Polityka prywatności i pliki cookie
Last updated: 24 September 2026
This policy explains what personal data we collect when you visit ilumia.pl or buy from us, why we collect it, who we share it with and what rights you have. It applies to our online store and to our profiles on social networks.
1. Who we are
The controller of your personal data is:
ESTON
Kościuszki 15, 98-220 Zduńska Wola-Karsznice, Poland
Tax number (NIP): 8291324578, business register number (REGON): 101562139
Registered in the Polish Central Register of Business Activity (CEIDG)
For anything concerning your personal data, write to pp@ilumia.pl or call +48 690 913 850. These contacts reach us directly.
2. What we collect, why, and for how long
| Why we process it | What we process | Legal basis | How long |
|---|---|---|---|
| Handling your order, delivering it and issuing the invoice | Name, delivery and billing address, e-mail, phone number, order contents, payment details | Art. 6(1)(b) GDPR, performance of the contract; Art. 6(1)(c) for tax and accounting duties | 5 years from the end of the calendar year in which the tax obligation arose |
| Running your customer account | E-mail, password in encrypted form, order history, saved addresses | Art. 6(1)(b) GDPR | Until you delete the account |
| Complaints, returns and withdrawals from the contract | Contact details, order details, bank account number for refunds | Art. 6(1)(c) GDPR, our statutory duties towards consumers | Until claims expire, normally 6 years |
| Answering questions sent by e-mail, contact form or live chat | Name, e-mail, content of the conversation | Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries | Up to 12 months after the conversation ends |
| Sending the newsletter | E-mail address | Art. 6(1)(a) GDPR, your consent | Until you withdraw consent or unsubscribe |
| Measuring how the store is used and showing you our ads | IP address, device and browser data, pages viewed, actions taken, identifiers stored in cookies | Art. 6(1)(a) GDPR, your consent given in the cookie banner | According to the lifetime of each cookie, see section 6 |
| Protecting forms and payments against abuse | IP address, device and browser data, behaviour on the form | Art. 6(1)(f) GDPR, our legitimate interest in security | As set by the security providers named in section 3 |
| Keeping the website running (server logs) | IP address, date and time, requested file, amount of data transferred, your internet provider | Art. 6(1)(f) GDPR, our legitimate interest in a working store | 7 days |
You can browse ilumia.pl without giving us any personal data. Data becomes necessary only when you place an order, create an account, write to us or subscribe to the newsletter. Where we ask for data to perform a contract, providing it is voluntary but without it we cannot complete the order.
We do not make decisions about you by automated means, and we do not profile you in a way that produces legal effects.
3. Who we share your data with
We do not sell your data. We share it only with the companies that help us run the store, and only to the extent each of them needs.
| What they do for us | Who they are |
|---|---|
| Delivering your order | The carrier you choose at checkout: DPD, DHL, UPS, GLS, FedEx or InPost (InPost sp. z o.o. and Integer.pl S.A., Kraków, Poland) |
| Processing your payment | Stripe Payments Europe, Limited, Dublin, Ireland; PayPro S.A. (Przelewy24), Poznań, Poland |
| Hosting the store and sending our e-mails | Our hosting and mail providers, bound by data processing agreements. We will name them on request. |
| Live chat on the website | Zoho Corporation B.V., Amsterdam, Netherlands (Zoho SalesIQ) |
| Managing your cookie consent | Digital Data Solutions B.V., Amsterdam, Netherlands (CookieFirst) |
| Website statistics and advertising | Google Ireland Limited, Dublin, Ireland (Google Analytics, Google Ads, Google Tag Manager); Meta Platforms Ireland Limited, Dublin, Ireland (Meta Pixel, advertising on Facebook and Instagram); Pinterest Europe Limited, Dublin, Ireland |
| Protecting forms and payments | Google Ireland Limited (reCAPTCHA); Intuition Machines, Inc. (hCaptcha, used inside the Stripe payment flow) |
Where we advertise through Meta, the Meta Pixel installed on our website records your visit and the actions you take here, and matches them with your Meta account so that we can measure our advertising and show our products to people likely to be interested in them. Some of the data used for matching, such as your e-mail address, is transformed into an irreversible form before it leaves your browser. For the collection of this data and its transfer to Meta we and Meta Platforms Ireland act as joint controllers under Art. 26 GDPR; what Meta does with the data afterwards is its own responsibility. The pixel runs only if you accept marketing cookies.
We may also disclose data to public authorities where the law requires it.
4. Transfers outside the European Economic Area
Some of the providers listed above belong to groups with companies in the United States, and your data may be transferred there. Such transfers are covered either by the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, or by the standard contractual clauses adopted by the European Commission, together with additional safeguards. You may ask us for a copy of the safeguards that apply.
5. Your rights
Under the GDPR you may ask us to:
- tell you what data we hold about you and give you a copy of it (Art. 15)
- correct data that is wrong or incomplete (Art. 16)
- delete your data, unless we still need it to meet a legal duty or to defend a claim (Art. 17)
- restrict how we use your data while a dispute about it is resolved (Art. 18)
- hand over the data you gave us in a machine-readable format, or send it to another controller (Art. 20)
- stop processing based on our legitimate interest (Art. 21). Where we process your data for direct marketing, we stop as soon as you object, without exception.
Where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect anything we did lawfully before it.
Write to pp@ilumia.pl to exercise any of these rights. We answer within one month.
You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
6. Cookies and similar technologies
Cookies are small text files stored on your device. We use them in three groups.
Necessary cookies keep the store working: they remember your cart, your login session, your chosen language and protect forms against abuse. They are set on the basis of our legitimate interest and cannot be switched off, because without them the store does not function.
Statistics cookies tell us which pages are visited and where people have trouble, so that we can improve the store. Marketing cookies let us show you our products on other websites and measure whether our advertising works. Both groups are set only after you agree to them.
You choose which groups you accept in the banner shown on your first visit. You can change or withdraw that choice at any time through the cookie settings link in the footer of every page. You can also delete cookies or block them entirely in your browser settings, under privacy options, though blocking the necessary ones will stop parts of the store from working.
The table below lists the cookies our store software sets by itself.
| Cookie name | What it does |
|---|---|
| FORM_KEY | Stores a random key used to prevent forged requests. |
| PHPSESSID | Your session identifier on the server. |
| GUEST-VIEW | Lets guests view and edit their orders. |
| PERSISTENT_SHOPPING_CART | Links to your cart and viewing history, if you asked for this. |
| STORE | The store view or language you selected. |
| USER_ALLOWED_SAVE_COOKIE | Records whether you allowed cookies to be used. |
| MAGE-CACHE-SESSID, MAGE-CACHE-STORAGE, MAGE-CACHE-STORAGE-SECTION-INVALIDATION, MAGE-CACHE-TIMEOUT, SECTION-DATA-IDS, PRIVATE_CONTENT_VERSION | Cache content in your browser so that pages load faster. |
| X-MAGENTO-VARY | Caches content on the server so that pages load faster. |
| MAGE-TRANSLATION-FILE-VERSION, MAGE-TRANSLATION-STORAGE | Help translate content into other languages. |
Cookies set by the providers named in section 3 are listed, with their purposes and lifetimes, in the cookie settings panel available from the footer.
7. Our profiles on social networks
We run profiles on Facebook, Instagram and Pinterest. When you visit them, those networks process your data under their own privacy policies and on their own terms, and we have no influence over it. Where the network prepares statistics about our profile for us, we act as joint controllers with it for that limited purpose. Buttons linking to our profiles from ilumia.pl are ordinary links: they do not connect you to those networks until you click them.
8. Changes to this policy
We update this policy when the way we process data changes, or when the law requires it. The date of the latest version appears at the top of this page.