This Privacy Policy explains how we process the personal data of persons using the website at shinewithcaroline333.com, signing up for free materials or the newsletter, purchasing courses, products, or services, contacting us, and using the content and offerings of the Shine with Caroline brand.We care about our users’ privacy and process personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the GDPR).
The controller of your personal data is:
Full legal name: EPI2
Brand: Shine with Caroline
Registered address: Stalowa 17/19/apt. 3, 03-425, Warsaw, Poland
Tax ID (NIP): 5221360099
Email: hello.shinewithcaroline@gmail.com
For matters relating to personal data, please contact us at: hello.shinewithcaroline@gmail.com
The supervisory authority with jurisdiction over the Controller is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.
For the purposes of this Privacy Policy, the following terms have the meanings set out below:
Data you provide voluntarily:
We process personal data only where there is a specific, documented legal basis under the GDPR. The table below sets out all processing purposes, the scope of data, the legal bases, and the retention periods.
Purpose of Processing
Scope of
Data
Legal Basis
(GDPR)
Retention
Period
Handling inquiries (contact form, email)
Handling inquiries (contact form, email)
First name, email, message content
Art. 6(1)(b) — pre-contractual measures, or Art. 6(1)(f) — legitimate interest
Newsletter / free materials sign-up
First name, email
Art. 6(1)(a) — consent
Until consent is withdrawn or unsubscribe
Sale of digital courses, products, sessions
First name, email, address, order data
Art. 6(1)(b) — contract performance
For the contract term + limitation period (up to 6 years)
Issuing invoices / tax records
Billing data, VAT No., address
Art. 6(1)(c) — legal obligation
5 years from end of tax year
Course access / user account
Email, login, order data
Art. 6(1)(b) — contract performance
For the access period + claims protection
Delivering individual services, incl. 1:1 Face Analysis (form analysis, photographs, materials, preparation of recommendations and plan)
First name, email, order data, preparatory form, photographs or materials submitted for analysis, service-preparation notes
Art. 6(1)(b) — contract performance; Art. 6(1)(f) — legitimate interest (claims protection); for health or special category data: Art. 9(2)(a) — explicit consent
For the service period + claims protection period; special category data only for as long as necessary for the purpose
Documenting consents and checkboxes (digital courses, 1:1 Face Analysis, acceptance of T&Cs)
First name, email, order number, name of course or service, checkbox content, date and time of checking, IP address
Art. 6(1)(b) — contract performance; Art. 6(1)(f) — legitimate interest (demonstrating valid consent, defense against claims)
For the contract period + limitation period or as required by law
Publishing reviews, testimonials, photographs
First name, content, photograph, image
Art. 6(1)(a) — separate consent
Until consent for future use is withdrawn or effective erasure request
Site analytics and statistics
IP, device data, site activity
Art. 6(1)(a) — consent (cookie banner), or Art. 6(1)(f) — legitimate interest for anonymized data
In accordance with tool settings (typically 12–26 months)
Marketing and remarketing (Meta Pixel, Google Ads, TikTok Pixel)
IP, cookie identifiers, activity
Art. 6(1)(a) — consent (cookie banner)
In accordance with advertising tool settings
Site security / server logs
IP, browser type, request timestamps
Art. 6(1)(f) — legitimate interest (system security)
Up to 12 months
We do not sell personal data to third parties.
You may sign up for our newsletter or download free materials, such as the Free Starter Kit, by providing your first name and email address. Sign-up is voluntary.The legal basis for processing data for the newsletter and free materials is your consent — Article 6(1)(a) GDPR.
Where the newsletter or email communications include marketing content, commercial information, offers, promotions, or invitations to purchase products or services, they will only be sent on the basis of the User’s prior consent to receiving such communications electronically, in accordance with applicable electronic communications law.
You may withdraw your consent at any time by:
- clicking the unsubscribe link in the footer of any email we send,
- contacting us at: hello.shinewithcaroline@gmail.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Examples of content we may send:
- educational materials on face yoga, natural beauty, facial tension work, body work, posture, breathing, wellness, meditation, self-development, spiritual content, and The Shine Method,
- information about courses, workshops, products, and services,
- inspiration relating to natural beauty, self-development, and inside-out beauty,
- special offers, promotions, and program invitations.
Where you purchase a digital course, physical product, 1:1 session, workshop, or any other service, we process the data necessary to fulfill the order, process the payment, grant access to the content, and meet our accounting and tax obligations.
Payments may be processed by third-party providers such as Stripe, PayPal, PayU, or Przelewy24. Payment data (including card numbers) is processed directly by the chosen payment operator in accordance with its own security and privacy policies. We do not store full payment card details.
Shine with Caroline is an educational, wellness, self-development, spiritual, body-work, and natural beauty brand. The content available on the site does not constitute medical, psychological, psychotherapeutic, psychiatric, or physiotherapy advice, diagnosis, or treatment.We do not ask you to send medical records or detailed health data through standard contact forms or by email. If, in the context of a specific service — in particular a 1:1 Face Analysis, individual session, workshop, wellness practice, meditation, breathing practice, spiritual practice, or body-work session — it becomes necessary to share information about health, contraindications, pregnancy, previous procedures, well-being, emotional difficulties, a history of trauma, or other particular circumstances, we will notify you separately and ask for your explicit, informed consent to the processing of such data, in accordance with Article 9(2)(a) GDPR.
Health data constitutes a special category of personal data and is processed only to the extent necessary for the safe organization and delivery of the service, with appropriate safeguards in place.Through Spiritual / Wellness / Body-Work Content, belief and subconscious work, or spiritual development content, a User may voluntarily share information that could reveal their philosophical, spiritual, or other specially protected beliefs within the meaning of Article 9 GDPR. Such data, if provided, is processed only to the extent necessary for the delivery of the relevant service or communication with the User, on the basis of the User’s explicit consent in accordance with Article 9(2)(a) GDPR, with appropriate safeguards in place.
We may publish reviews, testimonials, photographs, recordings, or results only where we have received your separate, explicit consent after you have voluntarily provided the materials.
Consent may cover: first name, review content, photograph, recording, image, description of results, social media profile tag.
You may withdraw consent to the future use of your review or image by contacting us at: hello.shinewithcaroline@gmail.com.
Withdrawal of consent does not affect the lawfulness of the use of materials prior to the withdrawal. After receiving notice of withdrawal, we will not use the materials in any new publications or new marketing activities. In relation to content published previously, we will take reasonable steps to remove it from channels within our control, where technically possible and required by applicable law. We are not responsible for copies, screenshots, shares, or further distribution of materials by third parties made before the withdrawal of consent.
We may use the services of third-party providers supporting the operation of the site, sales, marketing, and customer service. These may include in particular:
- hosting and site infrastructure provider,
- course platform (e.g., Kajabi or another),
- email marketing system provider (e.g., MailerLite, Klaviyo, or ConvertKit),
- payment operator (e.g., Stripe, PayPal, PayU, or Przelewy24),
- appointment booking system (e.g., Calendly or another),
- accounting system or accounting firm,
- analytics providers: Google Analytics,
- advertising tool providers: Meta Pixel, Google Ads, TikTok Pixel,
- heatmap tools, e.g., Microsoft Clarity or Hotjar,
- customer service tool providers,
- law firms or advisors, where necessary for the protection of rights.
Each processor acting on our behalf does so on the basis of a data processing agreement and is required to protect data in accordance with the GDPR.
Some of the tools we may use involve transfers of data outside the European Economic Area, in particular to the United States.:
Where such a transfer takes place, we apply the safeguarding mechanisms required by law, such as adequacy decisions (e.g., the EU–US Data Privacy Framework), standard contractual clauses approved by the European Commission, or other bases provided for in Article 46 GDPR.
If you would like more information about the safeguards applicable to a specific tool, please contact us at: hello.shinewithcaroline@gmail.com.
We apply appropriate organizational and technical measures to protect personal data against loss, unauthorized access, alteration, disclosure, or destruction, including in particular:
- encrypted HTTPS/TLS connections on the website,
- storage of data backups on secured servers with restricted access,
- use of trusted, GDPR-compliant service providers for payments, email, and course platforms,
- access to data restricted to persons and entities that need it for specified purposes.
In the event of a personal data breach that may result in a high risk to the rights and freedoms of natural persons, we will notify you and report the incident to the President of the UODO in accordance with the requirements of Articles 33–34 GDPR.
As a data subject, you have the following rights:
- Right of access — you may request information about what data we process and receive a copy of it.,
- Right to rectification — you may request correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) — you may request erasure of data where it is no longer necessary, or where you withdraw consent, provided no other legal basis for processing exists.
- Right to restriction of processing — you may request that we restrict the use of your data in certain situations.
- Right to data portability — where processing is carried out on the basis of consent or a contract by automated means, you may receive your data in a structured, commonly used format.
- Right to object — you may object to processing based on legitimate interest. You have an absolute right to object to direct marketing at any time.
- Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint — you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.
To exercise your rights, please contact us at: hello.shinewithcaroline@gmail.com. We will respond to your request as a rule within one month of receipt. This period may be extended by a further two months where necessary due to the complexity or number of requests, in which case we will inform you within one month of receipt of the request, stating the reasons for the delay, in accordance with Article 12(3) GDPR.
Our site may use cookies and similar technologies. Cookies may be used in particular for:
- the proper functioning of the site,
- remembering user settings,
- site statistics and analytics,
- measuring the effectiveness of marketing campaigns,
- remarketing and personalization of ads,
- embedding content from external platforms, e.g., YouTube or the course platform.
Purpose of Processing
Scope of Data
Essential
Required for the site to function and for basic features to work. Operate without consent.
Analytics
Help us understand how users interact with the site. Require consent.
Marketing
Used for ad measurement, remarketing, and personalized communications. Require consent.
Functional
Enable additional features, e.g., embedded external content. Require consent.
Essential cookies may operate without consent, as they are necessary for the site to function. Analytics, marketing, and functional cookies are only activated after the User gives consent via the cookie banner.You may manage cookie preferences through the cookie banner on the site or by changing your browser settings. Disabling certain cookies may affect the functionality of the site.
The site stores server logs (IP addresses, request timestamps, system errors, browser information). Logs are retained for administrative and security purposes, and access to them is restricted to authorized persons. The standard log retention period is up to 12 months.
We may use analytics and advertising tools such as:
- Google Analytics,
- Google Ads,
- Meta Pixel,
- TikTok Pixel,
- heatmap tools, e.g., Microsoft Clarity or Hotjar.
These tools help us analyze site performance, measure the effectiveness of content and campaigns, and better tailor our communications to our audience. Analytics and marketing tools that use cookies or similar technologies are activated in accordance with your consent settings.Advertising tools may involve marketing profiling, i.e., assigning Users to specific audience segments based on their activity on the Website, clicks, pages visited, or interactions with content. This profiling serves exclusively marketing and analytical purposes; it does not produce legal effects concerning the User or similarly significantly affect the User. Marketing and remarketing tools are activated exclusively in accordance with the User’s consent settings.
We operate Shine with Caroline brand profiles on social media platforms including Instagram, YouTube, TikTok, and Facebook.If you follow our profiles, comment, send messages, or interact with our content, your data may also be processed by the owners of those platforms in accordance with their own privacy policies. We process data from social media for the purposes of communication, community building, and marketing activities.
Shine with Caroline is a brand operated by a data controller registered and operating in Poland. This Privacy Policy has been prepared in accordance with the laws applicable in Poland and the European Union data protection provisions, in particular the GDPR.Where a User accesses the site or provides personal data from another country, they should be aware that the primary legal framework within which the Controller operates is Polish law and the relevant provisions of European Union data protection law.The above does not exclude any rights of the User that cannot be restricted or excluded by mandatory applicable law, where such provisions apply.
The content, products, and services of Shine with Caroline are directed primarily at adults. We do not knowingly collect data from children or minors without a required legal basis or the consent of a parent or legal guardian.Where a minor uses the offerings of Shine with Caroline, signs up for materials, contacts us, or makes a purchase, this should be done with the consent of and under the supervision of a parent or legal guardian, where such consent is required by applicable law.If we learn that we are processing data relating to a minor without the required legal basis or guardian’s consent, we will take steps to erase the data, restrict processing, or obtain appropriate consent.
We may update this Privacy Policy, for example in the event of changes to applicable law, tools, providers, the scope of services, or the operation of the site.The current version of the Privacy Policy is always available on our site. The date of the last update is stated at the beginning of this document. In the case of material changes affecting the way in which your data is processed, we will notify you by email, provided we hold your email address.
For matters relating to privacy and personal data, please contact us:
Shine with Caroline
Full legal name: EPI2
Brand: Shine with Caroline
Registered address: Stalowa 17/19/apt. 3, 03-425, Warsaw, Poland
Tax ID (NIP): 5221360099
Email: hello.shinewithcaroline@gmail.com
You may also lodge a complaint with the supervisory authority:Personal Data Protection Office (UODO)ul. Stawki 2, 00-193 Warsaw, Polandwww.uodo.gov.pl
