Privacy and Cookie Policy

Effective from: 12 October 2026

In this document we explain what personal data we collect in the InnerMastering Institute Store online shop (https://store.innermastering.com, the “Store”), for what purpose, on what legal basis and for how long we store it, to whom we disclose it and what rights you have. We also describe the cookies used in the Store. This document fulfils the information obligations under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR).

§ 1. Data controller and contact

The controller of your personal data is InnerMastering Institute sp. z o.o., with its registered office in Warsaw, Al. KEN 36 lok. 112B, 02-797 Warszawa, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000674526, NIP (tax identification number) 5213777844, REGON (statistical number) 367111608 (the “Controller”, “we”).
In all matters relating to personal data, including to exercise the rights described in § 7, you can contact us:
1. by e-mail: marco.ramirez@innermastering.com;
2. in writing: InnerMastering Institute sp. z o.o., Al. KEN 36 lok. 112B, 02-797 Warszawa;
3. by telephone: +48 506 068 711 (on business days, between 10:00 and 18:00).

§ 2. What data we collect

Data you provide in the order form: first name, surname, e-mail address, country; if you order coaching cards or printed books – also your delivery address and telephone number and, for delivery to a parcel locker or pick-up point, the selected point; if you want an invoice issued to a company – the company name and NIP (tax identification number).
Optional data: the name entered in the “Name for the ex libris” field and information on whether you have consented to receive information about new books and programmes.
Data related to your order and account: products ordered, amounts, currency, selected payment and delivery method (including the selected pick-up point), payment status and the transaction identifier received from the payment operator, e-book download history, the copy number from the ex libris, the record of your consent to the supply of the e-book before the end of the period for withdrawal from the contract (with the date), and account login data (e-mail address and password stored in encrypted form).
Correspondence data: the content of messages you send us (e.g. complaints, statements of withdrawal from the contract) and the data they contain.
Technical data: IP address, information about your browser and device, recorded in server logs and – to the extent described in § 9 – in cookies.
We do not receive full payment card details – these are processed by the payment operators.

§ 3. Purposes, legal bases and periods of processing

3.1. Orders, delivery of products and your account

Purpose: concluding and performing the contract – accepting and handling your order, receiving payment (including reminders about an unpaid order), delivering e-books and shipping cards and printed books, maintaining your account and Library (we create the account automatically with your first order), and contacting you about your order.
Legal basis: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract (a sales contract, a contract for the supply of digital content, a contract for maintaining an account) or in order to take steps at your request prior to entering into it.
Period: account data – until the account is deleted; order data – for the period required by tax law (point 3.2) and, to the extent necessary to defend against claims, until the limitation period for such claims expires (point 3.3).

3.2. Invoices, KSeF and accounting

Purpose: issuing a VAT invoice for each order, submitting it to the National e-Invoicing System (Krajowy System e-Faktur, KSeF), keeping accounting records and retaining tax documentation.
Legal basis: Article 6(1)(c) GDPR – a legal obligation arising in particular from the Act of 11 March 2004 on Goods and Services Tax (ustawa o podatku od towarów i usług), the Act of 29 August 1997 – Tax Ordinance (Ordynacja podatkowa) and the Accounting Act of 29 September 1994 (ustawa o rachunkowości).
Period: 5 years from the end of the tax year to which the documents relate and, if the law requires longer retention, until the limitation period for the tax liability expires.

3.3. Withdrawal from the contract, complaints and claims

Purpose: handling statements of withdrawal from the contract and complaints, documenting your consent to the supply of the e-book before the end of the period for withdrawal from the contract, and establishing, pursuing or defending claims.
Legal basis: Article 6(1)(c) GDPR – obligations arising from the Consumer Rights Act of 30 May 2014 (ustawa o prawach konsumenta) (including handling complaints and confirming consent on a durable medium); Article 6(1)(f) GDPR – our legitimate interest in being able to demonstrate proper performance of the contract and to establish, pursue and defend claims.
Period: until the limitation period for claims arising from the contract expires (as a rule 6 years, and 3 years for claims related to business activity; the period ends on the last day of the calendar year).

3.4. Ex libris in the e-book

Purpose: inserting an ex libris page with a name and copy number into the e-books you purchase. This applies only if you enter a name in the optional “Name for the ex libris” field; if the field is left blank, the e-book does not contain any of your data.
Legal basis: Article 6(1)(b) GDPR – performance of the contract in accordance with the wish you expressed in your order.
Period: the name is stored in the order and in the personalised copy of the file kept on the Store’s server so that it can be downloaded – for as long as the order data (point 3.1). The name inserted into a downloaded file remains in your copy of the e-book.
If you enter the name of another person (e.g. when buying an e-book as a gift), please let them know.

3.5. Information about new releases, review requests and cart reminders (marketing with consent)

Purpose: sending you information by e-mail about new books and programmes of InnerMastering Institute, including:
1. post-purchase messages – approximately 14 and 30 days after your order (a request for a review, information about new releases);
2. reminders about an abandoned cart – if you enter your e-mail address in the order form and tick the consent box but do not complete the order: after approximately 1, 24 and 72 hours;
3. the newsletter.
Legal basis: Article 6(1)(a) GDPR – your consent, given by ticking a checkbox (unticked by default) in the order form, in conjunction with Article 398 of the Electronic Communications Law Act of 12 July 2024 (ustawa – Prawo komunikacji elektronicznej). Consent is voluntary and is not a condition of purchase.
Period: until you withdraw your consent; abandoned cart data (e-mail address, first name, cart contents) are deleted after 7 days. We keep information on the giving and withdrawal of consent until the limitation period for claims expires, so that we can demonstrate that we acted lawfully.
Withdrawal of consent: at any time, with a single click on the unsubscribe link in any message, or by e-mail to marco.ramirez@innermastering.com. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

3.6. Analytics (with consent)

Purpose: compiling statistics on visits to the Store using Google Analytics 4 and determining how you reached the Store before placing an order (order source attribution – e.g. a campaign, a search engine, a referral), so that we can improve the Store and assess the effectiveness of our activities.
Legal basis: Article 6(1)(a) GDPR – your consent given in the cookie banner, in conjunction with Article 399 of the Electronic Communications Law Act. Without your consent, Google Analytics is not loaded at all and order source attribution is disabled.
Period: data in Google Analytics – 14 months; cookies – as set out in the table in § 9; until you withdraw your consent.

3.7. Security and operation of the Store

Purpose: ensuring the proper and secure operation of the Store (server logs, strictly necessary cookies, prevention of abuse and payment fraud), remembering your choice of language and currency and your cookie decision, and handling correspondence not related to an order.
Legal basis: Article 6(1)(f) GDPR – our legitimate interest in ensuring the security and functionality of the Store and in responding to messages; we use strictly necessary cookies without consent on the basis of Article 399 of the Electronic Communications Law Act.
Period: cookies – as set out in the table in § 9; server logs and correspondence – for the period necessary to achieve the purpose, and no longer than until the limitation period for any claims expires.

§ 4. To whom we disclose data

We disclose your data only to the extent necessary to achieve the purposes described. Recipients of the data may include:
1. hosting provider – SEOHOST (the Store’s server is located in Poland);
2. e-mail provider – Microsoft Ireland Operations Ltd. (Microsoft 365), which we use to send and receive messages;
3. payment operators – Stripe Payments Europe, Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), PayU S.A. (Poznań, Poland; payments in PLN) – to the extent necessary to process the payment you choose;
4. delivery of cards and printed books – Alsendo sp. z o.o., with its registered office in Warsaw (the Apaczka.pl service through which we dispatch parcels and which provides the pick-up point map in the order form), and the carrier you select in your order (InPost sp. z o.o., ORLEN Paczka sp. z o.o. or Poczta Polska S.A.) – with respect to your name, delivery address or selected pick-up point, telephone number and e-mail address;
5. analytics – Google Ireland Ltd. (Google Analytics 4) – only if you give your consent;
6. newsletter – MailerLite Limited (Ireland) – only if you consent to receive information about new releases;
7. accounting – the accounting firm that keeps our books;
8. Ministry of Finance – as the operator of the National e-Invoicing System (KSeF), to which we submit invoices;
9. providers of legal services to us – where necessary to pursue or defend claims;
10. public authorities – where they have a legal basis for this (e.g. tax authorities).
Some recipients process data on our behalf under data processing agreements (e.g. hosting, e-mail, analytics, newsletter, accounting firm). Payment operators, carriers and Alsendo (Apaczka.pl), to the extent they provide their own services, may act as separate controllers – on the terms described in their privacy policies.

§ 5. Transfers of data outside the European Economic Area

Some of our providers (Stripe, PayPal, Google, Microsoft, MailerLite) belong to groups that may also process data outside the European Economic Area (EEA), in particular in the United States.
In such cases, data are transferred on the basis of a European Commission decision finding an adequate level of protection (in particular under the EU–U.S. Data Privacy Framework – in respect of entities participating in it) or on the basis of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).
You can obtain a copy of the safeguards applied by writing to marco.ramirez@innermastering.com.

§ 6. Retention periods – summary

Data	How long
Order and invoice data	5 years from the end of the tax year (tax law)
Account and Library	until the account is deleted
Data needed to defend against claims (including the record of consent to the supply of the e-book)	until the limitation period for claims expires
Marketing (information about new releases, review requests, newsletter)	until consent is withdrawn
Abandoned cart data	7 days
Data in Google Analytics	14 months
Cookies	as set out in the table in § 9

After these periods expire, we delete or anonymise the data.

§ 7. Your rights

On the terms set out in the GDPR, you have the right to:
1. access your data and receive a copy of it (Article 15 GDPR);
2. rectification (correction) of your data (Article 16 GDPR) – you can also change some of your data yourself in your account;
3. erasure of your data (Article 17 GDPR) – e.g. deletion of your account; however, we will not delete data that we are required to retain by law (e.g. invoices);
4. restriction of processing (Article 18 GDPR);
5. data portability (Article 20 GDPR) – with respect to data processed by automated means on the basis of a contract or consent;
6. object to processing (Article 21 GDPR) – to processing based on our legitimate interest (Article 6(1)(f) GDPR), on grounds relating to your particular situation;
7. withdraw your consent at any time – without affecting the lawfulness of processing carried out before its withdrawal;
8. lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) if you believe that we are processing your data unlawfully. If you live in another Member State of the European Union, you may also lodge a complaint with the supervisory authority in that country.
To exercise your rights, write to marco.ramirez@innermastering.com. We will respond without undue delay and in any event within one month (in particularly complex cases this period may be extended by a further two months – we will inform you of this). We may ask for information needed to confirm your identity.

§ 8. Voluntary provision of data and automated decision-making

Providing data is voluntary but necessary to place an order: without your first name, surname, e-mail address and country (and, for cards and printed books, also your delivery address and telephone number), we cannot conclude or perform the contract. Providing a company name and NIP is necessary only if you want to receive an invoice issued to a company. The provision of invoice data is required by tax law.
Providing a name for the ex libris and consenting to information about new releases and to analytics is entirely voluntary and does not affect your ability to make a purchase.
We do not make decisions about you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you. Payment operators may use their own automated payment fraud prevention mechanisms – on the terms described in their privacy policies.

§ 9. Cookies

Cookies are small text files saved on your device by your browser while you use the Store. We also use similar technologies (e.g. browser storage) – the rules described below apply to them in the same way.
We use two categories of cookies:
1. strictly necessary – without them the Store does not work properly (cart, order, login, payment security, remembering your chosen language and currency and your cookie decision). We store them without your consent, on the basis of Article 399 of the Electronic Communications Law Act;
2. analytics – used to compile statistics and determine the source of orders. We store them only after you have given your consent.
On your first visit to the Store, we display a banner in which you can choose “Accept” (consent to analytics cookies) or “Necessary only”. Until you give your consent, Google Analytics is not loaded and order source attribution is disabled.
You can change your decision at any time by clicking the “Cookie settings” link in the page footer. Withdrawing consent results in the deletion of analytics cookies. You can also delete cookies and block them from being stored in your browser settings – however, disabling strictly necessary cookies may prevent you from placing an order or logging in.
The Store’s cache (LiteSpeed Cache) serves only to speed up the website and does not process personal data.
When you order cards or printed books, the order form loads the pick-up point map from the servers of Alsendo sp. z o.o. (Apaczka.pl), and the base map from the servers of its providers. In doing so, your browser sends them your IP address and basic technical information needed to display the map. The map is necessary to select a parcel locker or pick-up point.
Cookies used in the Store:

Name	Provider	Purpose	Category	Retention period
woocommerce_cart_hash	Store (WooCommerce)	remembering the contents of the cart	strictly necessary	until the end of the browser session
woocommerce_items_in_cart	Store (WooCommerce)	information on whether there are products in the cart	strictly necessary	until the end of the browser session
wp_woocommerce_session_*	Store (WooCommerce)	handling the cart and order form session	strictly necessary	up to 2 days
wordpress_logged_in_*	Store (WordPress)	keeping you logged in to your account	strictly necessary	until the end of the session or, if you choose to stay logged in, up to 14 days
pll_language	Store (Polylang)	remembering the selected language version	strictly necessary (functional)	1 year
imp_cur	Store	remembering the currency you have selected	strictly necessary (functional)	180 days
imp_geo	Store	selecting the default currency (EUR or USD) in the English and Spanish versions based on your approximate location (whether you are in the euro area)	strictly necessary (functional)	180 days
aelia_cs_selected_currency	Store (Aelia Currency Switcher)	displaying prices and settling the order in the selected currency	strictly necessary (functional)	until the end of the browser session
__stripe_mid	Stripe	preventing payment fraud	strictly necessary	1 year
__stripe_sid	Stripe	preventing payment fraud	strictly necessary	30 minutes
imp_consent	Store	remembering your cookie decision	strictly necessary	180 days
_ga, _ga_<ID>	Google (Google Analytics 4)	visit statistics – distinguishing users and sessions	analytics (with consent)	up to 14 months
sbjs_*	Store (WooCommerce – order attribution)	determining how you reached the Store (e.g. a campaign, a search engine, a referral) and linking this information to your order	analytics (with consent)	from the end of the session up to 6 months

§ 10. Data security

We apply technical and organisational measures appropriate to the risk, in particular an encrypted connection (SSL/TLS), restricted access to data and storage of passwords in encrypted form.
We never ask for your account password by e-mail or by telephone. Protect your password and log out after using the Store on a shared device.

§ 11. Links to other websites

The Store may contain links to other websites (e.g. payment operators, carriers). These websites apply their own privacy rules – we encourage you to read them.

§ 12. Changes to this policy

We may update this policy, e.g. in the event of changes in the law, in the services we use or in the way the Store operates. The current version is always available in the Store.
This policy is effective from 12 October 2026 and replaces the privacy policy in force from 10 October 2026.