Privacy Policy

This website and online shop are run by “JOLLY-HEAP” Svitlana Sapunova, Aleja Led 4, 55-⁠020 Rzeplin, Poland, NIP 8992772832, REGON 362440030, the company that makes JollyHeap blocks and sells them. It is the controller of the data the website itself collects (cookies, analytics and spam protection) and of the data you give us in an order. What you send us through a form on this website (the contact form or the distributor form) is processed jointly by both JollyHeap companies as joint controllers; see “When you leave your details in a form (joint controllers)” below.

Questions about your data: info@jollyheap.com or +48 71 880 87 27. We have not appointed a Data Protection Officer, so your message goes straight to the people who run the company.

When you place an order

Who: “JOLLY-HEAP” Svitlana Sapunova as the seller (details in section 1).

What we collect: your name, delivery address, e-mail address, phone number if you give one, the name of your company or institution and its tax or VAT number (if you buy as a business or institution), and the items, prices and currency of your order.

Why: to accept your order, arrange delivery, issue an invoice, and handle withdrawal from the contract, complaints and guarantee claims. The order goes into our order-handling system (CRM), from which we also send you the dispatch notification.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). For invoices and accounting records, compliance with a legal obligation (Art. 6(1)(c) GDPR). For defending or pursuing claims, our legitimate interest (Art. 6(1)(f) GDPR).

How long: invoices and accounting records for 5 years from the end of the calendar year in which the tax became due (Polish tax law). Order records for as long as claims can still be raised, as a rule 6 years for consumers and 3 years for business customers.

Your phone number is optional and only makes delivery smoother: the courier may need to call if they cannot find the door. We check a business’s EU VAT number against the European Commission’s VIES database to apply the correct VAT.

Payments

Card payments, Revolut Pay, Apple Pay and Google Pay are handled by Revolut. Your full card number never reaches us and we never store it. You enter it on the provider’s own secure page, and we only see whether the payment succeeded. Revolut decides for itself how it handles that data, so its own privacy notice applies alongside ours. If you pay by bank transfer, we see the details of your transfer: the sender, the account number and the reference. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).

When you use our contact form

Who: both JollyHeap companies as joint controllers; see “When you leave your details in a form” below.

What we collect: your name, e-mail address, phone number if you give one, and the message itself.

Why: to answer you and, if your question turns into an order or cooperation, to carry that conversation through.

Legal basis: our legitimate interest in replying to people who write to us (Art. 6(1)(f) GDPR); or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

How long: up to 2 years from our last contact, and longer only if the matter turns into a contract or a claim.

When you apply to become our distributor

Who: both JollyHeap companies as joint controllers; see “When you leave your details in a form” below.

What we collect: your name, e-mail address, company name, country, industry and what you tell us about your business.

Why: to assess whether we can work together and to get back to you with an offer.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and our legitimate interest in building a distribution network (Art. 6(1)(f) GDPR).

How long: up to 2 years from our last contact, and longer only if the matter turns into a contract or a claim.

Protection against spam

Our forms are protected by Cloudflare Turnstile, which checks that a form is being filled in by a person and not by a bot. For that check Cloudflare receives your IP address and basic information about your browser. Legal basis: our legitimate interest in keeping the site free of automated abuse (Art. 6(1)(f) GDPR). The provider is Cloudflare, Inc.; see the Cloudflare Privacy Policy.

When you leave your details in a form (joint controllers)

From 14 September 2026, the details you leave in a campaign form (for example jollyheap.com/numo/) or in a stand form at a trade fair or conference, and from 16 September 2026 also in the contact form or the distributor form on this website, together with the marketing consents given in those forms, are processed jointly by the two JollyHeap companies as joint controllers (Art. 26 GDPR):

• JOLLYHEAP Sp. z o.o., Aleja LED 6, 55-⁠020 Rzeplin, Poland, VAT ID PL8992792065, KRS 0000622029, distributor of JollyHeap blocks;
• “JOLLY-HEAP” Svitlana Sapunova, Aleja Led 4, 55-⁠020 Rzeplin, Poland, VAT ID PL8992772832, manufacturer of JollyHeap blocks.

What we collect: name, e-mail address, phone number, name and address of your institution or company, country, industry, job title, your message, and your consent decisions (what you ticked, when, and from which IP address).

Why and on what basis: to answer your enquiry and, for distributor applications, to assess possible cooperation (Art. 6(1)(b) and (f) GDPR) and, if you tick the consent for e-mail, phone or SMS, to send you offers and information about JollyHeap blocks through that channel (Art. 6(1)(a) GDPR). Each channel is a separate, voluntary consent; we answer your enquiry either way.

The essence of our arrangement (Art. 26(2) GDPR):

• a joint contact point for data matters: info@jollyheap.com; you may also write to either company separately;
• we fulfil the information duty jointly — through the notice at the form and this policy;
• the system in which the data is stored (CRM), its security and the handling of your requests (access, rectification, erasure, restriction, portability, objection) are run by JOLLYHEAP Sp. z o.o.; we reply within one month;
• a consent given in the form covers both companies — either may send you an offer, and every message contains an unsubscribe link;
• a withdrawal of consent, an objection or an erasure request made to one company is effective for both — the data sits in one shared database and the block applies immediately;
• you may exercise your rights against either company, regardless of which one contacted you;
• a personal data breach is notified to the supervisory authority and to you by JOLLYHEAP Sp. z o.o. on behalf of both companies.

How long: enquiries up to 2 years from our last contact, and longer only if the matter turns into a contract or a claim; marketing data until you withdraw consent; the proof of consent and of its withdrawal additionally for the limitation period for claims.

The joint controller agreement is available on request. Consents given under earlier versions of the wording, which named a single company, cover only that company. Messages sent through the contact form or the distributor form before 16 September 2026 stay with the controller named in the notice in force at the time.

We do not sell your data and we do not share it with anyone we have not named here.

• Hosting: OVH SAS (France), where this website, the shop and their database physically run, on our instructions.
• Content delivery network and site protection: Cloudflare, Inc. All traffic to the website passes through its servers, which makes the site faster and protects it against attacks. In doing so Cloudflare processes your IP address and basic information about your browser, on our instructions; the same company provides the spam protection for our forms described above.
• E-mail: Google Ireland Limited (Google Workspace), through which we send the messages from the website and the shop (form notifications, order confirmations) and correspond with you, on our instructions.
• Payment provider: Revolut, to process your payment. It acts as an independent controller of that data.
• Carriers: DPD Polska sp. z o.o. and, depending on the country, other carriers we use. They receive your name, delivery address and phone number and use them only to deliver your parcel. They too act as independent controllers.
• Accounting: our accounting office and invoicing system, for issuing and storing invoices. Invoices for business customers also go to the Polish National e-Invoicing System (KSeF), run by the Minister of Finance.
• Analytics and session recording: Google and Microsoft, only with your consent, as described in section 5.
• Public authorities: tax and other authorities, where the law requires us to hand data over.

Some of the providers listed above process data outside the EEA, mainly in the United States. This concerns Google, Microsoft and Cloudflare. Those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Write to info@jollyheap.com and we will tell you which safeguard applies to which provider.

We use cookies and similar technologies in line with Art. 399 of the Polish Electronic Communications Law. Without your consent we store on your device only what is strictly necessary for the website and the shop to work the way you expect:

• NEXT_LOCALE: a cookie with the language of the site, set only when you choose a language yourself in the language switcher; valid for one year;
• the contents of your cart and the status of your order: in your browser’s storage (localStorage and sessionStorage); they do not reach us until you place an order;
• jh_consent: a cookie with your choice in the cookie window, so that we do not ask you again on every page; valid for up to 12 months;
• technical Cloudflare cookies, which may be set to protect the site against bots and attacks.

Google Analytics and session recording in Microsoft Clarity run only if you agree to them in the cookie window. Without your consent none of these tools is loaded, and refusing changes nothing about your ability to read the site and shop. You can change your choice at any time in the cookie settings, linked in the footer of every page.

Google Analytics 4 and Google Tag Manager

With your consent we use Google Analytics 4, loaded through Google Tag Manager, to understand how people find and read our pages so we can improve them. It collects the pages you view, events such as submitting a form or clicking our phone number, your approximate location, device and browser type, and where you came from. Google Analytics 4 does not log or store IP addresses. We keep this data for 14 months, after which it is deleted automatically. Google Tag Manager itself sets no cookies; it only loads the tools named in this policy. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as an independent controller. You can also install the Google Analytics Opt-out Browser Add-on.

Microsoft Clarity: session recording

With your consent we use Microsoft Clarity to see how our pages actually behave: it records interactions (mouse movements, clicks, scrolling and navigation) and replays them as anonymised recordings and heatmaps, which we use to find and fix usability problems. Anything you type into a form field is masked and never transmitted. Recordings are kept for 30 days, and a small sample for up to 9 months.

Microsoft is not acting on our instructions here: under the Microsoft Clarity terms, Microsoft and we are independent controllers, and Microsoft may use this data for its own purposes, including improving its products and advertising. See the Microsoft Privacy Statement.

Legal basis for both tools: your consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law). You can withdraw it at any time in the cookie settings, without affecting what was processed before.

Our own site and shop statistics

Apart from these tools, we ourselves count how people use the site and the shop: which pages and products they view, which colourways they choose, what they add to and remove from the cart, whether they go to the checkout and whether they place an order. Along with this, we record the page address (without parameters), its language, the country (determined by Cloudflare from the IP address) and the type of device (phone, tablet or computer), and on the first page of a visit also the domain of the site that referred you to us and the campaign tag from the link (utm parameters). We do not store the IP address or browser information (User-Agent). The data goes only to our server and to our order-handling system (CRM), without any external analytics tools, and we keep it for 13 months.

Without your consent to analytics, events are anonymous: they carry no identifier and we store nothing on your device. If you agree to analytics in the cookie window, we store two random identifiers in your browser’s storage (not in cookies):

• jh_vid: a browser identifier (localStorage) that links your successive visits; after 13 months we replace it with a new one;
• jh_sid: a visit identifier (sessionStorage); after 30 minutes of inactivity we replace it with a new one.

They let us see the path through the shop as a whole, for example at which step people give up on a purchase, and if you place an order, we link the identifier to that order so that we know which path led to it. If you withdraw your consent, both identifiers are deleted from your browser straight away and further events are anonymous again. Legal basis: your consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law).

We do not profile you and we do not take decisions about you based solely on automated processing. Analytics tells us how many people read a page, but it does not build a profile of you as an individual for us. Our payment provider may automatically decline a card transaction on the basis of its own fraud checks. In that case you can contact the provider and ask for a human review.

• Invoices and accounting records: 5 years from the end of the calendar year in which the tax became due.
• Order records: until claims can no longer be raised (as a rule 6 years for consumers, 3 years for business customers).
• Messages from the contact form and distributor applications: up to 2 years from our last contact.
• Anything that became a contract or a claim: until the limitation period expires.
• Analytics data (Google Analytics 4): 14 months.
• Session recordings (Microsoft Clarity): 30 days, a small sample up to 9 months.
• Our own site and shop statistics: 13 months.
• Marketing data from campaign and stand forms: until you withdraw consent.
• Proof of consent and of its withdrawal: 6 years from the end of the year in which consent was withdrawn.

You can read every page without giving us anything. Your name, delivery address and e-mail address are necessary to conclude and perform the sale (without them we cannot process your order); a tax or VAT number is needed only for a business invoice, and your phone number is optional. If you write to us through a form, we need at least your e-mail address and your message. In our forms, mandatory fields are marked; everything unmarked is voluntary.

The site runs over an encrypted HTTPS connection. Access to the server and to the system in which we keep enquiries and orders is limited to the people who need it, each with their own account. Card details are handled by our payment provider, and we never see or store them. Forms and checkout are protected against automated abuse.

We make toys, but we address our website to grown-ups: parents, teachers, therapists and business partners. We do not knowingly collect personal information from children and we never use children’s data for advertising. If you are a parent or guardian and believe a child has sent us their details, write to info@jollyheap.com and we will delete them.

Our shop is intended for customers aged 18 and over.

You can ask us for a copy of the data we hold about you, ask us to correct it, delete it, restrict what we do with it, or send it to another company. Where we rely on your consent, you can withdraw it at any time in the cookie settings. Withdrawing is as easy as giving it, and it does not make what we did before unlawful. All of this is free, and we answer within one month. Just write to info@jollyheap.com.

You can object to direct marketing at any time. You have the right to object at any time to us processing your personal data for direct marketing. If you object, we stop immediately and you do not have to give a reason.

Where we rely on legitimate interest (Art. 6(1)(f) GDPR), namely answering your messages, protecting the site from abuse, and establishing or defending legal claims, you can also object on grounds relating to your particular situation.

Please tell us first: write to info@jollyheap.com and we will try to put it right. You also have the right to complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-⁠193 Warsaw, Poland, or to the supervisory authority of the EU country where you live, where you work, or where you think the problem happened.

If we start using your data for a purpose that is not described here, we will tell you about it before we start. We update this page whenever the site changes (for example when we add a new tool), and the date at the top always shows the current version.

This policy is available in all the languages of the website. You can switch the language with the language switcher at the top of the page. In case of any discrepancy, the Polish version prevails.