1. Data controller and contact
The controller of personal data on https://7pharma.pl is 7Pharma Sp. z o.o., Al. Komisji Edukacji Narodowej 93, 02-777 Warsaw, Poland. For privacy enquiries, email kontakt@7pharma.pl. This policy covers the product catalogue and administration area of 7pharma.pl. Purchases from the separate lilybox.pl store are subject to that store’s policy.
2. What data do we process and why?
- Providing and securing the website: the server processes your IP address, request time, resource address and browser information. Hosting is provided by LH.pl. We also record failed login attempts to limit attacks. Legal basis: our legitimate interest in maintaining and securing the website (Article 6(1)(f) GDPR).
- Contact: when you email us, we receive your email address, message and any information you choose to include. We use these to respond and handle your enquiry (Article 6(1)(f) GDPR), or, for steps taken at your request before entering into a contract, Article 6(1)(b) GDPR. This website contains an email link, rather than a contact form.
- Statistics: we activate Google Analytics 4 only with your consent. It measures visits, page views, device information and approximate region, and uses online identifiers. Page addresses sent to Analytics exclude query parameters and the fragment after #. We have disabled Google Signals, ad personalisation in this tag and automatic form measurement. Legal basis: Article 6(1)(a) GDPR.
- Marketing: we activate the Meta pixel only with your consent, on general pages such as the home page and product listing. It sends a basic page-view event, the page address, technical connection data and cookie identifiers. We do not activate it on individual product pages. Automatic collection of additional information is disabled in our website code, and we do not send contact details for advanced matching. Legal basis: Article 6(1)(a) GDPR.
3. Your cookie choices
Cookies are small pieces of information stored in your browser. We also use scripts from the services listed below. Necessary cookies support functions you explicitly request, including remembering consent choices and logging in. Optional statistics and marketing tools start only after you consent to the relevant category. Scrolling the page or closing the banner does not constitute consent.
In the banner, you can choose “Accept all”, “Reject optional” or “Choose settings”. Refusing optional cookies does not restrict access to the catalogue. At any time, open “Cookie settings” at the bottom of the page, change the categories and save your choices. Withdrawing consent stops further activation of the relevant tool and removes its accessible cookies from our domain; the page may reload. Withdrawal does not affect the lawfulness of earlier processing and does not automatically delete data already received by the provider.
You can also delete or block cookies in your browser settings. Deleting consent cookies may make the banner appear again. Cookies on Google and Meta domains, and your account settings with those providers, are controlled separately. We respect Do Not Track signals and global privacy controls supported by Complianz.
4. Cookie categories and lifetimes
- Necessary — Complianz: cmplz_banner-status, cmplz_consented_services, cmplz_functional, cmplz_statistics, cmplz_preferences, cmplz_marketing and cmplz_policy_id. These remember your choices and the policy version, normally for up to 365 days. Recording a refusal in cmplz_statistics or cmplz_marketing does not activate tracking.
- Statistics — Google Analytics: _ga and _ga_8D930YN45Y distinguish browsers and maintain session measurement state. Our website code sets these cookies to expire after 180 days, without extending their lifetime on subsequent page views.
- Marketing — Meta: _fbp and, when arriving with a relevant advertising identifier, _fbc, generally for up to 90 days. They identify the browser, attribute visits to advertising and support measurement. Meta may also use its own cookies on its domains, depending on your browser, login status and account settings, as described in its cookie policy.
- WordPress administration: wordpress_test_cookie (session; tests cookie support); wordpress_sec_[hash], wordpress_[hash] and wordpress_logged_in_[hash] (login session; standard authentication lasts 2 days, or 14 days with “Remember me”); wp-settings-[ID] and wp-settings-time-[ID] (administration preferences, up to one year); wp_lang (login language, session). These relate to administration and logging in.
Items in square brackets represent a variable identifier. Your browser may shorten storage periods. Not every cookie listed is created on every visit. Catalogue photographs and fonts are served from our own domain.
5. Google, Meta and data recipients
Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We also view reports through Site Kit in WordPress. Search Console shows how the website performs in search; its verification tag alone does not track catalogue visitors. Read Google’s privacy policy and its information about data from websites using Google services.
The pixel is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. 7pharma.pl and lilybox.pl share a pixel. Meta may link events to activity on its services, measure advertising and create audiences. Its joint controller arrangements apply to the collection and transmission of event data to Meta for its business tools. Meta is responsible for further processing for its own purposes. Read Meta’s privacy policy and cookie policy.
Authorised personnel and hosting, email and technical service providers may access data as necessary for their tasks, as may authorities entitled to do so by law. Google and Meta data may be processed outside the European Economic Area, including in the USA. Providers use safeguards described in their documentation, including adequacy decisions for covered recipients or standard contractual clauses. You can obtain details of these safeguards from the provider or by contacting us.
6. How long do we keep data?
A cookie’s lifetime is different from the retention period for server data. We retain correspondence while handling your enquiry and afterwards only where needed to meet legal obligations or protect legal claims. Security data and logs are used to handle and investigate incidents; we do not keep them longer than that purpose requires. Analytics user and event data retention is set to 2 months, without resetting the period on new activity. Google applies retention changes after 24 hours. Aggregated reports may remain available for longer. Meta’s processing periods depend on the purpose, type of information and settings described in its policy. Contact us about specific information or its deletion.
7. Your rights
Subject to the conditions set out in law, you have the right to access your data and receive a copy, to rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time and object to processing based on legitimate interests; you may object to direct marketing at any time. You may complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl.
Consent to statistics and marketing is voluntary. Providing information in correspondence is voluntary, although without it we may be unable to respond. Meta ads may be personalised using an interest profile. We do not make automated decisions on this website that produce legal effects or similarly significantly affect you.
8. Changes and the separate store
We update this document when our tools or data processing change. The current version is linked in the footer. Shopping links lead to lilybox.pl — check the store’s own consent banner and privacy policy after visiting it. Cookie choices on 7pharma.pl do not replace your choices in the store.