Privacy policy
This Privacy Policy describes how your personal information is collected, used and shared when you visit or make a purchase from pastrymade.com (the "Site").
Who is responsible for your data
The data controller is Goody Woody Karolina Zielińska, Jana Kazimierza 9/29, 01-248 Warszawa, Poland. For any question about your personal data, or to exercise any of the rights described below, write to contact@pastrymade.com.
What we collect
Device Information. When you visit the Site we automatically collect information about your device, including your browser, IP address, time zone and cookies installed on your device. As you browse, we also collect information about the pages and products you view, the site or search term that referred you, and how you interact with the Site. This is collected through cookies, log files, web beacons, tags and pixels.
Order Information. When you make or attempt to make a purchase, we collect your name, billing address, shipping address, payment information, email address and phone number.
Session recordings. We use a tool that records how visitors move through the Site — clicks, scrolling and navigation — so we can find and fix usability problems. These recordings are pseudonymised and are not used to identify you personally.
Why we use it, and on what legal basis
- To fulfil your order — process payment, arrange shipping, send confirmations and invoices. Legal basis: performance of the contract.
- To screen for fraud and risk, in particular using your IP address. Legal basis: our legitimate interest in preventing fraud.
- To improve the Site through analytics and session recordings. Legal basis: your consent, or our legitimate interest where consent is not required in your country.
- To send you marketing by email or SMS, where you have asked us to. Legal basis: your consent, which you can withdraw at any time.
Who we share it with
We use the following service providers, each of which processes personal data on our behalf:
- Shopify — e-commerce platform hosting the Site and processing orders. Privacy policy
- Shop Pay (Shopify) — accelerated checkout and order tracking.
- Klaviyo — email and SMS marketing, and the customer profiles behind it. Privacy policy
- Loox — collection and display of customer reviews and review photos. Privacy policy
- Microsoft Clarity — session recording and heatmaps, used to diagnose usability problems. Privacy statement
- Google — Google Tag Manager, which loads our analytics and advertising tags, including Google Analytics. Privacy policy
- Meta — advertising and measurement tools for Facebook and Instagram campaigns. Privacy policy
- UPS and FedEx — carriers, who receive the delivery address needed to bring you your order.
We may also disclose personal information to comply with applicable law, to respond to a lawful request, or to protect our rights.
Transfers outside the European Economic Area
Some of the providers above are established outside the EEA, principally in the United States. Where that is the case, the transfer is covered by the European Commission's standard contractual clauses or by an adequacy decision, as applicable.
How long we keep it
Order information is kept for as long as required by Polish accounting and tax law, which is currently five years from the end of the tax year in which the sale took place. Marketing data is kept until you withdraw your consent. Analytics and session recording data is kept for a maximum of 13 months.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. Write to contact@pastrymade.com and we will respond within one month. You also have the right to lodge a complaint with the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (uodo.gov.pl), or with the authority in your own country.
Behavioural advertising
We use your personal information to show you advertisements we believe may interest you. You can opt out of targeted advertising through Meta, Google, or the Digital Advertising Alliance opt-out portal.
Do Not Track
We do not currently alter our data collection practices in response to a Do Not Track signal from your browser.
SMS marketing
If you consent to SMS marketing at checkout or through our subscription tools, we use your number to send order notifications, including abandoned checkout reminders, marketing offers and review requests. Opt-in data and consent for text messaging are never shared with third parties other than our messaging provider, for the sole purpose of operating the programme. Reply STOP to any message to unsubscribe.
Changes
We may update this policy to reflect changes to our practices or for legal reasons. This version is dated 26 August 2026.