Privacy policy

In short

We only ask for the data we need to reply to you, send you your journal and meet our legal obligations. We don’t sell your data or use it for advertising, and we don’t build profiles or make automated decisions about you. This website doesn’t use cookies.

We process your data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and the Polish Personal Data Protection Act of 10 May 2018 (ustawa o ochronie danych osobowych).

Who is responsible for your data

The data controller is Marisa Jaworska, the owner of the anahatajournal.com website, who sells Anahata Journal in her own name, as an individual. When we say ‘we’ or ‘us’ in this policy, we mean her.

• Postal address: ul. Polna 15, 38-400 Krosno (Podkarpackie Voivodeship), Poland
• Email: marisajaworska@gmail.com

When you write to us through the form

Data: your name (if you give it), your email address, the reason for your message, the editions and copies you ask for (if you’re ordering the journal), your message, the language of the version of the website you’re writing from, and the ticked consent box. Web3Forms, the service that delivers your message to us, also records technical data such as your IP address, the date and time you sent it and the page you wrote from, and uses your IP address and email to filter spam.

Purpose: to reply to you and, if you ask us for the journal, to deal with your request.

Legal basis: your consent (Article 6(1)(a) GDPR), which you give by ticking the box and can withdraw at any time, without affecting the processing carried out before. If you write to us to order the journal, we also process your data to take, at your request, the steps needed before the purchase, such as confirming your order and working out the shipping (Article 6(1)(b) GDPR). If your message leads to a purchase, its data is then processed as explained in ‘When you buy’.

Retention: as long as we need to reply to you, and up to 12 months after our last communication, unless you ask us to delete it sooner. In addition, Web3Forms keeps a copy of each submission on its systems for up to 3 years and then deletes it automatically.

When you email us or ask to be notified

If you write to us directly at marisajaworska@gmail.com, we process your email address, your name and whatever you tell us in order to reply to you, based on your consent (Article 6(1)(a) GDPR). We keep it on the same basis as messages sent through the form.

If you ask us to let you know when Anahata Journal 2027 is available, we’ll use your email only for that notice, based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time: we won’t sign you up to any newsletter. We’ll delete it once we’ve let you know, or sooner if you ask us to.

When you buy

Data: your name, your email address, your shipping address, your phone number (if you pay on the website, Stripe asks for it for delivery), the editions and copies you choose, your order details and your payment details (amount, date, status and payment method; if you pay by card, its type or last digits). If you order through the form on the website, we collect them from the form and from the emails we exchange to confirm your order and agree how you’ll pay. When you pay on the website, Stripe collects them on its payment page, along with any billing details it asks for, and passes on to us the ones we need to handle your order. You enter your full card details directly with Stripe: we never see or store them. If you withdraw from the contract, we also process the details of your statement (your name, the order, your email and the date and time it was sent) to confirm it and refund you.

Purpose: to process your order and take payment, send it to you, keep you updated on its status, and handle withdrawals, returns, guarantee claims and complaints.

Legal basis: the performance of the sales contract you enter into with us (Article 6(1)(b) GDPR) and, for withdrawals, guarantee claims and complaints, compliance with our legal obligations under consumer law (Article 6(1)(c) GDPR).

Retention: while we handle your order and, after that, only to deal with possible claims and with restricted access, until the legal time limits for claims relating to the purchase have run out, including those of the legal guarantee.

Receipts, invoices and tax obligations

Data: what we need to issue the receipt or invoice and keep our tax records, that is, your name and address, the amounts and dates and, if you ask for an invoice in a company’s name, its tax details.

Legal basis: compliance with our legal obligations under tax law (Article 6(1)(c) GDPR).

Retention: for as long as Polish tax law requires us to keep these records, which is generally 5 years from the end of the calendar year in which the deadline for paying the tax on the sale passed (Articles 70 and 86 of the Polish Tax Ordinance, Ordynacja podatkowa), or longer if another applicable law requires it.

When you visit the website

When you open anahatajournal.com, your browser automatically sends some technical data (such as your IP address, your browser type, the page requested and the date and time) to the servers of Vercel, which hosts the website. This data is used only to show you the website and protect it against abuse and attacks; we don’t use it to analyse your browsing or to identify you.

We also measure visits anonymously with Vercel Web Analytics: how many people view each page, which country and type of device they come from, and which website sent them. It uses no cookies and stores nothing on your device, it doesn’t let us identify you or follow you from one website to another, and we only see overall figures. Legal basis: our legitimate interest in knowing what works on the website so we can improve it (Article 6(1)(f) GDPR).

Legal basis: our legitimate interest in keeping the website working and secure (Article 6(1)(f) GDPR).

Retention: Vercel keeps these technical logs only for the short period set by its service, after which they are deleted; we don’t copy them or store them separately.

Which data is required

On the form, only your email, your message and the consent box are required: without them, we can’t reply to you. To buy, we need your name, your email, your shipping address and a means of payment and, if you pay on the website, your phone number too; without them, we can’t fulfil your order.

If you give us someone else’s data, for example the address of a person you’re giving the journal to as a gift, make sure you’re allowed to do so, and let them know that you’ve given it to us and that we’ll use it only for the delivery.

Who else receives your data

We don’t sell your data or pass it on to third parties. We’ll only disclose it when the law requires us to, for example to the Polish tax authorities (Krajowa Administracja Skarbowa) or to the courts, if they request it.

To run our business, we rely on the following providers. Those that process data on our behalf (processors) do so under a contract that requires them to protect it and to use it only on our instructions; where that isn’t the case, we say so:

• Web3Forms (Web3Creative, India): receives the messages sent through the form, forwards them to us by email and keeps a copy for up to 3 years. It relies on its own providers: Amazon Web Services, Cloudflare and Hetzner for its infrastructure, and CleanTalk and Akismet for spam filtering, which receive your IP address and your email.
• Vercel Inc. (United States): website hosting and anonymous visitor statistics.
• Stripe Payments Europe Ltd. (Ireland): payment processing. Stripe also processes some data as an independent controller, to meet its own legal obligations and prevent fraud, in accordance with its privacy policy. If, on its payment page, you choose to save your details with one of Stripe’s own features, that relationship is directly between you and Stripe.
• Google Ireland Limited (Gmail): the email service we use to receive and reply to your messages. We use a standard email account, without a data processing agreement: Google processes this data under its own terms and privacy policy.
• The courier or postal company that delivers your order: receives the data needed for delivery, that is, your name, your shipping address and, if needed to let you know about the delivery, your email or phone number, and processes it under its own terms.
• The bank or payment provider through which we receive payment, if you pay by bank transfer or another method other than Stripe: receives the payment details (your name, the amount and the payment reference).
• Our tax adviser or accountant, where applicable: accounting and taxes.

International transfers

Some of these providers are located outside the European Economic Area (EEA) or may process data outside it, and orders we send outside the EEA take your data to the destination country. These transfers rely on the mechanisms provided for in the GDPR, which we set out below. If you’d like a copy of the safeguards, ask us at marisajaworska@gmail.com.

• Vercel Inc. (United States) participates in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission.
• Stripe Payments Europe Ltd. is based in Ireland. When data is passed to companies in its group in the United States, the transfer relies on the EU-U.S. Data Privacy Framework, in which Stripe participates, and on standard contractual clauses.
• Google Ireland Limited (Gmail), our email service, may process data in the United States through companies in its group. Its parent company, Google LLC, participates in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission.
• Web3Forms operates from India, which is not covered by an adequacy decision, and some of its providers process data in the United States. The transfer relies on the standard contractual clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), included in its data processing agreement, which also requires it to obtain equivalent safeguards from its own providers.
• If your order is going to a country outside the EEA, your name, your address and the shipping details (and, where applicable, the customs declaration with the contents and value of the parcel) are shared with the carriers and customs authorities of that country. This transfer is necessary to deliver your order (Article 49(1)(b) GDPR).

Your rights

You can exercise these rights at any time, free of charge:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data, for example when it is no longer needed.
• Objection: to object to processing based on our legitimate interest.
• Restriction: to ask us to keep your data without using it, in the cases provided for by law.
• Portability: to receive, in a structured, commonly used format, the data you gave us with your consent or for a contract, or to ask us to send it to another controller.
• Withdrawal of consent: to withdraw your consent where it is the basis for the processing, without affecting the processing carried out before.

How to exercise them and where to complain

Write to us at marisajaworska@gmail.com or by post to ul. Polna 15, 38-400 Krosno (Podkarpackie Voivodeship), Poland, telling us which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it.

We’ll reply within one month. In complex cases, this period may be extended by two further months; if so, we’ll let you know within the first month.

If you think we haven’t handled your data properly, you can lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl), which is our lead supervisory authority, or with the authority of the EU country where you live or work: in Spain, for example, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, www.aepd.es), and in Ireland the Data Protection Commission (6 Pembroke Row, Dublin 2, D02 X963, www.dataprotection.ie). You’ll find the authorities of all EU countries at edpb.europa.eu. We’d be grateful if you wrote to us first: we’ll try to put things right.

Cookies

This website doesn’t use cookies or any other technology that stores or reads information on your device for analytics, advertising or tracking. Nor does it load third-party content (such as social media, videos or external fonts) that could set them. That’s why we don’t show you a cookie banner.

The website only saves two pieces of information that it needs to work in your browser’s local storage (localStorage): the language you choose (aj-lang), so that it can show you the website in that language next time, and the copies of each edition you add to your order (aj-cart), so that you don’t lose them when you move from page to page. They are not cookies, they don’t include your name or your email, they aren’t used to identify you or track your browsing, and you can delete them whenever you like in your browser settings.

If you pay on the website, you’ll go to Stripe’s payment page, which uses its own cookies, needed for payment and fraud prevention, in accordance with its cookie policy.

If you send the contact form with JavaScript turned off, you’ll see Web3Forms’ confirmation page, a third-party site with its own cookie policy.

Children

This website is not aimed at children under 16. If you’re under 16, you need the consent of your parent or legal guardian to send us your data.

Security

We apply appropriate technical and organisational measures to protect your data: the website uses an encrypted connection (HTTPS), we work with providers that offer security guarantees, and we limit access to data to the people who need it.

Changes to this policy

We may update this policy if our services or the law change. This page always shows the date of the last update, and if a change is important, we’ll highlight it on the website.