CUDDLEREST PRIVACY AND COOKIES POLICY

Last updated: 8 September 2026

We care about the privacy of users of the CuddleRest online store and the security of the personal data entrusted to us.

This Privacy and Cookies Policy explains in particular:

- who the controller of personal data is,

- what personal data we process,

- for what purposes and on what legal grounds we process it,

- how long we retain personal data,

- to whom personal data may be disclosed,

- when personal data may be transferred outside the European Economic Area,

- what rights data subjects have,

- how we use cookies and similar technologies.

We process personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – the General Data Protection Regulation (“GDPR”), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Electronic Communications Law of 12 July 2024.

§ 1 PERSONAL DATA CONTROLLER

1. The controller of personal data of users and Customers of the CuddleRest online store is:

FABRYKA PRZYTULNOŚCI SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ 

1. Rysia 61/2

05-270 Marki 

Poland

KRS: 0000842191 

NIP: 1251705655 

REGON: 38609490900000

hereinafter referred to as the “Controller”, “Seller”, “CuddleRest” or “we”.

2. The online Store is operated at:

cuddlerest.pl

3. You can contact the Controller regarding personal data matters at:

e-mail: kontakt@cuddlerest.pl 

telephone: +48 733 303 717

4. The Controller is responsible for the lawful processing of personal data in connection with the operation of the CuddleRest Store.

§ 2 PRINCIPLES OF PERSONAL DATA PROCESSING

When processing personal data, we follow the principles set out in the GDPR, in particular:

1. we process personal data lawfully, fairly and transparently;
2. we collect personal data for specified, explicit and legitimate purposes;
3. we limit the scope of personal data collected to what is necessary for a particular purpose;
4. we do not retain personal data for longer than is necessary for the purpose for which it is processed or for the period required by law;
5. we apply appropriate technical and organisational measures to protect personal data;
6. we do not sell our Customers’ personal data.

§ 3 WHAT PERSONAL DATA WE MAY PROCESS

Depending on how you use the Store, we may process in particular:

1. identification data, such as:

- first name,

- surname;

2. contact details, such as:

- e-mail address,

- telephone number;

3. address details:

- delivery address,

- billing address;

4. business details, where the purchase is made in connection with business activity:

- company name,

- tax identification number,

- registered office or business address;

5. order-related data:

- order number,

- products ordered,

- product variants,

- order value,

- delivery method,

- payment method,

- order history;

6. payment-related information to the extent necessary to identify and settle a transaction;
7. information relating to complaints, returns and withdrawal from the agreement;
8. Customer Account data;

9. information provided by the Customer when contacting us, for example by e-mail;
10. information relating to reviews;
11. technical information relating to use of the Store, in particular:

- IP address,

- device information,

- browser type,

- operating system,

- date and time of use of the website,

- pages visited,

- session information,

- online identifiers,

- information stored using cookies and similar technologies.

The scope of data processed depends on the Store functionalities used by the user.

§ 4 PURPOSES, LEGAL BASES AND RETENTION PERIODS

1. PLACING AND FULFILLING AN ORDER

We process personal data for the purpose of:

- accepting an order,

- concluding a sales agreement,

- preparing the ordered products,

- contacting the Customer regarding order fulfilment,

- arranging delivery,

- settling the order.

The legal basis is:

Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract.

Providing the personal data required during checkout is necessary in order to fulfil the order. Failure to provide required information may make it impossible to place or fulfil an order.

Data relating to performance of the agreement is retained for the period necessary to fulfil it and subsequently for the period required by law or necessary for the establishment, exercise or defence of legal claims.

2. TAX AND ACCOUNTING OBLIGATIONS

We may process transaction data for the purpose of:

- issuing sales documents,

- maintaining accounting records,

- complying with tax obligations,

- complying with other legal obligations.

The legal basis is:

Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the Controller is subject.

Documents are retained for the period required by tax and accounting regulations, generally for 5 years calculated in accordance with the applicable provisions.

3. PAYMENTS

Where electronic payment is selected, certain information relating to the order and payment may be transmitted to the payment service provider to the extent necessary to process the transaction.

Payments in the CuddleRest Store may be processed in particular by:

- Autopay S.A.

- PayPro S.A. – operator of the Przelewy24 service.

Depending on the payment method selected, available methods may include:

- payment cards,

- BLIK,

- instant bank transfers,

- Apple Pay,

- Google Pay.

The legal basis for processing by CuddleRest is primarily:

Article 6(1)(b) GDPR – performance of the agreement,

and, where required by law:

Article 6(1)(c) GDPR – compliance with legal obligations.

Payment service providers may also process personal data as separate controllers to the extent resulting from the regulations governing the payment services they provide.

Detailed information concerning personal data processing by a payment provider is available in the privacy policy or privacy notice of the respective provider.

CuddleRest does not receive full payment card details enabling us to independently use the Customer’s payment card.

4. ORDER DELIVERY

We may disclose data necessary for delivery to the carrier selected by the Customer.

Such data may include in particular:

- first name and surname,

- address,

- telephone number,

- e-mail address,

- parcel-related information.

Depending on the selected delivery method, recipients of personal data may include courier and logistics service providers, in particular InPost, DPD, GLS, DHL or other carriers made available in the Store.

The legal basis for processing is:

Article 6(1)(b) GDPR – performance of the sales agreement.

5. CUSTOMER ACCOUNT

If the user decides to create an Account in the Store, their data is processed for the purpose of:

- creating and maintaining the Account,

- providing access to order history,

- enabling management of personal details,

- enabling use of Account functionalities.

The legal basis is:

Article 6(1)(b) GDPR – performance of the agreement for provision of the Account service.

Account-related data is generally processed until the Account is deleted or the Account agreement is terminated.

Deletion of the Account does not result in deletion of information which we are required to continue retaining due to legal obligations, completed orders or the need to establish, exercise or defend legal claims.

6. CONTACT WITH CUDDLEREST

If you contact us by e-mail, telephone or another available communication channel, we may process the personal data provided during that contact.

Where the contact concerns an existing or proposed agreement, the legal basis is:

Article 6(1)(b) GDPR.

In other cases, the legal basis may be:

Article 6(1)(f) GDPR – the Controller’s legitimate interest in communicating with persons interested in CuddleRest and responding to enquiries.

We retain such data for the period necessary to handle the correspondence and subsequently – where justified – for the period necessary to demonstrate the course of communications or protect ourselves against legal claims.

7. COMPLAINTS, WITHDRAWAL FROM AGREEMENTS AND RETURNS

Personal data may be processed for the purpose of:

- handling complaints,

- processing withdrawals from agreements,

- handling returns,

- complying with consumer law obligations,

- processing refunds.

The legal basis may be:

Article 6(1)(b) GDPR – performance of the agreement,

and

Article 6(1)(c) GDPR – compliance with legal obligations.

The data may subsequently be retained until the applicable limitation period for claims expires.

8. ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS

We may retain and use personal data for the purpose of:

- establishing the existence of a claim,

- recovering amounts due,

- defending against claims,

- preserving evidence.

The legal basis is:

Article 6(1)(f) GDPR – the Controller’s legitimate interest in protecting its rights.

Data is retained until the relevant claims expire or become time-barred, or until proceedings concerning the relevant claim have been concluded.

§ 5 NEWSLETTER AND ELECTRONIC MARKETING

1. If a user subscribes to the Newsletter, we may use the e-mail address provided to send information concerning CuddleRest, in particular:

- new products,

- promotions,

- offers,

- collections,

- inspiration,

- other marketing information concerning CuddleRest.

2. Use of the Newsletter is voluntary.
3. To the extent that we provide the Newsletter service requested by the user, the legal basis for processing may be:

Article 6(1)(b) GDPR – performance of the Newsletter service agreement.

4. Where applicable law requires consent to use a particular communication channel for marketing purposes, marketing communications are sent after obtaining the required consent, in particular in accordance with the Polish Electronic Communications Law.
5. The user may unsubscribe from the Newsletter at any time:

- by using the unsubscribe link included in the message,

- by contacting us at kontakt@cuddlerest.pl.

6. Unsubscribing is free of charge.
7. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
8. Once the user unsubscribes from the Newsletter, their data is no longer used for sending the Newsletter.
9. We may retain limited information concerning consent and its withdrawal in order to demonstrate compliance with applicable law.

The legal basis for such processing is:

Article 6(1)(f) GDPR – the Controller’s legitimate interest in demonstrating that consent was properly obtained and protecting itself against legal claims.

§ 6 PRODUCT REVIEWS AND TRUSTMATE

1. After a purchase has been made, we may enable the Customer to submit a review concerning the purchased product or purchases made at CuddleRest.
2. We may use the TrustMate service to collect and display reviews.
3. In connection with the use of this service, data necessary to send a review invitation and verify whether the review was submitted by a person who actually made a purchase may be transmitted to TrustMate, including in particular:

- e-mail address,

- first name, where required,

- order number or identifier,

- information concerning purchased products.

4. The legal basis for processing personal data by CuddleRest in connection with the review system is:

Article 6(1)(f) GDPR – the Controller’s legitimate interest in obtaining Customer feedback, improving the quality of products and service, and ensuring the credibility of reviews published in the Store,

provided that the use of the relevant communication method complies with electronic communications legislation.

5. To the extent that TrustMate processes personal data on our documented instructions, it acts as a processor.
6. To the extent that TrustMate provides services directly to the user, it may act as a separate controller in accordance with its own terms and privacy policy.

§ 7 ANALYTICS, STATISTICS AND STORE DEVELOPMENT

1. We may analyse how the Store is used in order to:

- understand interest in individual products,

- analyse the number of visits,

- determine how users use the website,

- improve the operation of the Store,

- improve its appearance and functionality,

- prepare sales statistics,

- measure the effectiveness of our activities.

2. Some analyses may be carried out using aggregated data which does not allow us to directly identify a particular person.
3. Data stored in server logs and information necessary to ensure security and the correct functioning of the Store may be processed on the basis of:

Article 6(1)(f) GDPR – our legitimate interest in ensuring the security, proper operation and diagnostics of the Store.

4. Where analytical activities require the use of optional cookies or other information stored on the user’s device, such activities are carried out only after obtaining appropriate consent.

§ 8 GOOGLE ANALYTICS

1. The Store may use Google Analytics, which enables us to analyse how users interact with the website.
2. The provider of Google services for users in the European Economic Area is generally Google Ireland Limited.
3. Google Analytics may process in particular:

- information concerning pages visited,

- device and browser information,

- information concerning the time of a visit,

- approximate location information derived from technical data,

- cookie identifiers or similar identifiers,

- information concerning interaction with the Store.

4. To the extent that Google Analytics requires access to information stored on the user’s device or the storage of information on that device, we use it only after consent to analytical cookies has been obtained.
5. The user may refuse consent to analytical cookies without losing the ability to make a purchase in the Store.
6. Consent may subsequently be changed or withdrawn using the cookie settings available in the Store.
7. Detailed information concerning personal data processing by Google is available in Google’s documentation and privacy policy.

§ 9 META PIXEL

1. The Store may use Meta Pixel, provided by Meta Platforms Ireland Limited.
2. Meta Pixel may be used in particular to:

- measure advertising effectiveness,

- analyse users’ actions after they move from an advertisement to the Store,

- create campaign statistics,

- conduct remarketing,

- personalise advertising, where the user has given appropriate consent.

3. In connection with the operation of Meta Pixel, the following information may be processed in particular:

- visits to the Store,

- products viewed,

- user activity,

- device and browser information,

- IP address,

- cookie identifiers,

- certain events connected with purchases.

4. To the extent that Meta Pixel requires the user’s consent, it is activated only after consent to marketing cookies or the relevant category of marketing technologies has been given.
5. Refusal to consent to marketing cookies does not prevent the user from making a purchase in the Store.

7. Detailed rules concerning personal data processing by Meta are set out in Meta’s documentation and privacy policy.

§ 10 COOKIES AND SIMILAR TECHNOLOGIES

1. WHAT ARE COOKIES?

Cookies are small pieces of information stored on the user’s device when visiting a website.

We may also use technologies which operate in a similar way, including:

- local storage,

- tags,

- pixels,

- online identifiers,

- analytical scripts.

Information obtained through cookies or similar technologies may in certain circumstances constitute personal data.

2. CATEGORIES OF COOKIES

The Store may use the following categories of cookies:

A. STRICTLY NECESSARY COOKIES

These are required for the correct operation of the Store and to provide a service expressly requested by the user.

They may be used in particular for:

- operation of the Cart,

- maintaining a session,

- correctly processing an order,

- logging in to the Account,

- ensuring website security,

- remembering privacy settings.

Strictly necessary cookies may be used without additional consent where they are necessary for providing a service expressly requested by the user or for carrying out the transmission of a communication.

They cannot be disabled using the consent panel to the extent that they are required for the operation of the Store.

B. FUNCTIONAL AND PREFERENCE COOKIES

These may be used to remember additional settings and user preferences.

Where their use is not necessary to provide a service requested by the user, they are activated only after appropriate consent has been obtained.

C. ANALYTICAL COOKIES

These enable us to analyse the use of the Store and create statistics.

They may be used in connection with:

- Google Analytics,

- analytical tools connected with the e-commerce platform.

Analytical cookies which are not necessary for operation of the Store are activated only after the user has given consent.

D. MARKETING COOKIES

These may enable:

- measurement of campaign effectiveness,

- creation of advertising audiences,

- remarketing,

- advertising personalisation,

- analysis of the path leading to a purchase.

They may be used in connection with Meta and Google services.

Marketing cookies are activated only after the user has given appropriate consent.

3. MANAGING CONSENT

1. During the first visit to the Store, the user is given the opportunity to make a choice regarding optional cookies.
2. The user may:

- accept all optional cookies,

- reject optional cookies,

- select individual categories.

3. Refusal to consent to analytical or marketing cookies does not prevent the user from making a purchase or using the basic functionalities of the Store.
4. Consent to cookies may be withdrawn or changed at any time.
5. Withdrawing consent should be as easy as giving it.

6. Current cookie settings should be accessible through a function such as “Cookie Settings”, “Manage Consents” or an equivalent tool available in the Store.
7. A complete and up-to-date list of cookies used, their providers, purposes and duration may also be displayed in the consent management panel used by the Store.
8. The user may also delete stored cookies through the settings of their web browser. Browser settings do not, however, replace the consent mechanism used by the Store.

4. DETAILED INFORMATION CONCERNING COOKIES USED BY CUDDLEREST

The following list is based on technologies identified on cuddlerest.pl as of 8 September 2026.

Analytical and marketing cookies are used after the user has given the relevant consent in the cookie consent panel.

5. LOCAL STORAGE AND SIMILAR TECHNOLOGIES

In addition to traditional cookies, the Store uses browser Local Storage.

Information stored in Local Storage generally remains on the user’s device until it is deleted by the Store, the browser or the user.

During testing, the recentlyViewed.recentlyViewed mechanism stored information concerning a viewed product even where consent to functional technologies had not been granted. We classify this functionality as functional; its technical behaviour may depend on the current version of the Shoper/cyber_Folks software.

6. CONSENT CATEGORIES AVAILABLE IN THE CUDDLEREST STORE

The CuddleRest consent panel currently distinguishes the following categories:

- Strictly necessary – always active;

- Functional – activated in accordance with the user’s choice;

- Analytical – activated after consent has been obtained;

- Software provider analytics – analytics performed by the Shoper/cyber_Folks platform provider, activated in accordance with the user’s choice;

- Marketing – activated after consent has been obtained.

The user may change their preferences at any time using the cookie settings available in the Store.

§ 11 SHOPER PLATFORM AND SOFTWARE PROVIDER

1. The CuddleRest Store operates using the Shoper e-commerce software.
2. The current provider of the platform is cyber_Folks S.A.
3. With respect to Customer data entered into the Store system, cyber_Folks S.A. may process personal data on behalf of the Controller as a processor, in accordance with the relevant agreements.
4. The platform provider may also process personal data for its own purposes connected with operation of its software to the extent that it acts as a separate controller. Detailed information is available in the Shoper/cyber_Folks privacy policy.

§ 12 RECIPIENTS OF PERSONAL DATA

We may disclose personal data to entities which help us operate the Store and fulfil orders.

These may include in particular:

1. the provider of the e-commerce platform and technical services – Shoper/cyber_Folks;
2. IT and technical service providers;
3. accounting service providers and entities supporting accounting settlements;
4. payment service providers, in particular:

- Autopay S.A.,

- PayPro S.A./Przelewy24;

7. banks and entities participating in payment processing;
8. courier and logistics service providers, in particular InPost, DPD, GLS, DHL or another carrier selected during checkout;
9. TrustMate – in connection with Customer reviews;
10. newsletter system providers and communication tools;
11. Google – in connection with services used by the Store, subject to the relevant legal requirements;
12. Meta – in connection with marketing and analytical services, subject to the relevant legal requirements;
13. entities providing legal, tax or advisory services where necessary;

14. public authorities, courts and other authorised institutions where disclosure is required by law.

We disclose to each recipient only the scope of personal data necessary for the relevant purpose.

Some recipients process personal data on our instructions as processors, while others – depending on the nature of the services they provide – may act as separate controllers.

§ 13 TRANSFERS OUTSIDE THE EEA

1. Due to CuddleRest’s use of services provided by global technology providers, in particular Google or Meta, personal data may in certain circumstances be accessible from or transferred outside the European Economic Area.
2. Where such a transfer takes place, it is carried out only on the basis of a mechanism permitted under the GDPR, in particular:

- a European Commission adequacy decision – Article 45 GDPR,

- the EU–US Data Privacy Framework where the relevant recipient participates in that mechanism,

- Standard Contractual Clauses approved by the European Commission – Article 46 GDPR,

- another legal mechanism permitted under the GDPR.

3. Where appropriate safeguards within the meaning of Article 46 GDPR are used in a specific case, the data subject may contact the Controller for further information concerning such safeguards.

§ 14 SOCIAL MEDIA

1. The Store may contain links to CuddleRest profiles on social media services and functionalities provided by external social media platforms.
2. When the user moves to an external social media service, the privacy rules of that service provider also apply.
3. Where social media tools used on the website store information on the user’s device or access information stored on that device for purposes other than those strictly necessary for operation of the website, such tools are activated only after appropriate consent has been obtained.

§ 15 PROFILING AND AUTOMATED DECISION-MAKING

1. We may use information concerning user activity to prepare statistical analyses or – after obtaining the required consents – to better tailor content and advertising.
2. Such activities may in certain circumstances constitute profiling within the meaning of the GDPR.
3. The Controller does not make decisions concerning Customers based solely on automated processing which produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 GDPR, unless the user is separately informed in advance about such processing in accordance with applicable law.

§ 16 DATA SUBJECT RIGHTS

In connection with the processing of personal data, you may – in the circumstances provided for by the GDPR – exercise the following rights:

1. RIGHT OF ACCESS

You have the right to obtain confirmation as to whether we process your personal data and, if so, to access such data and receive a copy.

2. RIGHT TO RECTIFICATION

If your personal data is inaccurate or incomplete, you may request that it be corrected or completed.

3. RIGHT TO ERASURE

In the circumstances specified in the GDPR, you may request deletion of your personal data.

This right is not absolute. We may retain certain information where continued processing is necessary, for example to comply with a legal obligation or to establish, exercise or defend legal claims.

4. RIGHT TO RESTRICTION OF PROCESSING

In the circumstances specified in the GDPR, you may request that processing of your personal data be restricted.

5. RIGHT TO DATA PORTABILITY

Where personal data is processed on the basis of consent or a contract and the processing is carried out by automated means, you may, in the circumstances provided for by the GDPR, receive your personal data in a structured, commonly used and machine-readable format and transmit it to another controller.

6. RIGHT TO OBJECT

Where we process personal data on the basis of:

Article 6(1)(f) GDPR – legitimate interests,

you may object to such processing on grounds relating to your particular situation.

DIRECT MARKETING

Where personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent that it is related to direct marketing.

Once such an objection has been made, we will no longer process personal data for direct marketing purposes.

7. RIGHT TO WITHDRAW CONSENT

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Withdrawing consent should be as easy as giving it.

8. RIGHT TO LODGE A COMPLAINT

If you believe that we process your personal data in breach of data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Poland, the supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Where provided for by applicable law, you may also contact the supervisory authority in the European Union Member State of your habitual residence, place of work or place of the alleged infringement.

§ 17 HOW TO EXERCISE YOUR RIGHTS

To exercise your rights concerning personal data, please contact us:

e-mail: kontakt@cuddlerest.pl

or in writing:

Fabryka Przytulności Sp. z o.o. 

1. Rysia 61/2

05-270 Marki 

Poland

In order to protect personal data, we may ask for information allowing us to verify the identity of the person making the request.

§ 18 DATA SECURITY

1. The Controller applies technical and organisational measures appropriate to the nature of the personal data processed and the level of risk.
2. The safeguards used are intended in particular to protect personal data against:

- loss,

- destruction,

- unauthorised alteration,

- unauthorised disclosure,

- unauthorised access.

3. Access to personal data is limited to persons and entities which require access in order to perform their duties or provide services to the Controller.
4. Processors acting on our instructions are required to ensure an appropriate level of personal data protection in accordance with the agreements concluded and applicable law.

§ 19 CHANGES TO THIS PRIVACY POLICY

1. This Policy may be updated in particular as a result of:

- changes in applicable law,

- changes in the operation of the Store,

- introduction of new functionalities,

- introduction of new payment methods,

- changes in payment service providers,

- changes in service providers,

- introduction of new analytical or marketing tools.

2. The current version of this Policy is always available in the Store.
3. The date of the most recent update is indicated in this Policy.

Last updated: 8 September 2026