Privacy policy

  • Effective from: 1 October 2026
  • Controller: EDUstick Sp. z o.o.
  • Applies to: the edustick.shop store and the edustick.eu website (including the EDUstick Creators Club)
  • Original language: Polish

This Privacy Policy describes how EDUstick Sp. z o.o. processes the personal data of people using the edustick.shop online store (the “Store”) and the edustick.eu website, including the EDUstick Creators Club at edustick.eu/klub/ (the “Website”), and how we use cookies and similar technologies. The same text applies in the Store and on the Website. Passages that apply to only one of them are marked. It is provided in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”). In case of any discrepancy between this English translation and the original Polish version, the Polish text prevails.

§ 1. Data Controller

We are the controller of the User's personal data:

  • Controller: EDUstick Sp. z o.o., ul. Żegańska 15, 04-713 Warsaw, Poland
  • Registration: KRS 0001116158, NIP 9522258570, REGON 529170439, Share capital: PLN 50,000
  • Data protection contact: iod@edustick.eu
  • Court of registration: District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register

Hereinafter referred to as “EDUstick”.

§ 2. About This Policy

EDUstick operates the Store, where it sells products and Creators Club subscriptions, and the Website, where it provides brand information and Creators Club Materials (together the “Services”). The Store runs on the Shopify platform; the Website runs on separate infrastructure described in § 6. This Privacy Policy describes how we collect, use and disclose personal data of Users who visit and use the Services, make purchases through them or otherwise communicate with us. In case of conflict between the Store Terms of Service or the Website Terms and this Privacy Policy, this Privacy Policy applies to the collection, processing and disclosure of personal data.

Please read this Privacy Policy carefully.

§ 3. Personal Data We Collect and Process

When we use the term “personal data”, we refer to information that identifies the User or can reasonably be linked to them. Personal data does not include information collected anonymously or anonymised in a manner that prevents identification of the User.

Depending on how the Services are used, we may process the following categories of personal data:

  1. Contact data: name, address, billing address, shipping address, telephone number, email address (Article 6(1)(b) GDPR — performance of contract; (c) — tax and accounting obligations; (a) — newsletter and marketing communications, based on consent).
  2. Payment data: transaction details, payment method, payment confirmations, bank account number for refunds. Payment card data is processed by the payment operator (Article 6(1)(b) and (c) GDPR).
  3. Account information: email address, name, settings and preferences; on the Website also an irreversible password hash or the identifier from Google or Microsoft sign-in (Article 6(1)(b) GDPR).
  4. Transaction information: products and subscriptions purchased, returned, exchanged or cancelled (Article 6(1)(b) and (c) GDPR); products viewed and added to cart — for analytics and advertising (in the Store: Article 6(1)(f) GDPR; see § 9).
  5. Communications with us: content of enquiries and correspondence, e.g. with customer service or via forms (Article 6(1)(b) GDPR, otherwise (f) — answering the enquiry).
  6. Device information: information about the device, browser or network connection, IP address and other identifiers (operation and security of the Services: Article 6(1)(f) GDPR; analytics and advertising: in the Store Article 6(1)(f) GDPR, on the Website Article 6(1)(a) GDPR — consent; see § 9).
  7. Usage information: how and when the Services are used and navigated (operation and security of the Services: Article 6(1)(f) GDPR; analytics and advertising: in the Store Article 6(1)(f) GDPR, on the Website Article 6(1)(a) GDPR — consent; see § 9).
  8. Creators Club data (Website): Access Codes used (as a hash), order number, Access Window dates, date and content of the consent to performance before the withdrawal period ends, favourites, ratings and comments, activity history, quiz results — details in § 5a.

§ 4. Sources of Personal Data

We may collect personal data from the following sources:

  1. Directly from the User: when creating an account, placing an order, using the Services, submitting forms and communicating with us.
  2. Automatically through the Services: from the User's device, including through cookies and similar technologies (§ 9).
  3. From service providers: where they process data on our behalf (§ 6).
  4. From sign-in providers: Google or Microsoft — when the User signs in to the Website with their account (§ 5a).
  5. From our Store to the Website: the order number and email address linked to an Access Code.

§ 5. How We Use Personal Data

Depending on how the User interacts with us and the Services used, we use personal data for the following purposes:

  1. Providing the Services and performing the contract. Fulfilling orders and subscriptions, processing payments, shipping, returns and exchanges, issuing Access Codes, operating Store and Website accounts, account and order notifications (Article 6(1)(b) GDPR).
  2. Marketing and advertising. We send marketing emails only with consent (Article 6(1)(a) GDPR). In the Store we use Google and Meta advertising tools (including the Parkour app), which measure ad performance and allow ads to be shown on other websites based on activity in the Store. The legal basis is our legitimate interest in marketing our own products (Article 6(1)(f) GDPR); the User may object and limit these tools at any time (§ 9). This involves profiling that has no legal or similarly significant effects on the User.
  3. Analytics and development of the Services. Visit statistics (Google Analytics): in the Store — our legitimate interest in improving the Store (Article 6(1)(f) GDPR); on the Website — only with consent (Article 6(1)(a) GDPR); details in § 9. Developing Materials based on activity history on the Website — our legitimate interest (Article 6(1)(f) GDPR), § 5a.
  4. Security and abuse prevention. Account authentication, bot protection, detecting fraud and abuse (Article 6(1)(f) GDPR). The User is responsible for keeping their login credentials confidential.
  5. Communicating with the User. Customer service, answering enquiries, complaints (Article 6(1)(b) and (f) GDPR).
  6. Legal obligations and claims. Tax and accounting, responding to requests from competent authorities, establishing, exercising and defending claims (Article 6(1)(c) and (f) GDPR).

§ 5a. The edustick.eu Website and the EDUstick Creators Club

This section applies to the Website.

Creators Club account. The User may create an account to use the activity library, enter Access Codes, save favourites and view their own history. An account can be created in three ways: with a Google account, with a Microsoft account, or with an email address and password. We then process the email address, name and chosen language. With external sign-in we receive from the provider only the User identifier, email address and name or display name. We do not access the User's mail, files or other resources at that provider. With password sign-in we store only an irreversible password hash, never the password in clear text. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR).

Sign-in providers. Google sign-in is provided by Google Ireland Limited and Microsoft sign-in by Microsoft Ireland Operations Limited. Using this option means the provider learns that the User has signed in to our Website. A User who does not want this can create an account with an email address and password.

Access Codes. An Access Code is sent by email for each paid period of a Creators Club subscription purchased in the Store. When issuing a Code we link it to the order number and the email address from the order. When the Code is entered on the Website we record the Access Window end date, the time the Code was used, the order number and — if given — the date and content of the consent to performance before the withdrawal period ends. We do not store the Code in clear text, only as an irreversible hash. Legal bases: performance of contract (Article 6(1)(b) GDPR), accounting obligations ((c)) and our legitimate interest in demonstrating consent and defending claims ((f)).

Activity history. We record which activity the User opened, when they started the slides and which file they downloaded. This serves to show the User their own history in the dashboard and to develop materials, i.e. to see which activities are used and which need improvement. The legal basis is our legitimate interest (Article 6(1)(f) GDPR). The User may object to this processing.

Ratings and comments. The User may rate an activity on a scale of 1 to 6 and add comments. Ratings and comments are linked to the account because they serve to improve materials and to contact the User with questions. We do not publish them. The legal basis is our legitimate interest in developing educational materials (Article 6(1)(f) GDPR).

End-of-activity quiz and badges. A Club member may take the quiz closing an activity and, above a threshold of correct answers, receives a badge shown in the account dashboard. We record only: the number of correct answers, the number of questions, the percentage score, the attempt timestamp and the activity identifier. We do not record the answers given or any data about a child: the quiz is taken on the adult's account. The number of attempts per day is limited, and the attempt record serves to enforce that limit. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR). The data is deleted together with the account.

Bot protection. The login and registration page uses Cloudflare Turnstile. The mechanism starts when the page is opened. Cloudflare receives the User's IP address and technical information about the browser and device to decide whether the request comes from a human. We do not pass the email address, password or form content this way. The purpose is to prevent automated account creation and mass triggering of login-code messages. The legal basis is our legitimate interest in the security of the Website (Article 6(1)(f) GDPR).

One-time code messages. Confirming the email address when creating an account and setting a new password require sending a message with a one-time code. Sending is handled by Azure Communication Services (Microsoft group) from the sender domain powiadomienia.edustick.eu. We pass the recipient's email address and the message content. The legal basis is performance of the account agreement (Article 6(1)(b) GDPR). No marketing messages are sent this way.

Contact forms. Enquiries sent via the contact form and the partnership form on the Website go to the HubSpot CRM. We process the name, email address and message content and, for partnership enquiries, also the company name and country. The data is used only to answer the enquiry and for further correspondence (Article 6(1)(b) or (f) GDPR).

Newsletter. Regardless of the account and access to Materials, the User may sign up for news about new activities and offers. Sign-up is voluntary and is not a condition for using the Website or downloading Materials. The legal basis is consent (Article 6(1)(a) GDPR), which can be withdrawn at any time via the link in the message or by writing to contact@edustick.eu.

Hosting and backups. The Website pages are hosted by Netlify, which processes the User's IP address and the request record in the server log — this is inherent in serving a web page and also helps detect abuse. Accounts, favourites, ratings, Codes and activity history are kept in Supabase (database in the Ireland region). Once a week we back up the database in GitHub Actions; the backup is kept for 90 days and is used only to restore data after a failure.

§ 6. Who We Share Personal Data With

  1. We share personal data only to the extent necessary for the given purpose. Some recipients process data on our behalf as processors under data processing agreements (Article 28 GDPR). Others act as independent controllers and process data under their own privacy policies.
  2. Recipients:
    • Shopify International Limited (Ireland) and Shopify Inc. (Canada) and affiliates — processor, and independent controller for the features described in § 7. Where: Store. Store platform, checkout, customer accounts, subscriptions (Shopify Subscriptions app), emails (Shopify Messaging), Shop app and sign-in. Transfer: § 14.
    • Shopify International Limited as operator of Shopify Payments (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland) and Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) — independent controllers for payment processing, including anti-money-laundering and fraud-prevention obligations; Stripe also acts as a processor for Shopify. Where: Store. Card and digital-wallet payments, including recurring subscription payments. Transfer: § 14.
    • Carriers: DPD, InPost, Orlen Paczka and, for shipments to Croatia, Cyprus, Ireland, Malta and countries outside the EU, carriers selected by the Easyship platform (e.g. DHL Express, UPS, FedEx) — independent controllers. Where: Store. Order delivery: name, address, phone, email.
    • Easyship Inc. (USA) — shipping platform; BaseLinker sp. z o.o. (Plac Solny 15, 50-062 Wrocław, Poland, KRS 0000795513, NIP 8971868567) — Base.com order management system; Patryk Jakubik trading as Tale Commerce (ul. Prymasa Stefana Wyszyńskiego 7H lok. 4, 05-220 Zielonka, Poland, NIP 8672245025) — “InPost – Tale Commerce” app — processors. Where: Store. Preparing shipments and labels, order and inventory management. Transfer: Easyship — § 14; BaseLinker and Tale Commerce are established in Poland.
    • Google Ireland Limited (Ireland); Google LLC (USA) — processor (Google Analytics) and independent controller (advertising, Google sign-in). Where: Store and Website. Statistics (Google Analytics 4, Google Tag Manager), conversion measurement and advertising (Google Ads, Merchant Center) — in the Store from the moment the page is opened, on the Website after consent (§ 9); Google sign-in on the Website. Transfer: § 14.
    • Meta Platforms Ireland Limited (formerly Facebook Ireland Ltd, Ireland); Meta Platforms, Inc. (USA) — joint controller for the collection and transmission of data via the Meta Pixel, independent controller thereafter. Where: Store. Measurement and advertising on Facebook and Instagram (Meta Pixel, conversion events) — activated when the Store is opened (§ 9). Transfer: § 14.
    • Ecom Parkour Limited (Tsim Sha Tsui, Hong Kong) — “Parkour” app — processor. Where: Store. Visit-source attribution and sending events to Meta; browser identifiers, approximate location. The app calls IP-address and approximate-location detection services (ipinfo.io, ipify.org) and uses Cloudflare, Inc.; it is activated when the Store is opened (§ 9). Transfer: § 14 (Standard Contractual Clauses).
    • Cloudflare, Inc. (USA) — processor. Where: Website. Protection of the login page against bots (Cloudflare Turnstile): IP address, technical browser data. Transfer: § 14.
    • Netlify, Inc. (USA) — processor. Where: Website. Hosting of edustick.eu: IP address, server log. Transfer: § 14.
    • Supabase, Inc. (USA; database in the Ireland region) — processor. Where: Website. Creators Club accounts, Access Codes, favourites, ratings, activity history, quizzes. Transfer: § 14 (technical support access).
    • HubSpot, Inc. (USA; EU-region portal) — processor. Where: Website. Contact and partnership forms, newsletter. Transfer: § 14.
    • Microsoft Ireland Operations Limited (Ireland); Microsoft Corporation (USA) — independent controller (Microsoft sign-in) and processor (Azure Communication Services). Where: Website. Sign-in; sending one-time code emails from powiadomienia.edustick.eu. Transfer: § 14.
    • GitHub, Inc. (USA) — processor. Where: Website. Weekly backups of the Website database (90 days). Transfer: § 14.
    • ConsultPL, the accounting firm keeping EDUstick's books — processor under a data processing agreement. Where: Store. Bookkeeping and sales documents.
  3. We may also disclose data to law firms and advisers (in a dispute), to public authorities where required by law, to an acquirer of our business, and to other parties on the User's instruction or with their consent.
  4. The current list of processors is available on request at iod@edustick.eu.

§ 7. Relationship with Shopify

This section applies to the Store. The edustick.shop online store is hosted by Shopify in accordance with its terms. The edustick.eu Website runs on separate hosting and does not use the Shopify platform. Shopify collects and processes personal data concerning the User's access to and use of the Store in order to provide and improve it. Data provided through the Store will be transferred to and made available to Shopify, as well as to third parties that may be established in countries other than the User's country of residence, in order to provide services to the User.

Furthermore, in order to secure, develop and improve our business, we use certain advanced features of Shopify that include data and information obtained from the User's interactions with our Store, with other merchants and with the Shopify platform. To provide these features, Shopify may use personal data collected during the User's interactions with our Store, with other merchants and with the Shopify platform. In such circumstances, Shopify is responsible for processing the User's personal data, including responding to the User's requests regarding the exercise of their rights related to the use of personal data for these purposes.

To learn more about how Shopify uses personal data and about the User's rights, please visit: Shopify Consumer Privacy Policy. Depending on their place of residence, the User may exercise their rights here: Shopify Privacy Portal.

§ 8. Third-Party Websites and Links

The Services may contain links to websites and other online platforms operated by third parties. When going to websites not affiliated with or controlled by us, the User should review their privacy and security policies and other terms. We do not guarantee the privacy or security of such websites and are not responsible for them. Information the User shares in public or semi-public places, including third-party social media platforms, may be visible to other users of those platforms. Our inclusion of a link does not imply endorsement of the content on such platforms or of their owners or operators.

§ 9. Cookies and Similar Technologies

  1. What they are. Cookies are small files stored in the browser. Browser local storage (localStorage) and pixels (signals sent to a tool provider) work in a similar way. In this Policy we refer to all of them as “cookies”.
  2. Store. Cookies strictly necessary for the Store are always used. Analytics and marketing tools (Google Analytics 4, Google Merchant Center, Meta Pixel, the Parkour app) are activated in the Store when the page is opened. The legal basis for processing data from these tools is our legitimate interest in measuring traffic, improving the Store and marketing our own products (Article 6(1)(f) GDPR). The User may at any time opt out of or limit these tools on the Your privacy choices page (link in the Store footer) and in browser settings (deleting and blocking cookies, blocking tracking scripts).
  3. Website. On the edustick.eu Website, visit statistics (Google Analytics 4) load only after consent is given in the banner; the legal basis is consent (Article 6(1)(a) GDPR). Consent can be changed or withdrawn at any time via the “Cookie settings” link in the Website footer; withdrawal does not affect the lawfulness of earlier processing. The Website does not use marketing cookies.
  4. Cookie categories:
    • Strictly necessary — Store (Shopify): including _shopify_*, cart, localization, cart_currency and shop.app cookies. Purpose: cart, checkout, currency and language, login, security, storing the consent choice. Duration: session or up to 1 year.
    • Strictly necessary — Website (EDUstick, Supabase, Cloudflare): eduCookieConsent (local storage) — consent choice; login session data; Cloudflare Turnstile on the login page. Purpose: storing the consent decision, keeping the user signed in, bot protection.
    • Analytics — Store and Website (Google Analytics 4): _ga, _ga_<identifier>. Purpose: visit statistics. Duration: up to 400 days (about 13 months).
    • Marketing — Store (Meta): _fbp and the Meta Pixel. Purpose: measurement and advertising. Duration: up to 90 days.
    • Marketing — Store (Ecom Parkour Limited): __parkour* and Parkour_* keys in local storage (including an identifier, visit source, approximate location). Purpose: attribution and sending events to Meta. Duration: __parkour* cookies — 90 days; local storage keys — until deleted in the browser.
    • Marketing — Store (Google): the _gcl_au cookie (where used) and Google Ads and Merchant Center measurement signals. Purpose: conversion measurement and advertising. Duration: _gcl_au — 90 days.
  5. Full description of Shopify platform cookies: shopify.com/legal/cookies. Cookies can also be deleted and blocked in browser settings; blocking strictly necessary cookies may prevent ordering or signing in.

§ 10. Children's Data

The Services are not intended for use by children on their own. Only adults may create a Website account. Quizzes and activities done with children are recorded only on the adult's account, without any data about the child. We do not knowingly collect personal data of children. A parent or guardian of a child who has provided us with personal data may contact us to request its deletion.

§ 11. Security and Retention

  1. We apply technical and organisational measures appropriate to the risk, but no security measures are perfect. We advise against sending us sensitive data through insecure channels.
  2. We retain data as follows:
    • 1) contract and transaction data — for the period required by tax and accounting law (as a rule 5 years from the end of the year in which the tax liability arose) and until claims become time-barred;
    • 2) Store account — until it is deleted;
    • 3) Website account with favourites, ratings, history and quiz results — until the account is deleted; unused accounts — no longer than 36 months after the last login; expiry of the Access Window does not delete the account;
    • 4) record of Access Code use and of the consent to performance — until claims under the contract become time-barred;
    • 5) contact form enquiries — 12 months, partnership enquiries — 24 months after the last contact, after which they are deleted or anonymised;
    • 6) newsletter — until consent is withdrawn, no longer than 36 months after the last activity;
    • 7) Website database backups — 90 days;
    • 8) cookies — as set out in § 9.
  3. We keep data longer only where required by law or for the defence of claims.

§ 12. User Rights and Choices

Subject to the conditions and limitations of the GDPR, the User has:

  1. The right of access to their data and to receive a copy.
  2. The right to rectification of inaccurate data.
  3. The right to erasure.
  4. The right to restriction of processing.
  5. The right to data portability for data processed on the basis of consent or contract.
  6. The right to object to processing based on our legitimate interest (Article 6(1)(f) GDPR), including the activity history on the Website, and at any time to direct marketing.
  7. The right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
  8. Managing communications. Promotional emails can be unsubscribed from via the link in every message. After unsubscribing we may still send non-promotional messages, e.g. about the account, orders, subscriptions and Access Codes.

Rights can be exercised by writing to iod@edustick.eu or to our postal address. We may ask the User to confirm their identity before acting on a request. We respond within one month, which may be extended by two months where justified. The User may authorise a representative to submit a request — we then require proof of authorisation. We do not discriminate against Users for exercising their rights. Information on rights related to data processing by Shopify: privacy.shopify.com.

Voluntary provision. Providing data is voluntary but necessary to conclude and perform the contract (order, subscription, Website account); without it we cannot conclude the contract. Providing data for the newsletter and consenting to analytics cookies on the Website is entirely voluntary; the User may opt out of analytics and marketing tools in the Store as described in § 9.

§ 13. Complaints

For complaints about how we process personal data, please contact us using the details in § 16. The User also has the right to lodge a complaint with a supervisory authority. In Poland, the competent authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), uodo.gov.pl. A list of supervisory authorities in the EEA is available here.

§ 14. Transfers outside the European Economic Area

  1. Some recipients listed in § 6 are established, or use sub-processors, outside the European Economic Area (EEA), mainly in the United States and Canada. Even where data is stored in the EEA (e.g. the Supabase database in Ireland, the HubSpot EU portal), the provider's technical support may access it from outside the EEA.
  2. We transfer data outside the EEA only on one of the following bases:
    • 1) a European Commission adequacy decision (Article 45 GDPR) — in particular for Canada (Shopify Inc.), for the United Kingdom and for US organisations participating in the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795);
    • 2) Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR) — for recipients not covered by point 1, or as an additional safeguard.
  3. Basis per recipient:
    • 1) Google LLC, Meta Platforms, Inc., Microsoft Corporation, Cloudflare, Inc., HubSpot, Inc., Easyship Inc. (USA) — the Commission decision on the EU-US Data Privacy Framework (for certified recipients) or Standard Contractual Clauses;
    • 2) Supabase, Inc., Netlify, Inc., GitHub, Inc. (USA) — Standard Contractual Clauses in the data processing agreements;
    • 3) Shopify Inc. (Canada) — adequacy decision for Canada; onward transfers by Shopify International Limited and Stripe Payments Europe, Limited — as set out in their privacy policies, using the mechanisms in paragraph 2;
    • 4) Ecom Parkour Limited (Hong Kong) — Standard Contractual Clauses.
  4. A copy of the Standard Contractual Clauses or information on the safeguard applied is available at iod@edustick.eu.

§ 15. Changes to This Privacy Policy

We may update this Privacy Policy, including to reflect changes in our practices or for other operational, legal or regulatory reasons. We will publish the revised Policy in the Store and on the Website at the same time, update the “Last updated” date and notify Users of material changes in accordance with applicable law.

§ 16. Contact

For matters concerning personal data protection and this Privacy Policy, please contact us:

  • Email: iod@edustick.eu
  • Postal address: EDUstick Sp. z o.o., ul. Żegańska 15, 04-713 Warsaw, Poland

EDUstick Sp. z o.o. · ul. Żegańska 15, 04-713 Warsaw, Poland

KRS 0001116158 · NIP 9522258570 · EU VAT PL9522258570 · REGON 529170439 · Share capital: PLN 50,000

Last updated: 1 October 2026. The same text is published in the Store (edustick.shop) and on the Website (edustick.eu/prywatnosc/). The Polish version of this Privacy Policy is the binding original; this English translation is provided for convenience only. References to “GDPR” mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.