COOKIE POLICY

SHOTTAS | www.shottasseeds.com

Last updated: 22 September 2026

1 — Cookies

1. In accordance with Article 399 of the Electronic Communications Law of 12 July 2024 (hereinafter: “PKE”), a provision implementing Article 5(3) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive), storing information on your device and accessing it require your consent — except for files and data that are necessary to provide the service you are using (Article 399(3) PKE). In other EU and EEA Member States, the equivalent national legislation implementing Article 5(3) of the ePrivacy Directive applies. We process personal data collected by means of Google Analytics solely on the basis of your consent (Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council — GDPR). Until you consent to the “Statistics” category, no information about your use of the website reaches Google Analytics — this is described in the section “STATISTICS COOKIES”.
2. Cookies are files sent to your computer or other device while you browse the shottasseeds.com website.
3. You can set the conditions for storing or accessing your data by changing the cookie settings in your browser.
4. Among other things, cookies make it possible to keep you signed in to the “My account” section and to remember the market version of the Shop that has been set (country and language), and — with your consent — to compile traffic statistics.
5. Cookies do not make any changes or modifications to the settings of the device or software on which they are installed.
6. You may refuse consent to cookies in the “Statistics” category. You can block necessary cookies only in your browser settings (points 7 and 9).
7. If you wish to block cookies, we recommend choosing the appropriate settings in your web browser. You can find more information on this subject at https://wszystkoociasteczkach.pl and https://www.youronlinechoices.com/pl/twojewybory — or directly in the individual browsers:
a. Mozilla Firefox: https://support.mozilla.org/en-US/kb/block-websites-storing-cookies-site-data-firefox
b. Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
c. Opera: https://help.opera.com/en/latest/web-preferences/
d. Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
e. Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
8. How we obtain your consent:
a. On your first visit to our website, we display a banner asking for your consent to cookies. No cookies other than necessary ones are stored on your device until you actively give your consent with the “Accept all” button, or select the “Statistics” category and confirm with the “Save choice” button. Until then, the Shop does not load Google Tag Manager or Google Analytics.
b. In the banner you can: (1) accept all, (2) choose “Necessary only”, (3) select or deselect the “Statistics” category under “Settings”.
c. Your consent concerns one category: “Statistics” (Google Analytics) — what this category switches on is described in the section “STATISTICS COOKIES”. Necessary cookies (in the banner: “Functional”) are always active, because the Shop does not work without them.
d. You can withdraw or change your consent at any time by clicking the “Cookie settings” link in the footer of our website. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
9. Blocking or deleting cookies may cause difficulties in using the Shop, and some of its features may turn out to be unavailable.
10. The cookies used in the Shop are divided into:
a. necessary cookies (in the banner: “Functional”) — the Shop does not work without them, e.g. they keep you signed in to the “My account” section; they do not require consent,
b. statistics cookies (in the banner: “Statistics”) — they make it possible to collect information on how the Shop is used; they are stored only with your consent.
In terms of storage time, cookies are divided into session cookies — temporary files that are stored on the User’s terminal device until the User logs out, leaves the website or closes the software (web browser),
and persistent cookies — which are stored on the User’s terminal device for the time specified in the cookie parameters or until they are deleted by the User.
11. Our website uses the following cookies and similar technologies. The list below reflects the actual state of the shop — it was established by inspecting the code and by measurement in a browser on 21 September 2026, not copied from documentation. The reCAPTCHA service, which protects selected forms, is described in the note at the end of this policy.

NECESSARY COOKIES

Necessary cookies are always active. They are essential for the shop to function correctly and do not require your consent. The Shop sets its own cookies of this kind — they are listed in the table below. In a browser without previously stored Google cookies, the reCAPTCHA service does not store any files on your device — it is described in the note at the end of this policy.

The browser stores no more than 10 shot_zam_, shot_fak_ and shot_pro_ cookies in total: when there are already 10 of them and the Shop is about to store another one, it deletes all the earlier ones. Access to an older order or document is then restored by opening the link from the email again.

STATISTICS COOKIES

With your consent, the Shop uses Google Analytics 4 and Google Tag Manager — tools provided by Google. We use them for traffic statistics: to understand how customers use the Shop and to improve it on that basis. We do not use the Meta pixel or Google advertising tools.

Before you give consent

Until you consent to the “Statistics” category — even if you do not click anything in the banner, and even if you choose “Necessary only” — the Shop does not load the Google Tag Manager or Google Analytics scripts, your browser does not connect to Google’s servers for this purpose, and no data about your use of the Shop reaches Google Analytics. No Google Analytics cookie is stored on your device. This does not apply to the reCAPTCHA service, which protects selected forms and connects to Google regardless of this consent — it is described in the note at the end of this policy.

After you give consent

If you click “Accept all”, or select the “Statistics” category and confirm with the “Save choice” button, your browser downloads the Google Tag Manager and Google Analytics scripts from Google’s servers, and Google Analytics stores the cookies listed in the table on your device. For as long as your consent remains in effect, these scripts load on every page of the Shop. Google Analytics then receives, in particular: the address of the page you are visiting, including its parameters (the addresses of the order confirmation and order status pages contain only the order number, and the addresses of the invoice and pro forma invoice pages — only the document identifier; the access keys to those pages are stored in cookies that Google Analytics cannot access; the tokens from links for setting a new password and from newsletter emails are likewise moved into cookies by the Shop on first entry, so they do not appear in the page address), the page title, the address of the page from which you came, the phrase entered in the Shop’s search box (the address of the results page contains it in the “szukaj” parameter), the browser language, the screen resolution, information about your browser and device and your approximate location determined by Google on the basis of your IP address, the status of your consent, the browser identifier stored in the _ga cookie and the visit identifier stored in the _ga_PQW1YYLZLH cookie (they enable Google Analytics to recognise later visits from the same browser), the time you are active on the page, and information about your activity in the Shop: scrolling the page, clicking a link leading outside the Shop (together with its address — e.g. the address of the carrier’s shipment tracking page, which contains the shipment number), downloading a file, playing a video, the products you view, adding a product to the cart and removing it from the cart, the products in your cart, the delivery and payment method you choose, errors in the order form (only the name of the field, without the content entered) and, once you place an order, its number, value, delivery cost and any discount code used. Google also receives the IP address of your device, because every connection to Google’s servers discloses it. Your consent does not cover the use of this data for advertising purposes — the Shop informs Google that no such consent has been given. After consent is given, Google Tag Manager also sends Google diagnostic data about its own operation. At the moment you give consent, Google Analytics also receives events from the current visit recorded before the click, since the last full page load — e.g. viewing a product, starting to place an order or choosing a delivery method; the Shop does not send information about an order placed before consent was given.

The duration is renewed with every page you visit. Your browser may shorten it — for example, Chrome to 400 days.

Google retains the data sent to Google Analytics for 2 months from its collection — both event data and data associated with the browser identifier; this period, which we have set in the service, is not extended by further activity.

Data from forms

Google Analytics does not receive the content entered in the Shop’s forms: automatic collection of user-provided data and measurement of form interactions are switched off in our Google Analytics account, and the events sent by the Shop do not contain the values of form fields — in the event of an error in the order form, they pass on only the name of the field. The exception is the Shop’s search box: Google Analytics receives the phrase entered in it as part of the address of the results page. Google Analytics removes a string that looks like an email address before storing it, but other data entered in the search box — e.g. a telephone number — would be stored, so please do not enter personal data in it. We do not use the Google Signals feature, so the data is not combined with information from Google accounts.

DATA STORED IN YOUR BROWSER’S MEMORY

Apart from cookies, the Shop stores a few pieces of information in the browser’s local storage (localStorage), and two in session storage (sessionStorage). They are not sent to our server with every request — they remain on your device. If consent has been given to the “Statistics” category, part of their content reaches Google Analytics as described above: the status of your consent, the products in your cart, the numbers of orders placed and any discount code used in them. Most of them are necessary for the Shop to work (cart, discount code, age confirmation, the record of your cookie decision). The newsletter pop-up markers only record that the pop-up has been closed or that the sign-up has been completed — so that it is not shown again; they contain no personal data and are necessary. The shot-purchase-wyslane and shot-zakup-oczekuje entries are not necessary: they serve solely for measurement in Google Analytics and are created only after consent has been given to the “Statistics” category. You can delete them together with the other site data:

You can delete all of the above data at any time by clearing the site data in your browser settings. Deleting the stored consent will cause the banner to be displayed again.

HOW TO WITHDRAW OR CHANGE YOUR CONSENT

You can change your choice at any time using the “Cookie settings” link in the footer of every page of the shop. It opens the same panel that is shown on your first visit. Withdrawing consent is just as easy as giving it. When you withdraw your consent to the “Statistics” category, the Shop deletes the Google Analytics cookies (_ga and _ga_PQW1YYLZLH) from your browser and reloads the page; from then on, Google Tag Manager and Google Analytics are not loaded and no data reaches them. Withdrawing consent does not delete data that Google Analytics received earlier — Google deletes it once the retention period described above has expired.

The buttons in the banner are “Accept all”, “Necessary only” and “Settings”, and in the detailed panel — “Save choice”.

TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

Our own necessary cookies and the data in browser memory come from us. All traffic to the Shop — together with the request headers in which the browser sends cookies — passes through Cloudflare; the rules for transferring this data are described in the Privacy Policy. In normal traffic, Cloudflare does not store cookies on your device and does not load its own scripts on the pages of the Shop. Should it consider the traffic suspicious and display a “verify you are not a bot” check, once you pass that check it stores the cf_clearance cookie, which confirms that verification. Cloudflare also passes the browser a network error reporting policy (Network Error Logging): the browser remembers it for 7 days and during that time may send Cloudflare reports solely on failed connections to the Shop. The data that reaches Google Analytics after consent is given is described in the paragraph below.

The data collected by Google Analytics 4 and Google Tag Manager after consent is given is received by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as a processor on behalf of the Controller. According to Google, this data may be processed outside the European Economic Area, including in the United States. Google LLC, which may receive this data in the United States, is certified under the EU–U.S. Data Privacy Framework, for which the European Commission has found an adequate level of data protection (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, Article 45 GDPR); the terms offered by Google additionally provide for standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).

Information about transfers related to the newsletter sign-up can be found in the Privacy Policy.

2 — Social Media — Joint Controllership with Meta Platforms Ireland Limited

1. The Controller runs profiles on services owned by Meta Platforms Ireland Limited: a Facebook page (facebook.com/shottasseeds) and an Instagram profile (instagram.com/shottasseeds). As regards the statistical data concerning those profiles, the Controller and Meta Platforms Ireland Limited are joint controllers of your data in accordance with Article 26 of the GDPR. The Controller does not run a YouTube channel or a profile on any other social network — an earlier version of this policy listed YouTube, Messenger and WhatsApp, which did not correspond to the facts.
2. Joint controllership covers the aggregate analysis of data in order to display statistics on the activity of users of the Controller’s Facebook page and its Instagram profile. The “share” buttons available in the shop (including Facebook, Messenger and WhatsApp) are not covered by joint controllership — they are triggered solely by the visitor, and the Controller receives no data in connection with them.
3. Scope of the responsibility of Meta Platforms Ireland Limited for processing your data for the above purposes:
a. having a legal basis for processing data for Page Insights;
b. ensuring the exercise of the rights of data subjects;
c. reporting breaches to the supervisory authority and notifying the data subjects affected by a breach of the incident;
d. ensuring appropriate technical and organisational measures to safeguard the security of your data.
4. Scope of the responsibility of the Controller for processing your data:
a. having a legal basis for data processing;
b. fulfilling the information obligations with regard to the purposes of processing pursued by the Controller.
5. Meta Platforms Ireland Limited will make the essence of the Page Insights Controller Addendum available to data subjects (Article 26(2) GDPR) via the Page Insights Information, which can be accessed from all Pages.
6. The main supervisory authority for the joint processing of data is the Irish Data Protection Commission (without prejudice to Article 55(2) of the GDPR, where applicable).
7. Detailed information about the arrangements between the joint controllers is available at: https://www.facebook.com/legal/terms/page_controller_addendum.
8. The rules on the processing of your personal data by Meta Platforms Ireland Limited are available at: https://www.facebook.com/privacy/explanation.
9. You can contact Facebook’s Data Protection Officer via the form provided on Facebook’s website at: https://www.facebook.com/help/contact/540977946302970.