Skip to Content
🌍 EN  |  🇩🇪 DE  |  🇫🇷 FR  |  🇮🇹 IT  |  🇳🇱 NL  |  🇺🇦 UA  |  🇰🇷 KO  |  🇸🇪 SV  |  🇩🇰 DA  |  🇨🇳 ZH  |  🇬🇧 UK  |  🇵🇱 PL  |  🇪🇸 ES

missO.

Privacy Policy

Short and to the point: what data we collect, why, and what rights you have.

In short

We only collect what we need

Data needed to fulfil your order, run your account and – if you wish – send our newsletter.

We share it with selected partners

Odoo hosting, Stripe payments, couriers, our accounting office, Zenbox mail. We never sell your data.

You are in control

Access, rectification, erasure, objection, withdrawal of consent – at any time.

Write to us

info@misso.pl

1. Scope of this policy2. Data controller3. What data we collect4. Purposes and legal bases of processing5. Special category data and minors6. Who we share data with7. Transfers outside the EEA8. How long we keep data9. Your rights and complaints to the supervisory authority10. Cookies11. Security12. Contact13. Changes to this policy

1. Scope of this policy

This policy explains how MISSO Sp. z o.o. processes the personal data of people who visit the misso-lingerie.com online shop, place orders, create an account, subscribe to the newsletter or contact us. We apply it in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish law, including the Electronic Communications Law of 12 July 2024.

2. Data controller

The controller of your personal data is MISSO Sp. z o.o., registered office at ul. Sandomierska 26A/116, 27-400 Ostrowiec Świętokrzyski, Poland, VAT ID (NIP): 6612371156, REGON: 360165222, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Kielce, 10th Commercial Division of the National Court Register, under KRS number 0000532373.

Contact on personal data matters: e-mail info@misso.pl, or in writing to our registered office.

Please contact us directly on any data-related matter.

3. What data we collect

Data you provide yourself: first and last name, e-mail address, phone number, delivery and billing address and, for company invoices, company name and VAT number; account data (login, encrypted password); the content of messages sent via the contact form or e-mail; data needed to handle a complaint or return (e.g. a bank account number for a refund).

Data collected automatically: IP address, device and browser information, pages visited, basket contents, order history, newsletter open and click information, and data stored in cookies (see section 10).

Data from third parties: the payment operator tells us the payment status (we never receive your full card details) and the courier company tells us the delivery status.

4. Purposes and legal bases of processing

  • Fulfilling your order (concluding and performing the sales contract, payment, delivery, contact about the order) – Art. 6(1)(b) GDPR.
  • Customer account (creating and maintaining the account, order history) – Art. 6(1)(b) GDPR (contract for the account service).
  • Complaints, returns and withdrawal from the contract – Art. 6(1)(b) and (c) GDPR (performance of the contract and obligations under the Polish Civil Code and Consumer Rights Act); the rules are described on the page Returns & Complaints.
  • Accounting and taxes (issuing invoices, including in the Polish National e-Invoice System – KSeF, keeping records) – Art. 6(1)(c) GDPR in conjunction with tax and accounting legislation.
  • Newsletter (e-mails about new arrivals and offers) – Art. 6(1)(a) GDPR and consent to electronic marketing communications under the Electronic Communications Law. You can withdraw your consent at any time – via the link in every message or by writing to us.
  • Marketing of our own products and statistics (e.g. analysis of newsletter opens and clicks, shop visit statistics in Odoo) – our legitimate interest, Art. 6(1)(f) GDPR.
  • Replying to messages sent via the contact form or e-mail – Art. 6(1)(f) GDPR (legitimate interest: handling enquiries) and, where they concern an order, point (b).
  • Shop security (protecting forms against spam and bots) – Art. 6(1)(f) GDPR.
  • Establishing, exercising and defending legal claims – Art. 6(1)(f) GDPR.
  • Cookies – those necessary for the shop to work: Art. 6(1)(f) GDPR; others (e.g. external content): your consent – Art. 6(1)(a) GDPR (see section 10).

Providing your data is voluntary, but without the data needed for an order we cannot fulfil it. We do not make decisions about you based solely on automated processing that would have legal effects.

5. Special category data and minors

We do not ask for special category data (e.g. about health) – please do not include it in messages to us. The shop is not intended for people under 16; if we learn that we have received such a person's data without a guardian's consent, we will delete it.

6. Who we share data with

We share your data only to the extent necessary with companies that help us run the shop:

  • Odoo S.A. (Chaussée de Namur 40, 1367 Grand-Rosière, Belgium) – provider of the shop software and cloud ERP (Odoo Online), data hosting, sending transactional e-mails and the newsletter (Odoo Email Marketing); data is stored in Odoo's data centre in the European Union (Western Europe, France).
  • Stripe Payments Europe, Limited (Ireland) – card and other online payments.
  • The Controller's bank – for traditional bank transfers and refunds.
  • Courier companies / postal operator – delivering orders and collecting cash on delivery – FedEx, DPD and Poczta Polska S.A.
  • External accounting office – bookkeeping and tax settlements (data from invoices and sales documents).
  • Symfonia accounting software provider – we store and process accounting documents in the Symfonia system; the provider has access to data only to the extent necessary to maintain and support the system.
  • Google Ireland Limited – the reCAPTCHA service protecting forms against spam.
  • Meta Platforms Ireland Limited – displaying embedded content from our Instagram profile (only after you consent to cookies).
  • Zenbox (Polish hosting and e-mail provider) – handling the info@misso.pl mailbox and customer correspondence; data stored on servers in Poland/EEA.
  • Public authorities – where required by law, in particular the Polish National Revenue Administration (invoices in KSeF).

We have concluded data processing agreements with providers processing data on our behalf (or accept their standard data processing terms). We never sell your data.

7. Transfers outside the EEA

As a rule, we process data within the European Economic Area. Some providers (Stripe, Google, Meta) belong to groups based in the USA and may transfer data to the United States. This is done on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. You can obtain a copy of the safeguards by contacting us.

8. How long we keep data

  • Orders and invoices – for the period required by tax and accounting law, as a rule 5 years from the end of the calendar year in which the tax liability arose.
  • Complaints and claims – until the seller's liability periods and the limitation periods for claims under the Polish Civil Code expire.
  • Customer account – until it is deleted (at your request or on our initiative), subject to the periods above.
  • Newsletter – until you withdraw consent; we keep confirmation of consent being given and withdrawn until the limitation period for any claims expires.
  • Correspondence – until the matter is closed, and then for the period needed to defend against any claims.
  • Cookies – for the period set for the given cookie (see section 10) or until you delete them in your browser.

9. Your rights and complaints to the supervisory authority

You have the right to: access your data and receive a copy, rectification, erasure, restriction of processing, data portability, object to processing based on legitimate interest (including – at any time – to direct marketing) and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

To exercise your rights, write to info@misso.pl. We will reply without undue delay and no later than within one month.

You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

10. Cookies

Cookies are small files stored in your browser. We use them in two groups:

  • Necessary – the shop does not work without them: maintaining the session and basket, logging in (e.g. session_id), remembering your language (frontend_lang) and time zone, remembering your choice in the cookie banner, payment security (Stripe cookies during checkout) and form protection (Google reCAPTCHA), as well as campaign parameters (utm_*) when you arrive from a campaign link.
  • Optional (with your consent) – external content, e.g. our embedded Instagram profile (Meta). Such content is blocked until you give consent in the cookie banner.

We currently do not use Google Analytics or advertising pixels (e.g. Meta Pixel). If this changes, we will update this policy and ask for your consent.

You can change your decision by deleting cookies in your browser settings – the banner will appear again. You can also block cookies in your browser, but some shop features (e.g. the basket) may then not work.

11. Security

The connection to the shop is encrypted (HTTPS), only authorised persons have access to data, and payment card data is handled directly by the payment operator.

12. Contact

MISSO Sp. z o.o., ul. Sandomierska 26A/116, 27-400 Ostrowiec Świętokrzyski, Poland
e-mail: info@misso.pl

13. Changes to this policy

We update this policy when laws, our services or providers change. The current version is always available on this page, and we will inform account holders and newsletter subscribers of any material changes.

Effective from: 23 October 2026