Privacy notice

Controller

NOVA GROUP SP. Z O.O., Żurawia 6/12, lok. 745, 00-503 Warsaw, Poland; KRS 0001117840; NIP 7011215529; REGON 529224431; VAT ID PL7011215529.

Contact: hello@terraoils.eu

Data and purposes

• Order, contact, delivery, payment-status, return, and correspondence data to perform the contract and provide customer care.
• Accounting and transaction evidence to meet legal obligations.
• Security records where necessary for legitimate interests.
• Analytics events only after consent.

Recipients

Data may be shared as necessary with Stripe, fulfilment and delivery partners, email, hosting and database processors, advisers, and authorities where legally required. Each receives only what is needed for its role.

Retention

Order and accounting records are retained for statutory periods. Messages and operational logs are kept only as long as needed for support, claims, security, and legal obligations.

Rights

Depending on the legal basis, individuals may request access, correction, deletion, restriction, portability, or object; consent may be withdrawn. Complaints may be made to the President of the Polish Personal Data Protection Office (UODO).

International processing

Some processors may handle data outside the EEA using an applicable transfer mechanism and safeguards. Provider details are available on request.

Newsletter and welcome offer

I agree to receive TerraOils news and offers by email. I can unsubscribe at any time. Confirm that you no longer want TerraOils news and offers.

Resend — Newsletter email.

• Newsletter preferences
• Confirm that you no longer want TerraOils news and offers.

Marketing

Allows Google Ads purchase measurement in your browser and on our server using advertising click IDs, purchase value and a transaction ID. No email or phone is uploaded. Click IDs are encrypted and deleted after 30 days or withdrawal; processing receipts are kept for 365 days.

PostHog analytics and session replay

Only after the Analytics category is selected, we use PostHog Cloud EU for product analytics and masked recordings of the public shopping journey. PostHog stores the native client IP address. Analytics events are retained for up to 365 days and session recordings for up to 30 days.

Form fields are masked, and account, checkout, order, return, contact, advisor and administration areas are excluded from recording. Consent can be withdrawn at any time through Privacy choices in the footer; withdrawal stops capture and clears local PostHog identifiers.

Google Ads campaign measurement

Only after the Marketing category is selected may we load the Google Ads tag to attribute a verified purchase to an advertising campaign. Advertising storage, advertising user data and ad personalization are denied by default. We do not send an email address, name or delivery address; the conversion contains currency, order value and an opaque transaction identifier.

Marketing consent can be withdrawn at any time through Privacy choices. Withdrawal blocks further advertising measurement and clears available local campaign identifiers.