This page explains what we do with your personal data when you visit ladasten.com, place an order or write to us. It is short because we collect little. We have no newsletter, no advertising trackers, and we never sell data.

1. Who is responsible for your data

The controller of your personal data is Nonsensia Lab, which runs the online store Ladasten at ladasten.com, ul. Marszałkowska 80, 00-517 Warsaw, Poland.

For anything about your data, write to shop@ladasten.com. Please put “Privacy” in the subject line so your message goes straight to the right person.

2. What we collect, and why

When you place an order

We collect your name, delivery and billing address, e-mail address, phone number (if you give it), the products you ordered, and any comment you add to the order.

Why: to process, pack and deliver your order and to keep you informed about it. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR), and our legal duty to keep accounting and tax records (Art. 6(1)(c) GDPR).

When you pay

You pay by bank transfer, so we never see your card. Our bank statement shows us the payer’s name, the account number, the amount, the date and the transfer title.

Why: to match your payment to your order and, if needed, to send a refund back to the same account. Legal basis: contract, and our legal accounting obligations.

When you write to us

If you use the contact form, e-mail or WhatsApp, we receive your name, your contact details and whatever you choose to write.

Why: to answer you. Legal basis: our legitimate interest in answering questions (Art. 6(1)(f) GDPR), or steps you ask for before or under a contract (Art. 6(1)(b)).

Asking for a review

After an order is completed, the “order completed” e-mail includes a link where you can review us on Trustpilot. That’s the only message of this kind you get from us. Leaving a review is entirely up to you. If you do, you share your review with Trustpilot directly, under its own privacy policy.

Legal basis: our legitimate interest in feedback on our service (Art. 6(1)(f) GDPR). Tell us if you’d rather not receive it, and we’ll note that.

When you browse the site

Like every website, our server records technical data such as your IP address, browser type and the pages you request. Our security tools use this data to block attacks and abuse. We count visits with self-hosted statistics that set no cookies and send nothing to third parties.

Why: to keep the store secure and working, and to understand in aggregate which pages are useful. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

3. Cookies

We use only cookies that the store needs to work:

• Cart and session cookies keep your cart and checkout together.
• Recently viewed products shows the products you just looked at.
• Cache and security cookies serve the right version of a page and protect logins.
• Login cookies are set only if you have an account and are signed in.

We don’t use advertising, profiling or third-party analytics cookies. You can delete cookies in your browser at any time, but the cart won’t work without them.

4. Who we share your data with

We share only the minimum each recipient needs to do its job:

• Delivery: Polish Post (Poczta Polska) and InPost get the name, address and, for lockers, the phone number or e-mail they need to deliver your parcel.
• Banks: the banks that hold our accounts process your transfer, and any refund, as part of normal banking.
• Hosting: our store and e-mail run on servers of a hosting provider in Poland, which processes data on our behalf.
• Authorities: we disclose data only when the law requires it, for example to tax authorities.

We never sell your data or pass it on for anyone else’s marketing.

If you contact us by WhatsApp or leave a review on Trustpilot, those services process your data as independent controllers under their own policies. Some of that processing may take place outside the European Economic Area.

5. How long we keep it

• Orders and payment records: for as long as Polish tax and accounting law requires, currently five years from the end of the year of the transaction.
• Messages: for as long as needed to deal with your matter and any follow-up or claim related to it.
• Server and security logs: for a limited period, for security purposes only.
• An account, if you created one, stays until you ask us to close it. Order records we must keep by law remain even after the account is closed.

6. Your rights

Under the GDPR (and the UK GDPR, if you live in the UK), you can:

• ask for a copy of the data we hold about you;
• have incorrect data corrected;
• have your data deleted, unless we have to keep it by law;
• restrict how we use your data, or object to uses based on our legitimate interest;
• receive the data you gave us in a portable format.

Write to shop@ladasten.com. We answer within one month. It costs you nothing.

You also have the right to complain to a data protection authority. In Poland, that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). In the UK, it is the Information Commissioner’s Office. You can also complain to the authority in your own EU country.

7. The rest

• We don’t make automated decisions about you, and we don’t build profiles of you.
• Our store is for adults only. We don’t knowingly collect data from anyone under 18.
• Giving us your order details is voluntary, but we can’t deliver an order without a name and address.
• We protect your data with encrypted connections (HTTPS), restricted access and two-factor login for staff accounts.

We may update this policy when our practices change. The current version is always on this page. Our store rules are on the Rules & Policy page.

Last updated: 25 September 2026.