Skip to content
Free delivery in Poland on orders from 1000 PLN.Ships within 24 hours.14-day returns on in-stock products.
0
Information

Privacy Policy

This is a convenience translation. The Polish version of the Privacy Policy is binding.

Privacy Policy of the SHEZAMME online store

Last updated: 4 November 2026

Hello! In this document we describe, in one place, how we process your personal data and how we use cookies and other tracking technologies in connection with the operation of the SHEZAMME online store available at https://shezamme.com (in all language versions).

Formal information first: the controller of your personal data is KOLEKT5 sp. z o.o., ul. Zielona 34b, 44-341 Skrbeńsko, Tax ID (NIP) 7292756919, KRS 0001112313.

We have written this policy in a question-and-answer format to make it easier to find the information you need. If you have any questions about privacy, write to us at support@shezamme.com.

You have the right to object to the processing of your data on the basis of our legitimate interest, including, at any time, to direct marketing – see section 11 for details.

1. Who is the controller of your personal data?

The controller of your personal data is KOLEKT5 spółka z ograniczoną odpowiedzialnością with its registered office in Skrbeńsko, ul. Zielona 34b, 44-341 Skrbeńsko, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001112313, Tax ID (NIP) 7292756919, REGON 528956304, which operates the SHEZAMME online store (hereinafter: “we”).

2. How can you contact us about personal data?

We have not appointed a data protection officer, as this is not mandatory in our case. In matters relating to personal data and privacy, you can write to us at the email address support@shezamme.com or by post to: KOLEKT5 sp. z o.o., ul. Zielona 34b, 44-341 Skrbeńsko.

3. What data about you do we process?

Depending on the purpose, we may process the following data:

  • first name and surname,
  • delivery address and billing address,
  • company name and Tax ID (NIP) (if you provide them, e.g. for an invoice),
  • email address,
  • phone number,
  • order details (products ordered, prices, delivery and payment method, order status),
  • payment information (payment method and status; we do not receive the full number of your payment card),
  • when paying with the USDC stablecoin – the address of the cryptocurrency wallet you pay from and the transaction ID,
  • bank account number (if we refund your money by bank transfer),
  • data contained in correspondence, complaints and statements of withdrawal from the contract,
  • IP address and information about your device and browser,
  • information about how you use the store and cookie identifiers (to the extent described in sections 12–20),
  • information about your consent to the newsletter and about how you respond to our messages (e.g. opening a message, clicking a link),
  • if you receive a gift card from someone – your email address and (if the buyer provides them) your first name and the gift message.

We describe the scope of the data processed for each purpose in section 6.

4. Where do we get your personal data from?

Most often, you provide it to us directly when you:

  • create an account or log in to it,
  • place an order,
  • file a complaint or withdraw from the contract,
  • subscribe to the newsletter,
  • contact us.

In June 2026, we moved the store from its previous platform (WooCommerce) to the Shopify platform. If your account or orders come from the previous version of the store, we have transferred your customer data and order history to the current platform (details in section 6).

Some information is collected automatically by the tools we use or is provided to us by other entities:

  • the store platform (Shopify) records, among other things, your IP address, e.g. when you place an order,
  • analytics and marketing tools collect information about your activity in the store – as a rule, after you have given your consent, with the exceptions described in sections 13 and 16,
  • payment operators provide us with information about the payment status,
  • if you place an order via an external platform (e.g. an AI assistant), the data needed to fulfil the order is provided to us by the operator of that platform via Shopify,
  • if you receive a gift card as a present, your email address is provided to us by the person who bought it,
  • carriers provide us with information about the shipment status.

5. Is your data secure?

We take care of the security of your data. We have analysed the risks associated with the individual processing operations and implemented appropriate security measures. Only authorised persons, entities with which we have concluded appropriate agreements and the recipients indicated in section 8 have access to the data. We review the solutions we use on an ongoing basis and improve them where necessary.

6. For what purposes and on what basis do we process your data?

Below you will find the purposes of processing together with their legal bases (the General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 of the European Parliament and of the Council):

  • creating and maintaining an account – Art. 6(1)(b) GDPR,
  • fulfilling orders, including delivery and in-store pickup – Art. 6(1)(b) GDPR,
  • handling payments – Art. 6(1)(b) GDPR,
  • preventing fraud and abuse in orders and payments (risk analysis) – Art. 6(1)(f) GDPR,
  • handling complaints and withdrawals from the contract – Art. 6(1)(c) GDPR (obligations arising from consumer rights legislation) and Art. 6(1)(f) GDPR,
  • handling gift cards – Art. 6(1)(b) GDPR, and delivering the card to the gift recipient – Art. 6(1)(f) GDPR,
  • sending the newsletter – Art. 6(1)(a) GDPR (consent),
  • reminders about incomplete orders – Art. 6(1)(f) GDPR, only for persons who have agreed to receive commercial information,
  • handling correspondence – Art. 6(1)(f) GDPR,
  • fulfilling tax and accounting obligations – Art. 6(1)(c) GDPR,
  • analytics and statistics (Google Analytics 4, Shopify statistics, Microsoft Clarity) – Art. 6(1)(a) GDPR (consent), with the exceptions described in sections 13 and 16,
  • marketing in external services (Google Ads, Meta, TikTok, Shopify marketing cookies) – Art. 6(1)(a) GDPR (consent),
  • measuring the store's performance on the basis of the limited information that the Google tag sends before you give your consent, and analytics and marketing in relation to visitors to the store from countries in which we do not display the cookie banner – Art. 6(1)(f) GDPR (section 13),
  • the Google Customer Reviews survey after an order is placed – Art. 6(1)(a) GDPR (consent),
  • protecting forms against spam and bots – Art. 6(1)(f) GDPR,
  • transferring customer data and order history from the previous version of the store to the Shopify platform – Art. 6(1)(f) GDPR (continuity in handling accounts, orders, returns and complaints),
  • establishing, pursuing and defending claims (archive) – Art. 6(1)(f) GDPR.

Where the basis is our legitimate interest (Art. 6(1)(f) GDPR), that interest is the purpose indicated for the given item, in particular efficient customer service, the security of the store and of payments, promoting our offer and protection against claims.

Providing data is voluntary, but without the data needed for an order we cannot conclude or perform the contract, and without an email address we cannot create an account or send the newsletter. Providing data for an invoice is an obligation arising from tax legislation if you wish to receive one. Giving consent (newsletter, cookies, Google survey) is voluntary and does not affect your ability to make purchases.

Account – details

Creating an account is voluntary. You can also shop without an account. You log in to your account with your email address and a one-time code that we send to that address – you do not set a password. Providing an email address is necessary to create an account. In your account settings, you can add further data (first name, surname, addresses, phone number) and change it at any time.

If your account was created in the previous version of the store, we have transferred your customer data and order history to the current store. Passwords have not been transferred: to log in, enter the email address you have used so far and you will receive a one-time code.

We store account data for as long as the account exists. You can delete your account at any time by writing to support@shezamme.com. We also store data on orders placed from the account after it has been deleted – under the rules described in section 7.

Orders – details

When placing an order, you provide the data necessary to fulfil it: first name and surname, delivery address, email address and phone number (and, if you wish to receive a company invoice, also the company name and Tax ID (NIP)). Without this data we cannot accept or fulfil the order. The Shopify platform records the IP address from which you place the order, among other things for the purpose of fraud risk analysis (Art. 6(1)(f) GDPR). We record each order together with information about the products ordered, the payment method and the delivery method.

If you choose in-store pickup at the SneakersJoint Partner Store (ul. Odrzańska 15, Wrocław), the data needed to hand over the order (first name and surname, order number) is available to the staff who hand over orders in that store. The SneakersJoint store is also operated by KOLEKT5 sp. z o.o., so your data is not passed on to another entity in this way.

If you order with delivery outside the European Union, the shipment data (including the recipient's details and the contents of the shipment) is passed on to the carrier and to the customs authorities of the destination country to the extent needed for customs clearance.

If you choose delivery to a parcel locker, our parcel locker service determines the approximate location of the delivery address in order to show you the nearest parcel lockers. To do this, it sends the street, a range of building numbers (e.g. 10–19), the postcode and the town – without your name or contact details – to the public address service of the Polish Head Office of Geodesy and Cartography (GUGiK) and, if that service does not know the address, to the OpenStreetMap Nominatim service (OpenStreetMap Foundation, United Kingdom). It retrieves the list of parcel lockers from InPost using only the coordinates or the postcode. We keep the location determined in this way in a cache for up to 30 days. Legal basis: Art. 6(1)(b) GDPR.

We process order data in order to perform the contract (Art. 6(1)(b) GDPR), to issue invoices and keep accounts (Art. 6(1)(c) GDPR) and for archiving purposes (Art. 6(1)(f) GDPR).

Orders via external platforms – details

Our products may be presented in the services of external platforms, e.g. in the Shop app, on Google, Facebook, Instagram and TikTok, and by AI assistants (e.g. ChatGPT, Microsoft Copilot, Meta AI). When you use such a service, its operator processes your data as a separate controller, in accordance with its own privacy policy. If you place an order with us via such a platform, we receive from it (via Shopify) the data necessary to fulfil the order – first name and surname, delivery address, email address, phone number, the products ordered and payment information – and we process it in the same way as the data of orders placed in the store (sections 6–11).

Payments – details

Payments are handled by Shopify Payments – a service of Shopify International Limited (Dublin, Ireland). Depending on the country and the order, you can pay by payment card, BLIK, Apple Pay, Google Pay, Przelewy24, via Klarna, with the USDC stablecoin and, for delivery within Poland, also on delivery (cash on delivery) – in that case you pay the carrier (InPost or DPD), and any refund is sent by bank transfer to the bank account you indicate. With regard to payment data, we are the controller and Shopify processes it on our behalf. Payments are processed and settled by the payment operators used by Shopify; their current list is available at https://www.shopify.com/legal/processor-list. Each operator may also process your data as a separate controller in connection with its own legal obligations (e.g. anti-money laundering, sanctions) – in accordance with its own privacy notice. If you pay via Apple Pay or Google Pay, you also use the services of Apple or Google under the terms set by those providers. Legal basis for processing: Art. 6(1)(b) GDPR.

If you choose Przelewy24, you will be redirected to the Przelewy24 website, which is operated by PayPro S.A. (ul. Pastelowa 8, 60-198 Poznań). PayPro processes the data needed to carry out the payment in accordance with its own privacy notice: https://www.przelewy24.pl/obowiazek-informacyjny-rodo-platnicy.

If you choose Klarna payment, you will be redirected to the Klarna website. Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden) is a separate controller of the data it receives in connection with the payment (including information about the order). Klarna decides independently which payment options to offer you (e.g. pay now, pay later, pay in instalments), and the financing terms depend, among other things, on your creditworthiness. Contact regarding personal data at Klarna: odo@klarna.pl. Klarna's privacy notice: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/en_gb/privacy.

USDC is a so-called stablecoin, i.e. a cryptocurrency whose value is pegged to the US dollar. USDC payment is available as part of Shopify Payments and is handled with the involvement of Stripe and Coinbase (they are on the list of Shopify payment operators given above). You pay from your own cryptocurrency wallet; its provider processes your data as a separate controller, in accordance with its own privacy policy. The transaction is recorded in a public blockchain ledger: the wallet address, the amount and the time of the transaction are publicly visible and, for technical reasons, cannot be deleted or changed. Anyone who knows your wallet address can see its transaction history. If we receive your wallet address and transaction ID, they are linked to the order in the same way as other payment data, and we do not publish them.

Complaints and withdrawals from the contract – details

When you file a complaint or withdraw from the contract, you provide us with the data needed to deal with the matter (e.g. first name and surname, address, email, phone number, order number, description of the problem, bank account number for the refund). We use it to fulfil the obligations arising from consumer rights legislation (Art. 6(1)(c) GDPR), to deal with your matter efficiently and – once it has been concluded – for archiving purposes, including to establish, pursue or defend claims (Art. 6(1)(f) GDPR).

Gift cards – details

When buying a gift card, you provide the data needed for the purchase (as with any order). We send the card code by email. We store information about the card (code, balance, usage history) until the balance has been used up, and then for the period required by tax legislation and until the limitation period for claims expires (Art. 6(1)(b), (c) and (f) GDPR).

If you send the card as a gift, you provide us with the gift recipient's email address and, if you wish, also their first name and a gift message. If you receive a card as a gift, your data was provided to us by the person who bought the card. We use it solely to send you the card on the specified day and to handle its use (Art. 6(1)(f) GDPR – our interest and the buyer's interest in delivering the gift). We store it in the same way as the information about the card. We describe your rights, including the right to object, in section 11.

Newsletter – details

You can subscribe to the newsletter at checkout by ticking the box consenting to receive emails about new arrivals and offers (and, if the store provides such a form, elsewhere in the store as well). Subscribing is voluntary and has no effect on your order. In that case, we process your email address and information about your consent, which is recorded in your customer profile in the store. Part of the newsletter is measuring whether a message has been opened and whether the links in it have been clicked (using a pixel in the message and link redirection) – on this basis we assess which content interests you. If you were subscribed to the newsletter in the previous version of the store, we have also transferred this information.

The legal basis for processing is your consent (Art. 6(1)(a) GDPR). We store the data until you withdraw it. You can unsubscribe from the newsletter at any time – by clicking the link in the footer of any message or by writing to support@shezamme.com.

Reminders about incomplete orders – details

If you start placing an order at checkout and do not complete it, we may send you an email reminding you of the products you left behind. We send such messages only to persons who have agreed to receive commercial information from us by electronic means (in accordance with the Polish Electronic Communications Law). The legal basis for processing is our legitimate interest, i.e. promoting our products among persons who have started shopping (Art. 6(1)(f) GDPR). You can object or withdraw your consent to commercial information at any time – we will then stop sending such messages.

Correspondence – details

When you contact us (by email, by phone, via the contact form or on social media), you provide the data contained in your message. We process it in order to reply and to communicate with you (Art. 6(1)(f) GDPR) and, if the message concerns an order, also to perform the contract (Art. 6(1)(b) GDPR).

Tax and accounting obligations – details

We store invoices and other accounting records for the period required by law (Art. 6(1)(c) GDPR).

Google Customer Reviews – details

After you place an order, we may invite you on the confirmation page to take part in the Google Customer Reviews survey. If you agree (by selecting “Yes”), Google Ireland Limited will use your email address, order number, delivery country and estimated delivery date to send you an email asking you to rate your purchase in our store. Google processes this data as a separate controller, in accordance with its own privacy policy (https://policies.google.com/privacy). Legal basis: your consent (Art. 6(1)(a) GDPR). Participation is voluntary and has no effect on your order.

7. How long do we store your data?

After the periods below have expired, we delete or anonymise the data. Limitation periods for claims range from 2 to 6 years, depending on the type of claim (the Polish Civil Code).

  • account data – for as long as the account exists,
  • order data, including the IP address recorded with the order – until the limitation period for claims relating to the order expires and, to the extent required by tax legislation, for the period specified in that legislation,
  • accounting records, including invoices – for the period required by tax and accounting legislation, as a rule for 5 years from the end of the calendar year in which the tax payment deadline passed,
  • data from complaints and withdrawals from the contract – until the limitation period for contractual claims expires,
  • correspondence – until the matter has been dealt with, and then until the limitation period for any related claims expires,
  • data processed on the basis of consent (e.g. newsletter, Google survey) – until consent is withdrawn, and the data needed to demonstrate that consent was given – until the limitation period for any claims expires,
  • data used for reminders about incomplete orders – until you withdraw your consent to commercial information or object,
  • data analysed as part of form protection (hCaptcha) – for the time needed to distinguish humans from bots and to detect abuse, in accordance with the service provider's privacy policy,
  • the location of the address determined when selecting a parcel locker – for up to 30 days,
  • activity data collected in Google Analytics 4 – no longer than 14 months from collection,
  • Microsoft Clarity session recordings – for 30 days from recording; recordings flagged by us and a small random sample of recordings – up to 13 months,
  • data in the previous version of the store and in its backups – until it is deleted after the transfer to the Shopify platform has been completed.

We state cookie lifetimes in section 16 (the “List of cookies” part).

8. Who are the recipients of your data?

We use the services of entities that process data on our behalf:

  • Shopify International Limited (The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland) – store platform: hosting, cart and checkout, customer accounts, storage of customer and order data (including data transferred from the previous version of the store), payment handling (Shopify Payments), order-related emails, the cookie consent banner, protection of forms against spam,
  • Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) – servers for our service that finds the nearest InPost parcel lockers at checkout, calculates the delivery cost and saves the selected parcel locker in the order (for this purpose it receives the delivery address and order data),
  • the provider of the order management and shipping system,
  • payment operators used by Shopify as part of Shopify Payments (the “Payments – details” part),
  • providers of apps running in the Shopify store that support its operation (e.g. shipping, pre-orders, translations, automations) – to the extent needed for the given app to function,
  • the provider of the newsletter system,
  • IT, hosting and email service providers,
  • the provider of the invoicing system and the accounting firm,
  • the provider of the server on which the previous version of the store runs – until the data has been deleted from it,
  • entities providing us with technical services and other subcontractors.

We also use analytics and marketing tools and external services:

  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – the Google tag from the Google & YouTube app (Google Analytics 4, Google Merchant Center and – if the tag is linked to an advertising account – Google Ads), Google Customer Reviews. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA,
  • Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) – the Meta pixel and Meta Conversions API (Facebook & Instagram app). Parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA,
  • TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) jointly with TikTok Information Technologies UK Limited – the TikTok pixel (TikTok app),
  • Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) – Microsoft Clarity (statistics, heatmaps and session recordings). Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA,
  • Intuition Machines, Inc. (1065 SW 8th St #704, Miami, FL 33130, USA) – hCaptcha, protection of forms against spam, used by the Shopify platform.

To a certain extent, Shopify processes data as a separate controller: as part of Shopify services based on data from multiple stores (e.g. fraud protection, Shopify Network Intelligence) and with regard to data that Shopify receives as part of your direct relationship with Shopify (e.g. the Shop app, Shop Pay, logging in with Shop). Shopify may also use information about your visit and purchases for services based on your interactions with other merchants using Shopify and with Shopify itself; for this purpose, this information may be shared with Shopify and other entities, including in other countries. We ask for your consent in the cookie banner for advertising based on your activity in our store, with other merchants and on Shopify – you can withdraw it at any time. Details: Shopify Consumer Privacy Policy – https://www.shopify.com/legal/privacy/consumers, Shopify privacy portal (where you can also withdraw your consent or object to processing by Shopify) – https://privacy.shopify.com. Contact with Shopify's data protection officer for individuals in the EEA: Shopify International Ltd., Attn: Data Protection Officer, c/o Intertrust Ireland, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.

We share your data with courier companies and operators of pickup points and parcel lockers (e.g. InPost, DPD) to the extent necessary to deliver the order and, for cash on delivery payments, also with regard to the amount to be collected. Carriers are separate controllers of your data. The following are also separate controllers: Klarna Bank AB (publ) – if you choose Klarna payment; Google – with regard to the Google Customer Reviews survey, if you agree to it; the operators of external platforms through which you place an order; and customs authorities – for shipments outside the European Union. We may also transfer data to tax authorities to the extent necessary to fulfil tax obligations and, where necessary, to entities authorised by law (e.g. courts, public prosecutors, the police).

9. Do we transfer your data outside the European Economic Area?

Yes. Some processing operations may involve transferring data to third countries, in particular to the USA and Canada and, for deliveries outside the European Economic Area, also to the destination country of the shipment. This concerns the Shopify platform (together with its subprocessors), the Cloudflare servers on which our parcel locker service runs, and the Google, Meta, TikTok, Microsoft and hCaptcha tools and, for USDC payments, also Stripe and Coinbase.

Data is transferred outside the European Economic Area on the basis of:

  • standard contractual clauses approved by the European Commission (Decision 2021/914),
  • a decision of the European Commission finding an adequate level of data protection – in particular the EU-US Data Privacy Framework (with regard to certified entities, e.g. Google LLC, Meta Platforms, Inc., Microsoft Corporation) and the decision concerning Canada,
  • in the case of Shopify – also Shopify's binding corporate rules (for transfers between Shopify companies),
  • for delivery to a country outside the EEA – the transfer of shipment data to the carrier and to the customs authorities of the destination country is necessary for the performance of the contract concluded with you (Art. 49(1)(b) GDPR); for the United Kingdom, Switzerland and Canada, decisions of the European Commission finding an adequate level of data protection also apply.

You can check the current certification status under the Data Privacy Framework programme at https://www.dataprivacyframework.gov/list. You can obtain a copy of the safeguards applied to data transfers (e.g. the standard contractual clauses) by writing to support@shezamme.com.

The data of customers from the EEA is primarily processed by Shopify International Limited (Ireland); however, Shopify may process data in any country in which Shopify, its affiliates or its providers operate, including Canada, the USA and Singapore. List of Shopify subprocessors: https://help.shopify.com/en/manual/privacy-and-security/privacy/subprocessors.

10. Do we make automated decisions and carry out profiling?

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. The Shopify platform and payment operators automatically assess the risk of fraud in orders and payments. A payment operator may automatically reject a payment deemed risky – you can then choose another payment method or contact us, and we will look into the matter.

Once you have given your consent, we use tools that show you ads tailored to your previous actions in our store (behavioural advertising). They may use, among other things, information about your browser and system, the pages and products viewed, the time spent in the store, the source of your visit, your approximate location and interests determined on the basis of your online activity. More about behavioural advertising: https://www.youronlinechoices.com.

11. What rights do you have?

You have the right:

  • of access to your data and to receive a copy of it,
  • to rectification of your data,
  • to erasure of your data,
  • to restriction of processing,
  • to data portability (where we process your data by automated means on the basis of consent or a contract),
  • to object to processing,
  • to withdraw your consent at any time – without affecting the lawfulness of processing carried out before its withdrawal,
  • to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl/en) or with the supervisory authority in the country of your habitual residence or place of work.

Right to object. You can object at any time to the processing of your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) on grounds relating to your particular situation. You can object to processing for direct marketing purposes at any time, without giving any reason – we will then stop processing your data for that purpose.

To exercise your rights, write to support@shezamme.com or by post to our registered office address. We will respond without undue delay and in any event within one month.

If you live in a US state whose laws give you the right to opt out of the “sale” or “sharing” of personal data for advertising purposes, you can exercise this right on the Your privacy choices page.

12. Do we use cookies?

Yes. Cookies are small pieces of text information stored on your device. Some are deleted when you close your browser (session cookies), while others remain for a specified period (persistent cookies). In this policy, we also use the term “cookies” for similar technologies: pixels (pieces of code that record events in the store, e.g. a product view or a purchase, and pass them on to the tool provider) and the browser's local storage.

13. On what basis do we use cookies?

We use cookies that are not necessary for the store to function on the basis of your consent, with the exceptions described in this section and in section 16. We use necessary cookies (e.g. cart, checkout, login, security) without consent, because without them we could not provide the service you request.

We collect consent using the cookie banner built into the Shopify platform. We display it to visitors from European Union countries, Norway and the United Kingdom. In these countries, cookies other than necessary ones remain blocked until you give your consent – with the exception of the limited information sent by the Google tag (described below), the Microsoft Clarity app pixel (section 16) and the browser storage entries described in section 15. Your decision applies to the pixels of the tools running in the store and at checkout (Google, Meta, TikTok, Shopify), and we pass it on to Google via the Google & YouTube app as part of the Google Consent Mode v2 mechanism. We load the Microsoft Clarity script on the store pages only after you have consented to analytics cookies (we describe the exception concerning the Clarity app pixel in section 16).

The Google tag from the Google & YouTube app loads on every visit. Without your consent, it does not store cookies, but it may send Google limited information about events (e.g. a page or product view, a purchase) without cookie identifiers. If you do not give your consent, Google does not use such information originating from individuals in the European Economic Area for personalised advertising. We process this limited information in our legitimate interest, i.e. to measure the performance of the store and the effectiveness of our offer in Google services (Art. 6(1)(f) GDPR). You can object (section 11).

If you visit the store from a country in which the banner is not displayed, Shopify's default settings for your region apply: analytics and marketing tools (including Microsoft Clarity) then operate without asking separately for consent. We process the data collected in this way in our legitimate interest, i.e. to analyse the store's performance and to promote our offer (Art. 6(1)(f) GDPR). You can object (section 11) or block these cookies in your browser (section 14).

14. How can you manage cookies and withdraw your consent?

You can change your cookie decision or withdraw your consent at any time using the “Cookie preferences” link in the store footer. It opens a consent settings panel in which you can enable or disable individual categories (preferences, analytics, marketing). Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before the withdrawal.

You can also manage cookies in your browser settings: block all or selected cookies (e.g. third-party cookies), delete stored cookies or use private (incognito) mode. If you block necessary cookies, parts of the store (e.g. the cart and checkout) may not work properly. After you delete cookies, the banner will ask for your consent again.

15. What are first-party cookies and browser storage used for?

First-party cookies in our store are set by the Shopify platform. They are used for the proper functioning of the store, including maintaining the session and login, handling the cart and checkout, security, and remembering the selected country and currency and your cookie decision. When you select a language in the language switcher, the app that translates the store (Translation Lab) saves your choice in a cookie and in browser storage.

In the browser's local storage (localStorage and sessionStorage), we also save information needed for the features you use: your list of favourite products, the selected size system, the automatically selected country (recognised by the Shopify platform on the basis of your IP address) and a temporary copy of the store menu (so that it loads faster). We also remember your list of recently viewed products and your recent searches so that we can display them again for your convenience. These entries remain on your device – we do not send them to ourselves or to third parties. You can delete them at any time by clearing the site data in your browser.

16. Which third-party tools do we use?

The following third-party tools operate in the store (some of them store cookies in the store's domain and some in their providers' domains):

  • Google Analytics 4, Google Merchant Center and Google Ads (Google & YouTube app),
  • Meta pixel and Meta Conversions API (Facebook & Instagram app),
  • TikTok pixel (TikTok app),
  • Shopify – Shopify statistics and marketing cookies, cookie banner, Shop Pay,
  • Microsoft Clarity,
  • hCaptcha (form protection, activated by the Shopify platform).

Google Analytics 4, Google Merchant Center and Google Ads – details

The Google tag runs in the store via the Google & YouTube app in Shopify (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA). With your consent (Art. 6(1)(a) GDPR), Google Analytics 4 collects information about how you use the store: pages viewed, visit duration, e-commerce events (product view, adding to cart, purchase), the source of your visit (channel, campaign), technical data about your browser and device, and your approximate location. According to Google, Google Analytics 4 does not log or store IP addresses. With regard to Google Analytics, Google acts as a processor on our behalf. Without your consent, the Google tag may only send the limited information described in section 13.

The Google tag also measures the performance of our products presented in Google services (Google Merchant Center) and, if it is linked to an advertising account, also conversions and remarketing in Google Ads. Once you have consented to marketing cookies, Google may store cookies that allow our ads to be shown to you in Google services depending on your actions in the store, and may receive order data, e.g. your email address and phone number, in the form of a hash, which Google compares with its users' data in order to attribute the purchase to an ad (enhanced conversions). With regard to Google Ads and Merchant Center, Google acts as a separate controller.

Google Privacy Policy: https://policies.google.com/privacy. Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout. Google ad settings: https://myadcenter.google.com.

Meta pixel and Meta Conversions API – details

We use advertising tools of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company: Meta Platforms, Inc., USA), activated through the Facebook & Instagram app in Shopify, on the basis of your consent (Art. 6(1)(a) GDPR). Two measurement methods are used:

  • the Meta pixel (in the browser) – sends Meta information about activity in the store (product view, adding to cart, proceeding to checkout, purchase),
  • Meta Conversions API (server-side) – Shopify sends Meta order data on our behalf (e.g. email, phone number, first name and surname) in the form of a hash, which Meta compares with its users' data in order to attribute the event to an account.

Events sent by both methods are not counted twice. Meta may combine this information with data from your Facebook or Instagram account and use it for its own purposes. When collecting data about events in our store and transmitting it to Meta, we are joint controllers with Meta Platforms Ireland Limited (Art. 26 GDPR); we are responsible for obtaining your consent and informing you about this processing. You can find the essence of the arrangement with Meta at https://www.facebook.com/legal/controller_addendum. Meta carries out further processing as a separate controller; with regard to that processing, you can exercise your rights under Art. 15–21 GDPR directly against Meta. Meta Privacy Policy: https://www.facebook.com/privacy/policy. Meta ad settings: https://www.facebook.com/ads/preferences.

TikTok pixel – details

We use the TikTok pixel provided by TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland), activated through the TikTok app in Shopify, on the basis of your consent (Art. 6(1)(a) GDPR). The pixel collects data about activity in the store (product view, adding to cart, proceeding to checkout, purchase) in order to measure the effectiveness of TikTok advertising campaigns and for remarketing; the app may also send these events to TikTok server-side. When collecting this data and transmitting it to TikTok, we are joint controllers with TikTok Technology Limited (Art. 26 GDPR); we are responsible for obtaining your consent and informing you about this processing. Further processing is carried out by TikTok (TikTok Technology Limited jointly with TikTok Information Technologies UK Limited) as a controller, in accordance with its own privacy policy. We will make the essence of the arrangement with TikTok available to you upon request sent to support@shezamme.com. TikTok Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

Shopify – details

The store runs on the Shopify platform (Shopify International Limited, Ireland). Shopify sets cookies in the store that are necessary for it to function and, once you have given your consent, also analytics cookies (_shopify_analytics) and marketing cookies (_shopify_marketing) with data from the store and checkout pages. We also send order-related messages via Shopify (Art. 6(1)(b) GDPR). If you use Shop Pay or log in with Shop, Shopify may recognise you in our store and at checkout under the terms of the Shop service (in that case Shopify acts as a separate controller). Shopify cookies: https://www.shopify.com/legal/cookies.

The Shopify cookie banner may be displayed in the store, in the cart, at checkout and on customer account pages. In it, you can accept all categories, reject cookies other than necessary ones or select individual categories. Your decision is automatically passed on to Shopify's consent mechanism (Customer Privacy API) and applies to the pixels running in the store and at checkout.

Microsoft Clarity – details

We use Microsoft Clarity, a tool of Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; parent company: Microsoft Corporation, USA). Clarity creates aggregate statistics and heatmaps (e.g. where you click and how far you scroll down pages) as well as session recordings, i.e. a replay of your actions on the pages (cursor movements, clicks, scrolling). This helps us improve the functioning and appearance of the store.

We load the Clarity script on the store pages only after you have consented to analytics cookies (Art. 6(1)(a) GDPR), and we also pass on to it your decision on marketing cookies. Clarity then stores cookies that allow subsequent page views and visits to be recognised.

In addition, the Microsoft Clarity app pixel for Shopify runs in the store. It is activated regardless of your decision in the banner: on the store pages, it sends Clarity information about shopping events (product view, search, adding to and removing from the cart, starting and placing an order), and at checkout it records the course of your visit (session recording) – even if you do not give your consent; without consent, it records without Clarity cookies. We process data from the pixel in our legitimate interest, i.e. to analyse and improve the functioning of the store and checkout (Art. 6(1)(f) GDPR). You can object (section 11).

Microsoft also processes the data collected by Clarity as a controller, in accordance with the Microsoft Privacy Statement: https://www.microsoft.com/privacy/privacystatement. We state the retention period for recordings in section 7. Data may be transferred to the USA (section 9).

hCaptcha – details

To protect the store's forms (e.g. the contact form) against spam and abuse, the Shopify platform uses the hCaptcha service provided by Intuition Machines, Inc. (1065 SW 8th St #704, Miami, FL 33130, USA). hCaptcha analyses how the form is used (including cursor movements, keystrokes, IP address and browser data) in order to distinguish humans from bots, and may store cookies. Legal basis: Art. 6(1)(f) GDPR (protection against bots and abuse). Data may be transferred to the USA. hCaptcha Privacy Policy: https://www.hcaptcha.com/privacy.

List of cookies

Below we list the most important cookies that may be stored in the store (name – provider – purpose – lifetime). We give the names and lifetimes based on the providers' information as at the date this policy was updated; providers may change them.

Necessary (without consent):

  • _shopify_essential – Shopify – session and checkout data, protection against tampering – 1 year,
  • cart, cart_currency – Shopify – cart contents and currency – 2 weeks,
  • localization – Shopify – selected country – 1 year,
  • discount_code – Shopify – discount code from a link – session,
  • _shopify_test – Shopify – checking cookie support – 1 minute,
  • Shop login cookies (e.g. __Host-Http-shop_binding) – Shopify – linking the login to the session – up to 3 hours,
  • translation-lab-lang – the app that translates the store (Translation Lab) – remembering the selected language – 1 year.

Analytics (with consent, with the exceptions set out in section 13):

  • _shopify_analytics – Shopify – statistics from the store and checkout pages – 1 year,
  • _ga, _ga_<identifier> – Google (Google Analytics 4) – distinguishing users and session state – 2 years,
  • _clck – Microsoft (Clarity) – Clarity user identifier – 1 year,
  • _clsk – Microsoft (Clarity) – combining page views into a single recording – 1 day,
  • MUID, CLID, ANONCHK, SM, MR – Microsoft (Microsoft domains) – recognising the browser in Microsoft services – in accordance with the provider's policy.

Marketing (with consent, with the exceptions set out in section 13):

  • _shopify_marketing – Shopify – marketing data from the store and checkout pages – 1 year,
  • _gcl_au, _gcl_aw – Google (Google Ads) – measuring ad effectiveness – 90 days,
  • IDE, test_cookie – Google (doubleclick.net) – advertising and measurement in Google advertising services – up to 13 months (test_cookie – 15 minutes),
  • _fbp, _fbc – Meta – identifying the browser and ad clicks for advertising and analytics purposes – 90 days,
  • _ttp, ttcsid, ttclid, _tt_enable_cookie – TikTok – measuring and personalising TikTok ads – up to 13 months.

17. Do we track your activity in the store?

Yes. We use Shopify statistics and marketing cookies as well as Google Analytics 4, Google Ads, the Meta pixel and Meta Conversions API, the TikTok pixel and Microsoft Clarity. In countries in which we display the banner, we store their cookies, and the tools collect data, after you have given your consent – except for the limited information sent by the Google tag without cookies (section 13) and the Microsoft Clarity app pixel (section 16). We have described the details in sections 13–16.

18. Do we show you ads tailored to your interests?

Yes. Once you have given your consent, we may target ads in Google, Meta (Facebook, Instagram) and TikTok services at audiences defined on the basis of various criteria, e.g. age, interests or previous actions in our store (remarketing).

19. How can you manage your privacy?

20. What are server logs?

Using the store involves sending requests to the server. The store's servers are provided by Shopify, which records each request in server logs. The logs include, among other things, the IP address, the date and time of the request and information about the browser and operating system. We do not link log data to specific individuals and do not use it to identify you.

21. Can the privacy policy change?

Yes. We may change it, in particular when we change the tools used in the store or when the law changes. If you have an account in the store, we will inform you of significant changes by email or by a notice in the store. We will make archived versions of the policy available to you upon request sent to support@shezamme.com.

Last updated: 4 November 2026

Add Order Note