do you have to give us your data?
Your name, address and e-mail are necessary to conclude and perform the sale — without them we cannot process your order. Your VAT ID is necessary only for a business invoice. Your phone number is optional. Your e-mail for our news is optional, and refusing it changes nothing about your purchase. In our forms, mandatory fields are marked; everything unmarked is voluntary.
10. How we protect your data
The shop runs over an encrypted HTTPS connection. Access to the administration panel is limited to the few people who need it, each with their own account and two-factor authentication. Card details are handled by our payment provider — we never see or store them.
11. Children
We make toys, but we sell them to grown-ups. This shop is intended for customers aged 18 and over, we do not create accounts for children, and we do not knowingly collect personal information from children or use it for advertising. If you are a parent or guardian and believe a child has given us their details, write to [email protected] and we will delete them.
12. Your rights
You can ask us for a copy of the data we hold about you, ask us to correct it, delete it, restrict what we do with it, or send it to another company. Where we rely on your consent, you can withdraw it at any time — through the unsubscribe link in any message or in the cookie settings — and withdrawing is as easy as giving it; it does not make what we did before unlawful. All of this is free, and we answer within one month. Just write to [email protected].
You can object to direct marketing at any time. You have the right to object at any time to us processing your personal data for direct marketing. If you object, we stop immediately and you do not have to give a reason.
Where we rely on legitimate interest (Art. 6(1)(f) GDPR) — answering your messages, keeping the shop secure, and establishing or defending legal claims — you can also object on grounds relating to your particular situation.
13. If you are not happy
Please tell us first — write to [email protected] and we will try to put it right. You also have the right to complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or to the supervisory authority of the EU country where you live, where you work, or where you think the problem happened.
14. Changes to this policy
If we start using your data for a purpose that is not described here, we will tell you about it before we start. We update this page whenever the shop changes — for example when we add a new payment method or a new tool — and the date at the top always shows the current version.