Privacy Policy
Last updated: 16 September 2026
In short
This website tells you about JollyHeap blocks. We collect personal data only when you write to us through a form, and we use analytics to see which pages people actually read. We never sell your data. You can ask us at any time for a copy of what we hold about you, or ask us to delete it — free of charge, answered within one month. Write to [email protected].
1. Who we are
This website is run by “JOLLY-HEAP” Svitlana Sapunova, Aleja Led 4, 55-020 Rzeplin, Poland, NIP 8992772832, REGON 362440030 — the company that makes JollyHeap blocks. It is the controller of the data the website itself collects (cookies, analytics and spam protection). What you send us through a form on this website — the contact form or the distributor form — is processed jointly by both JollyHeap companies as joint controllers; see “When you leave your details in a form — joint controllers” below.
Questions about your data: [email protected] or +48 575 935 005. We have not appointed a Data Protection Officer, so your message goes straight to the people who run the company.
Our online shop at shop.jollyheap.com is a separate website with its own privacy policy, because it also handles orders, payments and delivery.
2. What we collect and why
When you use our contact form
Who: both JollyHeap companies as joint controllers — see “When you leave your details in a form” below.
What we collect: your name, e-mail address, phone number if you give one, and the message itself.
Why: to answer you, and — if your question turns into an order or cooperation — to carry that conversation through.
Legal basis: our legitimate interest in replying to people who write to us — Art. 6(1)(f) GDPR; or steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR.
How long: up to 2 years from our last contact, and longer only if the matter turns into a contract or a claim.
When you apply to become our distributor
Who: both JollyHeap companies as joint controllers — see “When you leave your details in a form” below.
What we collect: your name, e-mail address, company name, country, industry and what you tell us about your business.
Why: to assess whether we can work together and to get back to you with an offer.
Legal basis: steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR, and our legitimate interest in building a distribution network — Art. 6(1)(f) GDPR.
How long: up to 2 years from our last contact, and longer only if the matter turns into a contract or a claim.
Protection against spam
Our forms are protected by Cloudflare Turnstile, which checks that a form is being filled in by a person and not by a bot. For that check Cloudflare receives your IP address and basic information about your browser. Legal basis: our legitimate interest in keeping the site free of automated abuse — Art. 6(1)(f) GDPR. The provider is Cloudflare, Inc.; see the Cloudflare Privacy Policy.
When you leave your details in a form — joint controllers
From 14 September 2026, the details you leave in a campaign form (for example jollyheap.com/numo/) or in a stand form at a trade fair or conference, and from 16 September 2026 also in the contact form or the distributor form on this website, together with the marketing consents given in those forms, are processed jointly by the two JollyHeap companies as joint controllers (Art. 26 GDPR):
- JOLLYHEAP Sp. z o.o., Aleja LED 6, 55-020 Rzeplin, Poland, VAT ID PL8992792065, KRS 0000622029 — distributor of JollyHeap blocks;
- “JOLLY-HEAP” Svitlana Sapunova, Aleja Led 4, 55-020 Rzeplin, Poland, VAT ID PL8992772832 — manufacturer of JollyHeap blocks.
What we collect: name, e-mail address, phone number, name and address of your institution or company, country, industry, job title, your message, and your consent decisions (what you ticked, when, and from which IP address).
Why and on what basis: to answer your enquiry and, for distributor applications, to assess a possible cooperation (Art. 6(1)(b) and (f) GDPR) and, if you tick the consent for e-mail, phone or SMS, to send you offers and information about JollyHeap blocks through that channel (Art. 6(1)(a) GDPR). Each channel is a separate, voluntary consent; we answer your enquiry either way.
The essence of our arrangement (Art. 26(2) GDPR):
- a joint contact point for data matters: [email protected]; you may also write to either company separately;
- we fulfil the information duty jointly — through the notice at the form and this policy;
- the system in which the data is stored (CRM), its security and the handling of your requests (access, rectification, erasure, restriction, portability, objection) are run by JOLLYHEAP Sp. z o.o.; we reply within one month;
- a consent given in the form covers both companies — either may send you an offer, and every message contains an unsubscribe link;
- a withdrawal of consent, an objection or an erasure request made to one company is effective for both — the data sits in one shared database and the block applies immediately;
- you may exercise your rights against either company, regardless of which one contacted you;
- a personal data breach is notified to the supervisory authority and to you by JOLLYHEAP Sp. z o.o. on behalf of both companies.
How long: enquiries up to 2 years from our last contact, and longer only if the matter turns into a contract or a claim; marketing data until you withdraw consent; the proof of consent and of its withdrawal additionally for the limitation period for claims.
The joint controller agreement is available on request. Consents given under earlier versions of the wording, which named a single company, cover only that company. Messages sent through the contact form or the distributor form before 16 September 2026 stay with the controller named in the notice in force at the time.
3. Who we share your data with
We do not sell your data and we do not share it with anyone we have not named here.
- Hosting — OVH SAS (France), where this website and its database physically run, on our instructions.
- E-mail delivery — Google Ireland Limited, which delivers the messages this site sends (form notifications and our replies).
- Spam protection — Cloudflare, Inc., as described above.
- Analytics and session recording — Google and Microsoft, as described in section 5.
- Public authorities — where the law requires us to hand data over.
4. When your data leaves the European Economic Area
Some of the providers listed above process data outside the EEA, mainly in the United States — this concerns Google, Microsoft and Cloudflare. Those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses under Art. 46(2)(c) GDPR. Write to [email protected] and we will tell you which safeguard applies to which provider.
5. Cookies, analytics and session recording
Some cookies are needed for the site to work at all and to remember your language. Everything else — analytics and session recording — runs only after you agree in the cookie banner. You can review or change your choice at any time through the cookie settings button in the corner of every page, and refusing changes nothing about your ability to read the site.
Google Analytics 4 and Google Tag Manager
With your consent we use Google Analytics 4, loaded through Google Tag Manager, to understand how people find and read our pages so we can improve them. It collects the pages you view, events such as submitting a form or clicking our phone number, your approximate location, device and browser type, and where you came from. Google Analytics 4 does not log or store IP addresses. We keep this data for 14 months, after which it is deleted automatically. Google Tag Manager itself sets no cookies — it only loads the tools named in this policy. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as an independent controller. You can also install the Google Analytics Opt-out Browser Add-on.
Microsoft Clarity — session recording
With your consent we use Microsoft Clarity to see how our pages actually behave: it records interactions — mouse movements, clicks, scrolling and navigation — and replays them as anonymised recordings and heatmaps, which we use to find and fix usability problems. Anything you type into a form field is masked and never transmitted. Recordings are kept for 30 days, and a small sample for up to 9 months.
Microsoft is not acting on our instructions here: under the Microsoft Clarity terms, Microsoft and we are independent controllers, and Microsoft may use this data for its own purposes, including improving its products and advertising. See the Microsoft Privacy Statement.
Legal basis for both tools: your consent — Art. 6(1)(a) GDPR. You can withdraw it at any time in the cookie settings, without affecting what was processed before.
6. Profiling and automated decisions
We do not profile you and we do not take decisions about you based solely on automated processing. Analytics tells us how many people read a page — it does not build a profile of you as an individual for us.
7. How long we keep your data — summary
- Messages from the contact form and distributor applications — up to 2 years from our last contact.
- Anything that became a contract or a claim — until the limitation period expires.
- Analytics data (Google Analytics 4) — 14 months.
- Session recordings (Microsoft Clarity) — 30 days, a small sample up to 9 months.
- Marketing data from campaign and stand forms — until you withdraw consent.
- Proof of consent and of its withdrawal — 6 years from the end of the year in which consent was withdrawn.
8. Do you have to give us your data?
Nothing on this site is compulsory — you can read every page without giving us anything. If you want an answer from us, we need at least your e-mail address and your message; the rest of the fields only help us reply properly. In our forms, mandatory fields are marked; everything unmarked is voluntary.
9. How we protect your data
The site runs over an encrypted HTTPS connection. Access to the administration panel is limited to the few people who need it, each with their own account and two-factor authentication. Form submissions are protected against automated abuse.
10. Children
We make toys, but we address our website to grown-ups — parents, teachers, therapists and business partners. We do not knowingly collect personal information from children and we never use children’s data for advertising. If you are a parent or guardian and believe a child has sent us their details, write to [email protected] and we will delete them.
11. Your rights
You can ask us for a copy of the data we hold about you, ask us to correct it, delete it, restrict what we do with it, or send it to another company. Where we rely on your consent, you can withdraw it at any time in the cookie settings — withdrawing is as easy as giving it, and it does not make what we did before unlawful. All of this is free, and we answer within one month. Just write to [email protected].
You can object to direct marketing at any time. You have the right to object at any time to us processing your personal data for direct marketing. If you object, we stop immediately and you do not have to give a reason.
Where we rely on legitimate interest (Art. 6(1)(f) GDPR) — answering your messages, protecting the site from abuse, and establishing or defending legal claims — you can also object on grounds relating to your particular situation.
12. If you are not happy
Please tell us first — write to [email protected] and we will try to put it right. You also have the right to complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or to the supervisory authority of the EU country where you live, where you work, or where you think the problem happened.
13. Changes to this policy
If we start using your data for a purpose that is not described here, we will tell you about it before we start. We update this page whenever the site changes — for example when we add a new tool — and the date at the top always shows the current version.
14. Languages
This policy is available in English, Polish, German, French, Spanish, Italian, Czech, Dutch, Danish, Romanian, Hungarian and Croatian. In case of any discrepancy, the Polish version prevails.