Last updated: 20 August 2026
In short
This website tells you about JollyHeap blocks. We collect personal data only when you write to us through a form, and we use analytics to see which pages people actually read. We never sell your data. You can ask us at any time for a copy of what we hold about you, or ask us to delete it — free of charge, answered within one month. Write to [email protected].
1. Who we are
The controller of your personal data is “JOLLY-HEAP” Svitlana Sapunova, Aleja Led 4, 55-020 Rzeplin, Poland, NIP 8992772832, REGON 362440030 — the company that makes JollyHeap blocks and runs this website.
Questions about your data: [email protected] or +48 575 935 005. We have not appointed a Data Protection Officer, so your message goes straight to the people who run the company.
Our online shop at shop.jollyheap.com is a separate website with its own privacy policy, because it also handles orders, payments and delivery.
2. What we collect and why
When you use our contact form
What we collect: your name, e-mail address, phone number if you give one, and the message itself.
Why: to answer you, and — if your question turns into an order or cooperation — to carry that conversation through.
Legal basis: our legitimate interest in replying to people who write to us — Art. 6(1)(f) GDPR; or steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR.
How long: up to 2 years after the conversation ends, and longer if the matter turns into a contract or a claim.
When you apply to become our distributor
What we collect: your name, e-mail address, company name, country, industry and what you tell us about your business.
Why: to assess whether we can work together and to get back to you with an offer.
Legal basis: steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR, and our legitimate interest in building a distribution network — Art. 6(1)(f) GDPR.
How long: up to 3 years from your enquiry, so that we can come back to you if the situation in your market changes.
Protection against spam
Our forms are protected by Cloudflare Turnstile, which checks that a form is being filled in by a person and not by a bot. For that check Cloudflare receives your IP address and basic information about your browser. Legal basis: our legitimate interest in keeping the site free of automated abuse — Art. 6(1)(f) GDPR. The provider is Cloudflare, Inc.; see the Cloudflare Privacy Policy.
3. Who we share your data with
We do not sell your data and we do not share it with anyone we have not named here.
- Hosting — OVH SAS (France), where this website and its database physically run, on our instructions.
- E-mail delivery — Google Ireland Limited, which delivers the messages this site sends (form notifications and our replies).
- Spam protection — Cloudflare, Inc., as described above.
- Analytics and session recording — Google and Microsoft, as described in section 5.
- Public authorities — where the law requires us to hand data over.
4. When your data leaves the European Economic Area
Some of the providers listed above process data outside the EEA, mainly in the United States — this concerns Google, Microsoft and Cloudflare. Those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Write to [email protected] and we will tell you which safeguard applies to which provider.
5. Cookies, analytics and session recording
Some cookies are needed for the site to work at all and to remember your language. Everything else — analytics and session recording — runs only after you agree in the cookie banner. You can review or change your choice at any time through the cookie settings button in the corner of every page, and refusing changes nothing about your ability to read the site.
Google Analytics 4 and Google Tag Manager
With your consent we use Google Analytics 4, loaded through Google Tag Manager, to understand how people find and read our pages so we can improve them. It collects the pages you view, events such as submitting a form or clicking our phone number, your approximate location, device and browser type, and where you came from. Google Analytics 4 does not log or store IP addresses. We keep this data for 14 months, after which it is deleted automatically. Google Tag Manager itself sets no cookies — it only loads the tools named in this policy. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as an independent controller. You can also install the Google Analytics Opt-out Browser Add-on.
Microsoft Clarity — session recording
With your consent we use Microsoft Clarity to see how our pages actually behave: it records interactions — mouse movements, clicks, scrolling and navigation — and replays them as anonymised recordings and heatmaps, which we use to find and fix usability problems. Anything you type into a form field is masked and never transmitted. Recordings are kept for 30 days, and a small sample for up to 9 months.
Microsoft is not acting on our instructions here: under the Microsoft Clarity terms, Microsoft and we are independent controllers, and Microsoft may use this data for its own purposes, including improving its products and advertising. See the Microsoft Privacy Statement.
Legal basis for both tools: your consent — Art. 6(1)(a) GDPR. You can withdraw it at any time in the cookie settings, without affecting what was processed before.
6. Profiling and automated decisions
We do not profile you and we do not take decisions about you based solely on automated processing. Analytics tells us how many people read a page — it does not build a profile of you as an individual for us.
7. How long we keep your data — summary
- Messages from the contact form — up to 2 years after the conversation ends.
- Distributor applications — up to 3 years from the enquiry.
- Anything that became a contract or a claim — until the limitation period expires.
- Analytics data (Google Analytics 4) — 14 months.
- Session recordings (Microsoft Clarity) — 30 days, a small sample up to 9 months.
8. Do you have to give us your data?
Nothing on this site is compulsory — you can read every page without giving us anything. If you want an answer from us, we need at least your e-mail address and your message; the rest of the fields only help us reply properly. In our forms, mandatory fields are marked; everything unmarked is voluntary.
9. How we protect your data
The site runs over an encrypted HTTPS connection. Access to the administration panel is limited to the few people who need it, each with their own account and two-factor authentication. Form submissions are protected against automated abuse.
10. Children
We make toys, but we address our website to grown-ups — parents, teachers, therapists and business partners. We do not knowingly collect personal information from children and we never use children’s data for advertising. If you are a parent or guardian and believe a child has sent us their details, write to [email protected] and we will delete them.
11. Your rights
You can ask us for a copy of the data we hold about you, ask us to correct it, delete it, restrict what we do with it, or send it to another company. Where we rely on your consent, you can withdraw it at any time in the cookie settings — withdrawing is as easy as giving it, and it does not make what we did before unlawful. All of this is free, and we answer within one month. Just write to [email protected].
You can object to direct marketing at any time. You have the right to object at any time to us processing your personal data for direct marketing. If you object, we stop immediately and you do not have to give a reason.
Where we rely on legitimate interest (Art. 6(1)(f) GDPR) — answering your messages, protecting the site from abuse, and establishing or defending legal claims — you can also object on grounds relating to your particular situation.
12. If you are not happy
Please tell us first — write to [email protected] and we will try to put it right. You also have the right to complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or to the supervisory authority of the EU country where you live, where you work, or where you think the problem happened.
13. Changes to this policy
If we start using your data for a purpose that is not described here, we will tell you about it before we start. We update this page whenever the site changes — for example when we add a new tool — and the date at the top always shows the current version.
14. Languages
This policy is available in English, Polish, German and French. In case of any discrepancy, the Polish version prevails.