Skip to content
Build their box

Language and delivery

Language

Privacy policy

How the A Co To online shop at acoto.ooo looks after your personal data. Valid from 29 October 2026

Who looks after your data

  1. The controller of your personal data is Lucyna Ludwiczak, a sole trader doing business as "A co to Lucyna Ludwiczak", ul. Fiołkowa 12, 62-030 Luboń, Poland, tax ID (NIP) 7773132782 ("we").
  2. For anything about your data, write to lucy@acoto.ooo, call +48 696 766 760 or send a letter to our address. We haven't appointed a data protection officer, so Lucy answers herself.

What data we use

  1. When you order: your name, email address, mobile number, delivery address or pickup point, delivery country, your choices (boxes, extras, delivery method) and the payment status. We never see your full card details.
  2. About the child: the first name for the box, the age band and the world you choose, and your trip details (departure date, how you travel and, if you tell us, where you're going) and your notes.
  3. Please don't put health information in the notes. If you mention something like an allergy so that we leave an item out, we use it only to pack that box, based on your explicit consent, which you give by writing it (Art. 9(2)(a) GDPR).
  4. If you send a gift: the recipient's name, address and phone number, and your gift message.
  5. We also use what you write to us, your marketing email choice, reviews and questions you send us, and technical data about your visit, as described below.

Orders, delivery and payment

  1. We use your order data to take your order, pack it, send it, keep you informed and deal with any problems. The legal basis is the contract with you and the steps before it (Art. 6(1)(b) GDPR).
  2. Giving us this data is voluntary, but we can't take or deliver an order without it.
  3. Payments go through Stripe (its European company in Ireland), which processes payment data for us. Stripe also uses some data as an independent controller, for example to prevent fraud and meet its legal duties, under its own privacy policy.
  4. If you pay with PayPal, Klarna, BLIK, a bank transfer or another method, that provider processes your data as an independent controller under its own privacy policy.
  5. For delivery we pass your name, address or pickup point, phone number and email to Apaczka, which creates the shipping labels, and to the carrier: InPost (including its Mondial Relay network) or DPD with its local partners (for example SEUR in Spain and BRT in Italy). Carriers use this data to deliver the parcel and to send you delivery notifications.

Accounting, complaints and legal claims

  1. We keep order and payment records to meet our accounting and tax duties, including EU VAT rules for sales to other EU countries (Art. 6(1)(c) GDPR, together with Polish accounting and tax law).
  2. We use your data to handle complaints and withdrawals, as consumer law requires (Art. 6(1)(c) GDPR).
  3. We may use your data to establish, pursue or defend legal claims, which is our legitimate interest (Art. 6(1)(f) GDPR).
  4. If a product we sold turns out to be unsafe or is recalled, we use your contact details to warn you, as product safety law requires (Art. 6(1)(c) GDPR, together with Regulation (EU) 2023/988).

When you write to us

  1. If you email us, call us or write to us, we use your message and contact details to answer you. If it's about an order, the legal basis is the contract (Art. 6(1)(b) GDPR). Otherwise, it's our legitimate interest in answering questions (Art. 6(1)(f) GDPR).

Emails

  1. We email you about your order: a confirmation, payment details if your payment method needs them, a message when your parcel is on its way, a message if there is a delivery problem, and a short note with tips for the road the day before your trip. Stripe also sends you its payment receipt. The legal basis is the contract (Art. 6(1)(b) GDPR).
  2. We send emails through Resend (Resend, Inc.), which stores them on servers in the EU and may process them outside the EEA under standard contractual clauses.
  3. We may also send tips for travelling with kids, new products, a request for a review after your trip and the odd offer, at most 2 emails a month.
  4. In countries where the law requires your prior consent, including Poland, we send these emails only if you tick the box at checkout. The legal basis is your consent (Art. 6(1)(a) GDPR).
  5. In the other countries we email buyers about our own similar products, unless they tick "No thanks" at checkout or unsubscribe later. The legal basis is our legitimate interest in direct marketing to our customers (Art. 6(1)(f) GDPR), as allowed by the national rules on emails to existing customers.
  6. If you leave an order unpaid and you have ticked the box to receive our emails, we may send you one reminder with a picture of your box and a discount code. Without that tick, we don't send it.
  7. If you sign up for a trip reminder or ask us to tell you when we deliver to your country, we use your email only for that, based on your consent (Art. 6(1)(a) GDPR).
  8. If a friend orders with your referral code, we email you your reward. The legal basis is the referral offer you took part in (Art. 6(1)(b) GDPR). We never tell you who the friend was.
  9. Every marketing email has an unsubscribe link, and you can also reply to any of our emails to stop them. Unsubscribing is free and doesn't affect emails about your orders. We keep a record of your choice and when you made it.

Reviews

  1. If you send us a review, we keep your stars, text, the name you give and any photo, together with your order if you came from our email link. We use them to improve our boxes, based on our legitimate interest (Art. 6(1)(f) GDPR).
  2. We publish your review on our website and social media only if you tick that we may quote it. That is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us. We then remove it from our website.
  3. Please only send photos of children if you are their parent or guardian, and only of people who agree.

Analytics and cookies

  1. We count visits with our own analytics (analytics.plud.net). By default it works without cookies: nothing is stored on your device and no profile is built. The legal basis is our legitimate interest in knowing how our shop is used (Art. 6(1)(f) GDPR).
  2. If you accept on the cookie bar, the analytics keeps a random visitor ID in your browser so we can tell which visits led to an order, and we load the ad tags of the platforms where we advertise, to measure our ads: the Meta pixel (Meta Platforms Ireland Ltd.), the Google Ads tag (Google Ireland Ltd.) and the TikTok pixel (TikTok Technology Limited, Ireland). When you pay, Meta, Google and TikTok receive the purchase together with your email address in hashed form, so they can match the order to an ad you saw. They may process this data outside the EEA under standard contractual clauses or the EU-US Data Privacy Framework.
  3. The legal basis is your consent (Art. 6(1)(a) GDPR). You can change your mind at any time with the "Cookie settings" link in the footer; declining removes the stored ID. We ask again after 12 months.
  4. Without asking for consent, we only store what the site needs to work as you expect: your cookie choice, your unfinished order, the delivery country you chose, a referral code from a friend's link and a session cookie with your country, which we work out from your IP address to suggest prices and delivery. The Stripe payment page uses its own cookies to process payments securely and prevent fraud.

Questions to our FAQ assistant

  1. If you type a question into "Ask your own question…" in our FAQ, an AI model from Anthropic (Anthropic, PBC) answers it. Anthropic receives your question and our own product information, and may process it outside the EEA under standard contractual clauses. Please don't include personal details.
  2. We keep the questions and answers to improve the FAQ, together with the page language, the delivery country and a code made from your IP address that changes every day, used only to stop abuse. We don't store your IP address. Questions are deleted after 12 months.
  3. The legal basis is our legitimate interest in answering your questions and improving the shop (Art. 6(1)(f) GDPR).
  4. If you accepted cookies, we also save your analytics visitor ID with the question, so we can see whether the answer helped your visit. That part is based on your consent, which you can withdraw at any time with the "Cookie settings" link in the footer.

Hosting and security

  1. Our website and order system run on Netlify (Netlify, Inc.), and the order system's database is provided by Neon. They process data for us to host the site, and the servers record technical data such as your IP address to deliver pages and protect the site. The legal basis is our legitimate interest in a working and secure shop (Art. 6(1)(f) GDPR).

Who receives your data

  1. Companies that process data for us under a data processing agreement: Stripe (payments), Apaczka (shipping labels), Resend (emails), Netlify and Neon (hosting and database), Anthropic (FAQ assistant) and our analytics service analytics.plud.net.
  2. Independent controllers, each under its own privacy policy: carriers (InPost, DPD and their local partners), payment providers you choose (such as PayPal or Klarna) and, only if you accept cookies, Meta, Google and TikTok.
  3. Public authorities, such as tax offices, courts or consumer and product safety authorities, when the law requires it.
  4. We never sell your data.

Data outside the EEA

  1. Some of these companies, or their subcontractors, are based in the United States or may access data from outside the European Economic Area. We only allow this with safeguards required by the GDPR: the EU-US Data Privacy Framework, where the company is certified under it, or standard contractual clauses approved by the European Commission.
  2. You can ask us for more information about these safeguards and for a copy of them.

How long we keep data

  1. Order data: as long as needed to fulfil the order and handle complaints and claims, and then as long as tax law requires us to keep order records: 5 years from the end of the calendar year in which the tax payment deadline passed, and 10 years from the end of the year of the sale for records of sales to other EU countries (EU VAT One Stop Shop).
  2. Data for legal claims: until the claims are time-barred.
  3. Marketing emails: until you unsubscribe, object or withdraw your consent. After that we keep your address on a do-not-email list so we don't write to you again, and the record of your choice as proof.
  4. Trip reminders and "let me know" sign-ups: until we've sent that email or you unsubscribe.
  5. Reviews: published reviews until you ask us to remove them, others as long as they help us improve our boxes.
  6. FAQ questions: 12 months. The analytics visitor ID stays in your browser until you decline cookies or your consent expires after 12 months.
  7. Messages you send us: as long as needed to deal with the matter, and then until any related claims are time-barred.

Your rights

  1. You have the right to access your data and get a copy, to have it corrected, deleted or its use restricted, and to receive data you gave us in a common format or have it sent to another controller.
  2. You can object at any time to our use of your data for direct marketing. We will then stop.
  3. You can also object to other uses based on our legitimate interest, for reasons related to your particular situation.
  4. Where we rely on your consent, you can withdraw it at any time. This doesn't affect the lawfulness of what we did based on your consent before you withdrew it.
  5. To use your rights, write to lucy@acoto.ooo. It's free, and we reply without undue delay and at the latest within one month.
  6. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Complaints to a data protection authority

  1. If you think we are handling your data unlawfully, you can complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
  2. You can also complain to the data protection authority in the EU country where you live or work, or where you think the breach happened. The European Data Protection Board lists the authorities of all EU countries at edpb.europa.eu.

Changes to this policy

  1. We update this policy when the way we use data changes. The current version is always on this page. If a change matters for you, we will also tell you by email.