Ecom house logo

Privacy and Cookie Policy of ecom.house

Version: 1.0 · Effective from: 25 September 2026

§ 1. General provisions

  1. This Privacy and Cookie Policy (the "Policy") explains how we process the personal data of people who visit the ecom.house website (the "Website") and contact us through it, and how we use cookies and similar technologies.
  2. The Website is aimed mainly at businesses. The data you give us usually relates to you as a person who represents or works for a company.
  3. Abbreviations used in this Policy:
    1. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation);
    2. PKE - the Polish Electronic Communications Law of 12 July 2024 (Journal of Laws of 2024, item 1221);
    3. UŚUDE - the Polish Act of 18 July 2002 on the provision of electronic services;
    4. EEA - the European Economic Area.

§ 2. Data controller

  1. The controller of your personal data is Ecomhouse spółka z ograniczoną odpowiedzialnością, registered office in Warsaw (address: ul. Jasna 1/414, 00-013 Warsaw, Poland), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0000696799, tax ID (NIP) 7010720998, share capital PLN 10,000.00, owner of the ecom.house brand ("Ecomhouse" or "we").
  2. For anything related to your personal data, write to [email protected] or send a letter to our registered office.
  3. We have not appointed a data protection officer. We are not required to, because our core activities do not consist of regular and systematic monitoring of people on a large scale or of processing special categories of data on a large scale (Article 37 GDPR).

§ 3. Purposes, legal bases and scope of processing

  1. Replying to messages sent through the contact form and to questions asked in our guides. We process your email address, phone number (if you give it), the message, the address of the page the form was sent from and the page language. The legal basis is our legitimate interest in answering enquiries and holding business talks (Article 6(1)(f) GDPR) and, where you ask about entering into a contract with you, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Giving your data is voluntary, but we cannot reply without an email address.
  2. Scheduling and holding a consultation. When you book a slot, we process your name, email address and, if you give them, your phone number, company name and message, as well as the chosen date and time. We create a Google Calendar event with a Google Meet link and send the invitation and a confirmation to your email address. The legal basis is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, where you book on behalf of a company, our legitimate interest in holding business talks (Article 6(1)(f) GDPR). Your name and email address are required to book.
  3. Source of the enquiry. With a booking we save information about the source of the visit: the Google ad click identifier (gclid), campaign parameters (UTM) and the landing page address. The legal basis is our legitimate interest in assessing which channels and campaigns bring enquiries (Article 6(1)(f) GDPR). We do not pass this data to advertising providers.
  4. Recording your cookie choices (consent log). We record a random consent identifier (also stored in the cc_cookie cookie), the banner version, the language, your decision, the categories you chose and the date. We do not record your IP address. The legal basis is our obligation to demonstrate that consent was given (Article 6(1)(c) in connection with Article 7(1) GDPR).
  5. Statistics and improving the Website - only with your consent. If you consent to the "Analytics" category, we use Google Analytics 4 (Google) and Microsoft Clarity (Microsoft). These tools process identifiers stored in cookies, information about your device and browser, approximate location derived from your IP address, the pages you visit, how you arrived and your interactions with the page (clicks, scrolling, cursor movements), from which Microsoft Clarity builds heatmaps and session replays. The legal basis is your consent (Article 6(1)(a) GDPR and Article 399(1) PKE).
  6. Advertising and measuring its performance - only with your consent. If you consent to the "Marketing" category, we use Google Ads (Google) and Microsoft Advertising (Microsoft) to measure how our ads perform, to show them to people who visited the Website (remarketing) and to tailor them to you. This involves identifiers stored in cookies, ad click identifiers (gclid, msclkid), the pages you visit and whether you sent a form or made a booking. After you send a form or make a booking, we also pass on, as a hash (SHA-256): to Google - your email address, phone number and, for a booking, your first and last name; to Microsoft - your email address and phone number. This lets us match the enquiry to the ad more accurately. The legal basis is your consent (Article 6(1)(a) GDPR and Article 399(1) PKE).
  7. Measurement without cookies. If you do not consent, the Google and Microsoft Advertising tags run in a limited mode: they do not store or read cookies and do not pass advertising identifiers. They send Google and Microsoft your consent status, the address of the page you visit, the time, your browser and device type, your IP address (needed for the connection) and, if the visit started from an ad, the ad click identifier from the page address. Google and Microsoft use this data for aggregated, statistical measurement of traffic and ad performance, without recognising you on later visits. The legal basis is our legitimate interest in aggregated measurement of the Website and our campaigns (Article 6(1)(f) GDPR). You can object (§ 7(1)(6)).
  8. Security and operation of the Website. Our servers log the IP address, date and time, requested page, browser details and response code. We also keep the IP address briefly in a cache to limit how many forms can be sent and to protect them from abuse. The legal basis is our legitimate interest in keeping the Website secure and running (Article 6(1)(f) GDPR).
  9. Establishing, pursuing and defending claims. We may process the data described above where needed to establish, pursue or defend legal claims. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).
  10. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Article 22 GDPR). Ad tailoring described in paragraph 6 happens with your consent and has no such effects.

§ 4. Recipients of data

  1. Your data may be received by:
    1. OVHcloud - provider of the servers that run the Website and its back end;
    2. Cloudflare, Inc. (USA) - provider of DNS, content delivery and protection of the Website against attacks;
    3. Google Ireland Limited (Ireland) and Google LLC (USA) - for Google Workspace (email, Google Calendar and Google Meet when handling enquiries and bookings) and, with your consent, Google Analytics 4 and Google Ads;
    4. Vercom S.A. (Poznań, Poland) - operator of the EmailLabs service we use to send booking confirmations and form notifications;
    5. Microsoft Ireland Operations Limited (Ireland) and Microsoft Corporation (USA) - with your consent, for Microsoft Advertising and Microsoft Clarity;
    6. providers of IT, legal, accounting and advisory services to us - to the extent needed for those services, under data processing agreements (Article 28 GDPR);
    7. public authorities and other bodies entitled under the law - to the extent the law requires.
  2. For advertising (§ 3(6)), Google and Microsoft also process data as separate controllers, under their own terms. These are described by Google in How Google uses information from sites that use its services and Google Business Data Responsibility, and by Microsoft in the Microsoft Privacy Statement.

§ 5. Transfers outside the EEA

  1. Using the services of Google LLC, Microsoft Corporation and Cloudflare, Inc. may involve transferring your data to the United States.
  2. Transfers are made with the safeguards required by Chapter V GDPR, in particular:
    1. Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework - for organisations certified under it; you can check their current status at dataprivacyframework.gov/list;
    2. the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 - where the recipient is not covered by an adequacy decision or certification.
  3. To get a copy of these safeguards or learn where they are available, write to [email protected].
  4. If the EU-US Data Privacy Framework decision is annulled or changed, we will promptly put another transfer mechanism in place, in particular the standard contractual clauses.

§ 6. How long we keep data

  1. We keep data for as long as needed for the purpose for which we collected it, and then for the period required by law or until claims become time-barred. In particular:
    1. data from the contact form, questions in guides and bookings, including correspondence and the calendar event - for 3 years from the last contact in the matter (the limitation period for business claims, Article 118 of the Polish Civil Code); if we enter into a contract, the data becomes part of the records of that contract and is kept under the rules that apply to it;
    2. the consent log - for 1,461 days from the recorded decision (365 days of consent validity plus 3 years to demonstrate it was given);
    3. the cc_cookie cookie with your choice - 365 days; after that the banner asks again;
    4. data processed on the basis of consent (§ 3(5) and (6)) - until you withdraw consent, and in cookies for no longer than the periods listed in § 8; data collected in Google Analytics 4 - for 14 months; data in Microsoft Clarity - for the period Microsoft sets for that service;
    5. server logs - for no longer than 30 days, and the IP address in the cache - for no longer than 1 hour;
    6. data needed for claims - until they become time-barred.

§ 7. Your rights

  1. In relation to the processing of your data, you have the right to:
    1. access your data and receive a copy (Article 15 GDPR);
    2. have your data corrected or completed (Article 16 GDPR);
    3. have your data erased (Article 17 GDPR), in particular where it is no longer needed for the purposes for which we collected it, where you withdraw consent and there is no other legal basis, or where you successfully object;
    4. restrict processing (Article 18 GDPR), in particular while the accuracy of your data is being checked after you contest it;
    5. data portability for data you gave us, where we process it on the basis of consent or a contract by automated means (Article 20 GDPR);
    6. object to processing based on our legitimate interest, on grounds relating to your particular situation (Article 21(1) GDPR);
    7. withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; you withdraw cookie consent with the "Your consents" button in the Website footer;
    8. lodge a complaint with the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) if you believe we process your data unlawfully.
  2. To exercise your rights, write to [email protected]. We reply without undue delay and within one month at the latest. For complex requests or a large number of requests, this may be extended by two further months - we will let you know if so.

§ 8. Cookies and similar technologies

  1. Cookies are small text files that your browser stores on your device. Browser storage (localStorage and sessionStorage) and scripts that read information from your device and send it to providers' servers work in a similar way. Below, we call all of these "cookies".
  2. We use cookies needed for the Website to work without your consent (Article 399(3)(2) PKE). We use all other cookies only with your prior consent (Article 399(1) PKE in connection with Article 6(1)(a) GDPR).
  3. Cookies fall into these categories:
    1. Necessary - remember your cookie choice and keep the Website working. Always on.
    2. Analytics - Google Analytics 4 and Microsoft Clarity (§ 3(5)). Only with consent.
    3. Marketing - Google Ads and Microsoft Advertising, including ad personalisation (§ 3(6)). Only with consent.
  4. On your first visit, the cookie banner lets you accept all categories, reject all, or choose them in the settings. The accept and reject buttons are equally prominent. We remember your choice for 365 days. If we change the banner text or the scope of the categories, we will ask again.
  5. You can change or withdraw your choice at any time with the "Your consents" button in the Website footer. When you withdraw consent, we delete our analytics and marketing cookies stored on the ecom.house domain and reload the page. You can delete cookies stored on Google and Microsoft domains in your browser settings. After you withdraw consent, the Google and Microsoft Advertising tags run in the cookieless mode described in § 3(7), and Microsoft Clarity is not loaded.
  6. We use Google Consent Mode v2 and Microsoft Advertising consent mode. Until you decide, all consent signals are set to "denied".
  7. The list of cookies used on the Website is generated automatically from a scan of the Website. The scan date is shown above the list.

As of 2026-09-25 (scan of ecom.house).

Necessary

Name Provider Purpose Domain Lifetime
cc_cookie ecom.house Remembers your cookie choice and the consent ID ecom.house 12 months

Analytics

Name Provider Purpose Domain Lifetime
_clck Microsoft Clarity Keeps the Clarity user ID and settings ecom.house 12 months
_clsk Microsoft Clarity Links page views into one Clarity session ecom.house 24 h
_ga Google Analytics Distinguishes users in statistics ecom.house 13 months
_ga_KCN6MX1GNQ Google Analytics Keeps the session state in statistics ecom.house 13 months
ANONCHK Microsoft Clarity Tells whether the MUID ID was passed to the Microsoft advertising ID c.clarity.ms 10 min
MR Microsoft Clarity Tells whether to refresh the MUID ID c.clarity.ms 7 days
MUID Microsoft Clarity Browser ID used by Microsoft services clarity.ms 13 months
SM Microsoft Clarity Syncs the MUID ID across Microsoft domains c.clarity.ms session

Marketing

Name Provider Purpose Domain Lifetime
_gcl_au Google Ads Measures ad conversions ecom.house 3 months
_gcl_aw Google Ads Stores the Google ad click ID (gclid) ecom.house 3 months
_uetmsclkid Microsoft Advertising Stores the Microsoft ad click ID (msclkid) ecom.house 3 months
_uetsid Microsoft Advertising Session ID for conversion measurement ecom.house 24 h
_uetvid Microsoft Advertising Visitor ID for conversion measurement and remarketing ecom.house 13 months
GCL_AW_P Google Ads Stores the ad click ID for conversion measurement doubleclick.net 3 months
GCL_AW_P Google Ads Stores the ad click ID for conversion measurement google.com 3 months
GCL_AW_P Google Ads Stores the ad click ID for conversion measurement googleadservices.com 3 months
IDE Google Ads Serves and tailors Google ads and measures their performance doubleclick.net 13 months
MR Microsoft Advertising Tells whether to refresh the MUID ID c.bing.com 7 days
MUID Microsoft Advertising Browser ID used by Microsoft advertising services bing.com 13 months
SRM_B Microsoft Advertising User ID used by Microsoft advertising services c.bing.com 13 months

Browser storage

Key Provider Purpose Category Type
_cltk Microsoft Clarity Clarity session data Analytics sessionStorage
_gcl_ls Google Ads Copy of ad click IDs for conversion measurement Marketing localStorage
_uetmsclkid Microsoft Advertising Copy of the session, visitor and click IDs and their expiry dates Marketing localStorage
_uetmsclkid_exp Microsoft Advertising Copy of the session, visitor and click IDs and their expiry dates Marketing localStorage
_uetsid Microsoft Advertising Copy of the session, visitor and click IDs and their expiry dates Marketing localStorage
_uetsid_exp Microsoft Advertising Copy of the session, visitor and click IDs and their expiry dates Marketing localStorage
_uetvid Microsoft Advertising Copy of the session, visitor and click IDs and their expiry dates Marketing localStorage
_uetvid_exp Microsoft Advertising Copy of the session, visitor and click IDs and their expiry dates Marketing localStorage
cc_banner_en ecom.house Copy of the cookie banner texts for the session Necessary sessionStorage
cc_banner_pl ecom.house Copy of the cookie banner texts for the session Necessary sessionStorage
  1. You can also block and delete cookies in your browser settings. Instructions: Google Chrome, Mozilla Firefox, Microsoft Edge, Safari. If you block necessary cookies, the banner will appear on every visit.

§ 9. Information required by UŚUDE

  1. Using electronic services involves typical risks, such as interception of data sent over the network, malware, phishing and unsolicited messages (spam). The Website sends data only over an encrypted connection (HTTPS).
  2. The tools described in § 8 may place data (cookies) and software (scripts) on your device. Their functions and purposes are described in § 3 and § 8.

§ 10. Changes to this Policy

  1. This Policy may change when the law, the tools used on the Website, or the purposes or scope of processing change.
  2. We publish the current version on the Website with its version number and effective date. If a change affects the scope of cookie consents, the banner will ask you again.

§ 11. Effective date

This Policy is effective from 25 September 2026 and replaces the previous privacy policy and cookie policy of the ecom.house website.