Privacy

Privacy policy

Effective from: 27 August 2026
Controller: EDUstick Sp. z o.o.
Original language: Polish

This Privacy Policy describes how EDUstick® collects, uses, and discloses personal data of users (Consumers, natural persons) of our online store edustick.shop and of the brand information site edustick.eu, which does not sell, and how we use cookies. It is provided in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"). In case of any discrepancy between this English translation and the original Polish version, the Polish text prevails.

§ 1. Data Controller

We are the controller of the User's (Consumer's) personal data:

Controller: EDUstick Sp. z o.o.
ul. Żegańska 15
04-713 Warsaw, Poland
Registration: KRS 0001116158
NIP 9522258570
REGON 529170439
Share capital: PLN 50,000
Data protection contact: iod@edustick.eu
Court of registration: District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register

Hereinafter referred to as "EDUstick".

§ 2. About This Policy

EDUstick operates this store and website, including all related information, content, features, tools, products, and services, in order to provide the User with a tailored shopping experience (the "Services"). The EDUstick store is powered by Shopify technology, which enables us to offer the Services to the User. This Privacy Policy describes how we collect, use, and disclose personal data of Users who visit and use the Services, make purchases through them, or otherwise communicate with us. In case of conflict between our Terms of Service and this Privacy Policy, this Privacy Policy applies to the collection, processing, and disclosure of the User's personal data.

Please read this Privacy Policy carefully. By using and accessing the Services, the User confirms familiarity with this Privacy Policy and understanding of the rules governing the collection, use, and disclosure of their data as described herein.

§ 3. Personal Data We Collect and Process

When we use the term "personal data", we refer to information that identifies the User or can reasonably be linked to them. Personal data does not include information collected anonymously or that has been anonymised in a manner that prevents identification of the User or linking it to the User.

We may collect or process the following categories of personal data, including conclusions drawn from them, depending on how the User uses the Services and their place of residence, and to the extent permitted or required by applicable law:

Contact data: including first and last name, address, billing address, shipping address, telephone number, and email address (Article 6(1)(a, b) GDPR).
Financial data: including credit card numbers, debit card numbers, financial account numbers, payment card details, financial account details, transaction details, payment forms, payment confirmations, and other payment data (Article 6(1)(b) GDPR).
Account information: including username, password, security questions, preferences, and settings (Article 6(1)(b) GDPR).
Transaction information: including items the User views, adds to cart, adds to wishlist, purchases, returns, exchanges, or cancels, as well as past transactions (Article 6(1)(f) GDPR).
Communications with us: including information provided in communications with us, e.g. when sending an enquiry to customer service (Article 6(1)(b) GDPR).
Device information: including information about the customer's device, browser or network connection, IP address, and other unique identifiers (Article 6(1)(b) GDPR).
Usage information: including information regarding the customer's interactions with the Services, including how and when the Services are used or navigated (Article 6(1)(b) GDPR).

§ 4. Sources of Personal Data

We may collect personal data from the following sources:

Directly from the customer: including at the time of account creation, when visiting or using our Services, when communicating with us, or where the User provides personal data to us in any other way.
Automatically through the Services: including from the User's device when using our products or services or visiting our websites, and through the use of cookies and similar technologies.
From service providers: including where we cooperate with them to operate certain technology and where they collect or process the User's personal data on our behalf.
From our partners or other third-party companies: in accordance with applicable law.

§ 5. How We Use the Customer's Personal Data

Depending on how the User interacts with us and the Services used, we may use the User's personal data for the following purposes:

Providing, customising, and improving the Services. We use the User's personal data to provide the Services, including to perform the contract concluded with the User, process payments, fulfil orders, remember preferences and products of interest to the User, send notifications related to the User's account, process purchases, returns, exchanges, and other transactions, create, maintain, and manage the User's account, arrange shipping, enable returns and exchanges, enable posting of reviews, and create personalised shopping experiences, for example by recommending products related to the User's previous purchases. This may include using the customer's personal data to personalise and improve the Services.
Marketing and advertising. We may use the User's personal data for marketing and promotional purposes such as sending marketing, advertising, and promotional communications via email, text message, or postal mail, and to display online advertisements to the User promoting products or services on our Services or on other websites, including based on items purchased or added to cart by the User or other User activity on the Services.
Security and fraud prevention. We use the User's personal data to authenticate the User's account, ensure secure payments and purchases, detect and investigate potentially fraudulent, illegal, unsafe, or malicious activity, take appropriate steps to combat such activity, and protect public safety and the security of our services. If the User chooses to use the Services and register an account, they will be responsible for keeping their account credentials secure. We strongly advise against sharing the username, password, and other authentication credentials with anyone.
Communicating with the User. We use the User's personal data to provide customer service, answer questions, deliver effective services, and maintain a business relationship.
Legal reasons. We use the User's personal data to ensure compliance with applicable law or to respond to legitimate legal processes, including requests from law enforcement or government authorities, and to conduct investigations or participate in evidentiary proceedings in civil matters, potential or actual litigation, or other adversarial proceedings, and to enforce or investigate potential violations of our terms or policies.

Educational materials and the EDUstick Creators Club account. The EDUstick Creators Club is the part of edustick.eu that holds the lesson plan library, available at edustick.eu/en/club/; earlier versions of this Policy described it as the "Education section". To download lesson plans, the User provides a first name, last name and email address, and consents to receiving educational materials and news about new lesson plans. The legal basis is consent (Article 6(1)(a) GDPR), which can be withdrawn at any time by writing to contact@edustick.eu or using the unsubscribe link in any message. Withdrawal does not affect the lawfulness of processing carried out beforehand. This data is handled in the HubSpot CRM and kept until consent is withdrawn, and at most 36 months from the last activity.

Ratings and notes on lesson plans. The User may rate a plan from 1 to 6 and add notes. The rating and the notes are linked to the email address given at registration, because they serve to improve the materials and to follow up on questions. We do not publish them and do not share them with third parties other than the processor named above. The legal basis is our legitimate interest in developing educational materials (Article 6(1)(f) GDPR).

Access marker in the browser. After registration we store the email address and the registration date in the browser's local storage so that we do not have to ask for them on every visit. The marker stays on the User's device and can be removed by clearing site data.

§ 6. How We Disclose Personal Data

In certain circumstances, we may disclose the User's personal data to third parties for legitimate purposes, in accordance with this Privacy Policy. These circumstances may include:

In the case of Shopify, we may disclose data to vendors and other third parties who provide services on our behalf (e.g. IT management, payment processing, data analysis, customer service, cloud storage, order fulfilment, and shipping).
In the case of business and marketing partners, in order to provide marketing services and present advertisements to the User. For example, we use Shopify to deliver personalised advertisements through third-party services based on the User's online activity across different merchants and websites. Our business and marketing partners will use the User's data in accordance with their own personal data processing policies. Depending on the User's place of residence, the User may have the right not to share their data for the purposes of displaying personalised advertisements and marketing based on online activity across different merchants and websites.
Where the User instructs us to disclose certain data to third parties, i.e. requests this or consents to it, for example for the purpose of shipping products or in connection with the use of social media widgets or login integrations.
Our affiliates or within our corporate group.
In connection with a business transaction such as a merger or insolvency, in order to fulfil obligations arising from applicable law (including in response to court summons, search warrants, and similar requests), to enforce applicable terms of service or policies, and to protect and defend the Services, our rights, the User's rights, or the rights of others.

Contact forms on edustick.eu. Enquiries sent through the contact form and the partner form are received in the HubSpot CRM, operated by HubSpot, Inc. HubSpot acts as a data processor under a data processing agreement concluded with us. For this purpose we process your first name, last name, email address and message, and for partner enquiries also your company name and country. The data is used solely to answer the enquiry and to carry on the resulting correspondence.

The EDUstick Creators Club account. The User may create an account in order to come back to the lesson plan library, save favourites and see their own history. There are three ways to create one: with a Google account, with a Microsoft account, or by giving an email address and setting a password. We then process the email address, the first and last name, and the chosen language. With external sign-in we receive from the provider only the User identifier, the email address and the name or display name. We gain no access to the User's mail, files or other resources held by that provider. With password sign-in we store only an irreversible hash of the password, never the password itself. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR).

Sign-in providers. Google sign-in is operated by Google Ireland Limited and Microsoft sign-in by Microsoft Ireland Operations Limited. Using that route means the provider learns that you signed in to our service. A User who prefers to avoid this can create an account with an email address and a password.

Where account data is held. Accounts, favourites, ratings and activity history are kept in Supabase, which acts as a data processor under a data processing agreement concluded with us. This project's database runs in the Ireland region, that is inside the European Economic Area. Supabase Inc. is nevertheless established in the United States, and technical support and sub-processors may access the data outside the EEA. The transfer relies on the European Commission's standard contractual clauses concluded in the data processing agreement.

Access codes. The code that unlocks file downloads is bought in the edustick.shop store. Once it is entered we record the access expiry date, the moment the code was used and the order reference, so that we can handle a complaint. We do not store the code itself in readable form, only as an irreversible hash. The legal basis is performance of the contract (Article 6(1)(b) GDPR) together with our accounting obligations (Article 6(1)(c) GDPR).

Activity history. We record which lesson plan the User opened, when the slides were launched and which file was downloaded. This serves two purposes: showing Users their own history in the panel, and developing the materials, that is seeing which plans are used and which need work. The legal basis is our legitimate interest (Article 6(1)(f) GDPR). You have the right to object to this processing.

How long we keep account data. Until the User deletes the account, and if an account goes unused, for at most 36 months from the last sign-in. The account can be deleted at any time by writing to contact@edustick.eu from the address the account is registered to. On deletion we remove the User's data, including favourites, ratings and activity history. We keep longer only those records that tax law or the defence of legal claims requires. Expiry of the download access window deletes neither the account nor its history.

Bot protection on the EDUstick Creators Club gate. The sign-in and registration page uses Cloudflare Turnstile, provided by Cloudflare, Inc. The mechanism starts when the page is opened, not only when a form is submitted. For this purpose Cloudflare receives the User's IP address and technical information about the browser and device, on the basis of which it decides whether the request comes from a human. We do not pass the email address, the password or the contents of the form this way. The purpose is to stop automated account creation and mass triggering of code messages: exhausting the sending quota would mean that real Users stop receiving the codes they need in order to sign in. The legal basis is our legitimate interest in the security of the Service (Article 6(1)(f) GDPR).

Messages with one-time codes. Confirming the email address when an account is created, and setting a new password, both require a message carrying a one-time code. Delivery is handled by Azure Communication Services, a Microsoft service, from the sending domain powiadomienia.edustick.eu. We pass to it the recipient's email address and the contents of the message. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR). We do not send marketing messages this way.

Hosting of the information site. The edustick.eu site is a set of static pages served by Netlify, Inc. The hosting provider processes the User's IP address and the request entry in the server log, which is an inherent part of delivering a page over the internet and also serves to detect abuse. Netlify acts as a data processor under a data processing agreement concluded with us. The company is established in the United States, and the transfer relies on the European Commission's standard contractual clauses.

Database backups. Once a week we take a backup of the database covering account data and the data described in this section. The backup is produced in GitHub Actions, operated by GitHub, Inc., and kept there for 90 days, after which it is deleted automatically. GitHub acts as a data processor under a data processing agreement concluded with us. The company is established in the United States, and the transfer relies on the European Commission's standard contractual clauses. The backup serves solely to restore data after a failure; we do not use it for any other purpose.

End-of-activity quiz and badges. A Club member may take the quiz that closes an activity, and on passing the threshold receives a badge shown in the account panel. We record only: the number of correct answers, the number of questions, the percentage score, the timestamp of the attempt and the activity identifier. We do not record the answers given, nor any data about a child: the quiz is taken on an adult's account and that account is the only reference point. The number of attempts per day is limited, and the record of attempts exists precisely to enforce that limit. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR). The data is deleted together with the account.

§ 7. Relationship with Shopify

The edustick.shop online store is hosted by Shopify. This section covers the store only: the edustick.eu information site runs on separate hosting and does not use the Shopify platform. The Services are hosted by Shopify in accordance with its terms. Shopify collects and processes personal data concerning the User's access to and use of the Services, in order to provide and improve them. Data provided through the Services will be transferred to and made available to Shopify, as well as to third parties that may be established in countries other than the User's country of residence, in order to provide services to the User.

Furthermore, in order to secure, develop, and improve our business, we use certain advanced features of Shopify that include data and information obtained from the User's interactions with our Store, with other merchants, and with the Shopify platform. In order to provide these advanced features to the User, Shopify may use personal data collected during the User's interactions with our Store, with other merchants, and with the Shopify platform. In such circumstances, Shopify is responsible for processing the User's personal data, including responding to the User's requests regarding the exercise of their rights related to the use of personal data for these purposes.

To learn more about how Shopify uses personal data and about any rights the User may have, please visit Shopify's privacy section: Shopify Consumer Privacy Policy. Depending on the User's place of residence, the User may exercise applicable rights regarding their personal data here: Shopify Privacy Portal.

§ 8. Third-Party Websites and Links

The Services may contain links to websites and other online platforms operated by third parties. When transferring to websites not affiliated with us or not controlled by us, the User should review their privacy and security policies and other terms and conditions. We do not guarantee the privacy or security of such websites, nor are we responsible for them. This includes, but is not limited to, the accuracy, completeness, and reliability of information found on these websites. Information that the User provides in public or semi-public places, including data shared on third-party social media platforms, may also be visible to other users of the Services and/or users of such third-party platforms without restrictions on its use by us or by the third party. Our inclusion of such links does not in itself imply endorsement of the content on such platforms or of their owners or operators, except as explained in the Services.

§ 9. Cookies

Cookies (so-called "cookies") are IT data, in particular text files, that are stored on the User's end device and intended for use with the Shopify platform. Cookies typically contain the name of the website they originate from, the time of storage on the end device, and a unique number.
The Shopify platform uses two fundamental types of Cookies: "session" (session Cookies) and "persistent" (persistent Cookies). "Session" Cookies are temporary files that are stored on the User's end device until they leave the website or close the software (web browser). "Persistent" Cookies are stored on the User's end device for the time specified in the Cookie parameters or until they are deleted by the User. A detailed description of Shopify platform cookies is available at: shopify.com/pl/legal/cookies
Please note that you can control and manage cookies in various ways. We remind you that deleting or blocking cookies may negatively affect the user experience, and some parts of our website may not be fully accessible. Most browsers automatically accept cookies, but you can decide whether to accept them by using the browser function, often located in the "Tools" or "Preferences" menu. More information on how to modify browser settings or block, manage, or filter cookies can be found in the browser's help file or on websites such as: allaboutcookies.org.
Many advertising services and other third parties provide the option to opt out of their systems. You can read more about the information they collect and how to opt out via the links to the privacy policies listed at: shopify.com/pl/legal/cookies

The edustick.eu information site. The brand site uses its own consent banner. Your choice is stored in the browser's local storage under the key eduCookieConsent and can be changed at any time through the "Cookie settings" link in the footer. Visit statistics are collected in Google Analytics 4 (provider: Google Ireland Limited). The analytics script loads only after consent is given and does not run before that. Apart from storing the consent record itself, the information site does not use cookies for marketing purposes.

§ 10. Children's Data

The Services are not intended for use by children. We do not knowingly collect any personal data concerning children below the age of majority in the User's jurisdiction. If the User is a parent or guardian of a child who has provided us with their personal data, the User may contact us using the contact information below to request its deletion. As of the effective date of this Privacy Policy, we have no actual knowledge of "sharing" or "selling" (as those terms are defined in applicable law) personal data of persons under 16 years of age.

§ 11. Security and Retention of User Data

Please note that no security measures are perfect or impenetrable, and we cannot guarantee "complete security". Furthermore, any data transmitted to us may not be secure during transmission. We advise against using insecure channels to transmit sensitive or confidential data to us.
The length of time we retain the User's personal data depends on various factors, such as whether we need this information to operate the User's account, provide the Services to the User, meet legal requirements, resolve disputes, or enforce other applicable contracts and policies. As a rule, we are obliged to retain transaction data for no less than 5 years, as required by the Polish Accounting Act.

Form enquiries. Correspondence arising from a contact form enquiry is kept for 12 months from the last contact, and partner enquiries for 24 months from the last contact, after which it is deleted or anonymised. We keep data longer only where tax law or the defence of legal claims requires it.

§ 12. User Rights and Choices

Depending on the User's place of residence, the User may be entitled to all or some of the following rights related to their personal data. However, these rights are not absolute, may apply only in certain circumstances, and in some cases we may refuse the User's request to the extent permitted by law. These rights are:

Right of access. The User may have the right to access the personal data we hold about them.
Right to erasure. The User may have the right to request the erasure of personal data we hold about them.
Right to rectification. The User may have the right to request the rectification of inaccurate personal data we hold about them.
Right to data portability. The User may have the right to obtain a copy of the personal data we hold about them and to request its transfer to a third party in certain circumstances and with certain exceptions.
Managing communication preferences. We may send the User promotional emails, and the User may opt out of receiving them at any time using the unsubscribe option displayed in our emails to the User. If the User opts out, we may still send non-promotional emails, for example concerning the User's account or orders placed.
If the User is a resident of the United Kingdom or the European Economic Area and subject to exceptions and limitations provided by local law, in addition to the rights described above, the User may exercise the following rights:
1. Objection to processing and restriction of processing: The User has the right to ask us to stop or restrict the processing of their personal data for certain purposes.
2. Withdrawal of consent: Where we need the User's consent to process their personal data, the User has the right to withdraw that consent. If the User withdraws consent, this will not affect the lawfulness of any processing based on their consent prior to its withdrawal.
The User may exercise any of these rights where indicated in the Services or by using the contact information below. To learn more about how Shopify uses the User's personal data and about the rights that may apply to them, including rights related to data processing by Shopify, please visit privacy.shopify.com/pl.
We will not discriminate against the User for exercising any of these rights. We may need to verify the User's identity before proceeding with their request, in accordance with applicable law. In accordance with applicable regulations, the User may authorise a representative to submit requests on their behalf relating to the exercise of their rights. Before accepting such a request submitted by a representative, we will require proof that the representative has been authorised by the User to act on their behalf, and we may ask the User to directly confirm their identity. We will respond to the User's request within the timeframe provided by applicable law.

§ 13. Complaints

In case of complaints regarding the way we process personal data, please contact us using the contact information below. Depending on the User's place of residence, the User may have the right to appeal our decision by contacting us using the contact information below, or to lodge a complaint with the local data protection authority. A list of the relevant data protection supervisory authorities in the EEA can be found here.

In Poland, the competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), uodo.gov.pl.

§ 14. International Data Transfers

We may transfer, store, and process the User's personal data outside the User's country of residence. If we transfer the User's personal data outside the European Economic Area or the United Kingdom, we rely on recognised data transfer mechanisms, such as the European Commission's Standard Contractual Clauses or equivalent agreements issued by the relevant supervisory authority in the United Kingdom, unless the data is transferred to a country that has been recognised as providing an adequate level of protection.

HubSpot. The CRM portal in which we handle form enquiries operates in the European Union region. HubSpot, Inc. is nevertheless established in the United States, and technical support and sub-processors may access the data outside the European Economic Area. The transfer relies on the European Commission's standard contractual clauses concluded in the data processing agreement.

Cloudflare. The service that protects the sign-in gate against bots is provided by Cloudflare, Inc., established in the United States. The transfer relies on the European Commission's standard contractual clauses concluded in the data processing agreement.

§ 15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date, and notify the User of changes in accordance with applicable law.

§ 16. Contact

If you have any questions about our personal data protection practices or this Privacy Policy, or wish to exercise any of the rights to which you are entitled, please contact us:

Email: iod@edustick.eu
Postal address: EDUstick Sp. z o.o.
ul. Żegańska 15
04-713 Warsaw, Poland

In accordance with applicable personal data protection regulations, we are the controller of the User's personal data.

EDUstick Sp. z o.o. · ul. Żegańska 15, 04-713 Warsaw, Poland

KRS 0001116158 · NIP 9522258570 · REGON 529170439 · Share capital: PLN 50,000

Last updated: 1 February 2026. The Polish version of this Privacy Policy is the binding original; this English translation is provided for convenience only. References to "GDPR" mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.