Ziołowy Dwór Marek Gorczyca, trading as Herbal Mansion, is the data controller.

Address 3 Maja 116a 38-200 Jasło Poland

• NIP: 6851218021
• VAT: PL6851218021
• REGON: 180856431
• EORI: PL685121802100000

Contact: sales@herbalmansion.com

Data you provide, including order and account data:

• name, billing address and shipping address;
• email address and phone number;
• order details, including products, quantities, notes, parcel value and delivery method;
• payment-related information processed by payment providers. We do not store full card details;
• customer support messages, return requests, refund requests and complaint records.

Data collected automatically, including device and usage data:

• IP address, browser type, device information and time zone;
• cookies and similar technologies;
• pages and products viewed, referrers, search terms and interaction events.

Marketing preferences:

• newsletter or SMS subscription status;
• consent and opt-out records;
• advertising interaction data where enabled.

We use personal data to:

• process and fulfil orders, including payments, packing, shipping, confirmations and invoices;
• communicate with you about orders, delivery, tracking, customs requests and support;
• handle returns, refunds, refused delivery cases, carrier claims and import-related delivery issues;
• provide order details to carriers, courier partners, customs brokers or customs authorities where needed for delivery or customs clearance;
• prevent fraud and secure transactions;
• improve the Site, including analytics, performance and debugging;
• send marketing communications where you have subscribed or where otherwise permitted by law.

• Contract: to process orders, provide services, deliver products, manage returns and communicate about your order.
• Legal obligation: accounting, tax, invoicing, customs, regulatory and mandatory compliance obligations.
• Legitimate interests: fraud prevention, security, analytics, service improvement, customer support, carrier claims, delivery issue resolution and protection of our legal position.
• Consent: marketing emails or SMS where required, and non-essential cookies or advertising technologies where required.

You can withdraw consent at any time by unsubscribing or contacting us.

We use cookies and similar technologies for essential site functions, preferences, analytics and advertising where enabled.

• Essential: site operation, security and checkout.
• Preferences: remembering choices where enabled.
• Analytics: understanding site usage and improving performance.
• Advertising: relevant ads or remarketing where enabled.

You can manage cookies through your browser settings and, where available, our cookie banner or preferences tool.

We share personal data only as needed to operate the Site, fulfil orders, comply with legal obligations and resolve delivery or support issues. This may include sharing data with:

• Shopify: store platform, hosting and checkout.
• Payment providers: depending on checkout method.
• Shipping carriers and courier partners: including Poczta Polska, DPD, UPS and other carriers depending on destination and availability.
• Customs brokers, customs authorities and government bodies: where required for non-EU delivery, customs clearance, import procedures, return, disposal, abandonment, refused delivery cases, carrier claims or legal compliance.
• Analytics and advertising tools: where enabled.
• Email and SMS service providers: where enabled.
• Professional advisers or authorities: where required to protect rights, prevent fraud, comply with law or handle disputes.

We do not sell your personal data as a standalone customer list.

Shopify, carriers, payment providers and some other service providers may process data outside the European Economic Area, including in Canada, the United States or the destination country of your parcel.

Where required, we rely on safeguards such as Standard Contractual Clauses, adequacy decisions or other lawful transfer mechanisms.

For non-EU deliveries, necessary order and shipping information may be processed in the destination country by carriers, customs brokers, customs authorities or other parties involved in customs clearance and delivery.

If you subscribe to marketing communications, you can unsubscribe at any time using the link in our emails or by contacting sales@herbalmansion.com.

For SMS, where available, follow the opt-out instructions in the message, such as replying STOP where applicable. Message and data rates may apply.

Transactional order, delivery, customs or support messages may still be sent where necessary to fulfil your order or respond to your request.

We keep personal data only as long as necessary for the purposes described in this policy, including order fulfilment, customer support, legal, accounting, tax, customs and fraud-prevention requirements.

Order records are typically retained for several years to comply with tax and accounting rules. Support, delivery, refund, refused delivery and carrier claim records may be retained as needed to resolve the case and protect our legal position.

We use reasonable technical and organisational measures to protect your data. Payment transactions are handled by secure payment providers. We do not store full card details.

No online service can guarantee absolute security, but we limit access to personal data to what is reasonably necessary for store operation, fulfilment, customer support and legal compliance.

Depending on your location, you may have rights to access, correct, delete, restrict, port or object to processing of your personal data, and to withdraw consent at any time.

To exercise your rights, contact sales@herbalmansion.com. We may need to verify your identity before fulfilling a request.

You may also lodge a complaint with your local supervisory authority. In Poland, the supervisory authority is UODO.

There is no consistent industry standard for responding to Do Not Track signals, so we may not respond to them in a uniform way.

The Site is not intended for children and we do not knowingly collect personal data from children.

We may update this Privacy Policy to reflect changes in our practices, technology, service providers or legal requirements. The Last updated date will be revised accordingly.