Effective date: 8 September 2026
1. Controller
The controller of personal data collected through LALILL.eu is LALILL GROUP SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Krzywa 4, 64-920 Piła, Poland, KRS 0000928824. Contact: contact@lalill.eu.
2. Data, purposes and legal bases
- Orders and delivery: identification, contact, address, order and transaction data — to perform the contract and meet tax/accounting duties.
- Account: login and order history — to provide the requested account service.
- Enquiries and complaints: contact and case data — to handle the request, perform the contract and establish or defend claims.
- Fraud prevention and security: technical identifiers, logs and transaction signals — our legitimate interest in securing the shop and payments.
- Newsletter: email address and consent record — consent; you may withdraw it at any time using the unsubscribe link.
- Live chat: data you enter and technical data — to answer your request and, where applicable, our legitimate interest in customer service.
3. Recipients
Data is shared only as needed with service providers, including Stripe for payments, UPS for delivery, hosting and IT providers, email/newsletter providers, Smartsupp for live chat, and professional advisers or authorities where required by law. Each recipient receives only data needed for its task.
4. International transfers
Some providers may process data outside the European Economic Area. Where this occurs, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses. Details can be requested by email.
5. Retention
Order and accounting records are kept for the period required by tax and accounting law. Account data is kept until the account is deleted, subject to records we must retain. Enquiries, complaints and claim records are kept until the case and applicable limitation periods end. Newsletter data is kept until consent is withdrawn. Security logs are kept only as long as reasonably necessary.
6. Your rights
You may request access, rectification, erasure, restriction, portability and, where applicable, object to processing based on legitimate interests. You may withdraw consent without affecting earlier processing. Send requests to contact@lalill.eu. You may complain to the Polish President of the Personal Data Protection Office (UODO) or the competent authority in your country.
7. Required data and automated decisions
Data marked as required is necessary to create an account or complete an order. Without it, we cannot provide that service. We do not make decisions producing legal or similarly significant effects based solely on automated processing.
8. Updates
We may update this policy when services or legal requirements change. The current version and effective date are published here.