Elfindo Privacy and Cookies Policy

Version effective from: 18 September 2026

This translation is provided for convenience. In the event of any discrepancy, the Polish version of this document prevails.

This Policy describes the rules for processing personal data and for using cookies and similar technologies on the elfindo.com website.

Elfindo is a service based on personalising stories for children. For this reason, we attach particular importance to minimising the scope of data concerning children and their loved ones.

1. Data Controller

The controller of personal data is:

Wirebase Sp. z o.o.
Aleja Jana Pawła II 27
00-867 Warsaw, Poland
KRS: 0000868493
NIP: 5272940820
REGON: 387522572

Contact for privacy and personal data matters:

[email protected]

If the Controller appoints a Data Protection Officer, their contact details will be published in the current version of this Policy.

2. Scope of the Policy

This Policy applies to data processed in connection with:

• the use of the elfindo.com website,
• placing and fulfilling Orders,
• preparing a personalised story,
• delivering an audiobook, ebook or other Digital Content,
• customer service and complaint handling,
• payments and settlements,
• signing up for and sending the Newsletter,
• the security of the Service,
• cookies and similar technologies,
• analysing the use of the Service, if the user gives the relevant consent.

3. What data we process

Depending on how you use Elfindo, we may process the following categories of data.

3.1. Data of the Customer or parent/guardian

This may include:

• first name and surname, if required for the Order or an accounting document,
• e-mail address,
• telephone number, if provided,
• address or invoicing details, if required,
• data necessary to settle the Order,
• Order number or identifier,
• purchase history and history of contact with customer service.

3.2. Data concerning the child used for Personalisation

Depending on the Product selected, this may include:

• first name,
• age or age range,
• linguistic forms needed to prepare the story naturally,
• interests and hobbies,
• favourite activities,
• Christmas wishes,
• information about pets,
• favourite objects or toys,
• general information about the child's everyday surroundings,
• other information voluntarily provided by the parent or guardian.

3.3. Data concerning family members and other loved ones

If needed for Personalisation, the Customer may provide limited information about people in the child's closest circle, e.g.:

• the person's first name or the way the child addresses them,
• their relationship to the child,
• general information about a household or family tradition,
• other information needed for a specific element of the story.

Please do not provide data of third parties that is not needed to create the story.

3.4. Payment-related data

We may process:

• the transaction amount and currency,
• the payment status,
• the transaction identifier,
• the payment method selected.

If the payment is processed by an external operator, card or account details may be processed directly by that operator. As a rule, the Controller does not need full payment card details.

3.5. Technical and usage data

This may include:

• IP address,
• date and time of connection,
• browser and device information,
• session identifiers,
• security logs,
• error information,
• data on how the Service is used,
• identifiers of cookies or similar technologies,
• a record of consent choices.

3.6. Correspondence data

If you contact us, we process the data contained in your message and the data needed to respond.

3.7. Newsletter data

If you sign up for the Newsletter, we process primarily:

• e-mail address,
• date and source of sign-up,
• a record of the consent given,
• unsubscribe information,
• technical information on message delivery, if available.

4. What data we do not want to collect

1. Elfindo is designed in accordance with the principle of data minimisation.
2. Please do not provide the following in Personalisation Forms:
   • the child's full home address,
   • the child's surname, unless necessary,
   • the full date of birth,
   • the name of the school or nursery,
   • identity document numbers,
   • passwords or login details,
   • the child's financial data,
   • data concerning health, racial or ethnic origin, religion, political opinions, sexual orientation or other special categories of data, unless there is a clear need, a valid legal basis and appropriate information for the user.
3. If such information is provided inadvertently in a free-text field, the Controller may delete or anonymise it if it is not needed to fulfil the Order.

5. Where we obtain data from

1. We obtain Customer data primarily directly from the Customer when they:
   • use the Service,
   • place an Order,
   • complete forms,
   • contact customer service,
   • sign up for the Newsletter.
2. Data concerning the child and other loved ones is provided by the Customer who orders the personalised Product.
3. The Service is not directed at children as independent purchasers of the service, and we do not assume that a child provides us with data on their own in order to conclude a contract.
4. If the Customer provides the data of another adult, they should do so only to the extent necessary and, where appropriate, inform that person of this Policy.

6. Purposes and legal bases of processing

6.1. Fulfilling the Order and customer service

We process Customer data in order to:

• accept and handle the Order,
• conclude and perform the contract,
• deliver the Product,
• communicate about the Order,
• handle changes, questions and complaints.

Legal basis: Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract.

6.2. Personalising the story based on information about the child and loved ones

We use the data provided by the parent or guardian in order to:

• prepare the personalised story,
• apply the information correctly in the text or audio,
• check the quality of the Personalisation,
• handle any corrections or complaints.

With regard to the data of persons who are not a party to the contract, the legal basis is, as a rule, Article 6(1)(f) GDPR, i.e. the Controller's legitimate interest in performing a personalised service ordered by an entitled person, exercised with particular care because children's data is involved.

The Controller limits the scope of this interest through data minimisation, a limited retention period and the use of the data solely for delivering the specific Product and the related customer service.

6.3. Settlements and legal obligations

We process data in order to:

• keep accounts,
• issue accounting documents,
• comply with tax obligations,
• comply with other obligations arising from the law.

Legal basis: Article 6(1)(c) GDPR.

6.4. Complaints, claims and defence of rights

Data may be processed in order to:

• establish, pursue or defend claims,
• document the performance of the contract,
• prevent abuse.

Legal basis: Article 6(1)(f) GDPR – the Controller's legitimate interest.

6.5. Security of the Service

Technical data and logs may be processed in order to:

• protect the Service against attacks and abuse,
• detect errors,
• ensure continuity of operation,
• protect accounts and access to Products,
• carry out technical diagnostics.

Legal basis: Article 6(1)(f) GDPR – the Controller's legitimate interest in ensuring the security and proper operation of the services.

6.6. Newsletter and e-mail marketing

If you sign up for the Newsletter, we process your data in order to send information about Elfindo, new Products, launches, materials and promotions.

Legal basis for data processing: Article 6(1)(a) GDPR – consent.

Commercial information and direct marketing are sent by means of electronic communication after the consent required by Article 398 of the Polish Electronic Communications Law of 12 July 2024 has been obtained.

Consent may be withdrawn at any time.

6.7. Analytics and optional technologies

If the Service uses optional cookies or similar analytics, personalisation or marketing technologies, they are activated after the required consent has been obtained.

Legal basis for accessing the device: Article 399 of the Polish Electronic Communications Law of 12 July 2024.
Legal basis for processing personal data: Article 6(1)(a) GDPR.

7. Children's data

1. We give special protection to data concerning children.
2. The child's data is used solely to the extent needed to prepare and support the personalised Product, unless there is another explicit legal basis and appropriate information.
3. We do not use the child's data provided for Personalisation to conduct direct marketing aimed at the child.
4. We do not expect a child to provide us with personal data or conclude a contract with us on their own.
5. The parent, guardian or other person placing the Order should have the right to provide the child's data.
6. If we learn that a child's data has been provided by an unauthorised person or to an extent not needed to provide the service, we may delete it or restrict its processing.
7. Any requests concerning a child's data may be sent to [email protected].

8. Automated and generative tools

1. Elfindo may use automated tools, including generative solutions, to prepare the text, recording, voice, effects or other elements of the Product.
2. In such cases, data is transferred to the providers of these tools solely to the extent needed to provide the service and with due regard to data protection requirements.
3. The Controller should configure the services used so that data provided for the fulfilment of a specific Order is not used for the provider's own independent purposes that are incompatible with the purpose of providing Elfindo.
4. Elfindo does not take decisions concerning the Customer or the child based solely on automated processing that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR.
5. Automated Personalisation of content is not an assessment of the child or a psychological profile.

9. Recipients of data

Data may be disclosed to entities supporting the Controller, to the extent needed to provide the services, in particular:

• hosting and server infrastructure providers,
• providers of CDN, DNS and web security services, including services used to protect the Service,
• e-mail service providers,
• providers of Newsletter distribution systems,
• payment operators,
• providers of accounting systems and entities providing accounting services,
• providers of tools for generating or processing text and audio, if used to deliver the Product,
• providers of analytics tools, solely to the extent consistent with the consents given,
• entities providing technical, legal or security support,
• public authorities, where the obligation to disclose data arises from the law.

Where an entity processes data on behalf of the Controller, this should take place on the basis of appropriate data processing terms compliant with Article 28 GDPR.

10. Transfers of data outside the European Economic Area

1. Some technology providers may process data outside the European Economic Area.
2. Where such a transfer takes place, the Controller applies the mechanisms provided for by the GDPR, as appropriate to the situation, in particular:
   • a European Commission decision finding an adequate level of protection,
   • standard contractual clauses,
   • other legally permissible safeguards.
3. Information on the safeguards applied may be obtained by contacting [email protected].

11. How long we keep data

The retention period depends on the purpose of processing.

11.1. Order and contract data

Data is kept for the period needed to perform the contract and then for the time necessary to handle complaints, establish, pursue or defend claims and comply with legal obligations.

11.2. Accounting and tax records

Data required by tax and accounting regulations is kept for the period required by the applicable law, as a rule for the period linked to the statutory retention period for tax records.

11.3. Raw Personalisation data concerning the child and loved ones

We keep input data used solely to create the story only for the period necessary to:

• generate and check the Product,
• deliver all of its parts,
• handle typical technical or Personalisation corrections.

As a rule, this data should be deleted or anonymised no later than 30 days after delivery of the Product has been completed, unless:

• the Customer has earlier made an effective request for its deletion and there is no basis for further retention,
• the data is necessary to handle a pending complaint,
• longer retention results from an express request by the Customer or a separate legal basis.

11.4. The finished personalised Product

The finished Product may contain personal data within the content of the recording or text. It is kept for the access period specified in the offer or the contract and is then deleted or anonymised in accordance with the adopted technical and backup cycle, unless further retention is necessary to fulfil the Customer's rights or legal obligations.

11.5. Newsletter

We keep Newsletter data until consent is withdrawn or the service is discontinued. Limited information confirming the fact of consent or unsubscription may be kept for longer if this is needed to demonstrate compliance with the law or to defend against claims.

11.6. Technical logs

Security logs and diagnostic data are kept for a period justified by the security of the Service, as a rule no longer than 12 months, unless longer retention is needed in connection with an incident, abuse or a claim.

11.7. Cookies

The lifetime of cookies depends on the specific cookie and its purpose. Up-to-date information should be available in the Service's cookie settings panel.

12. Your rights

Under the rules set out in the GDPR, you have the following rights:

• the right of access to your data,
• the right to obtain a copy of your data,
• the right to rectification of your data,
• the right to erasure of your data,
• the right to restriction of processing,
• the right to data portability, where the statutory conditions are met,
• the right to object to processing based on Article 6(1)(f) GDPR,
• the right to withdraw consent at any time, where processing is based on consent,
• the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

For matters concerning the exercise of your rights, you may contact us at [email protected].

13. Objection to processing

1. If data is processed on the basis of the Controller's legitimate interest, you may object on grounds relating to your particular situation.
2. In the event of an objection, the Controller will cease processing the data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims.
3. Where data is processed for direct marketing purposes, the objection is absolute.

14. Whether providing data is mandatory

1. Providing the data required to place and fulfil an Order is voluntary, but failure to provide it may make it impossible to conclude or perform the contract.
2. Providing data for Personalisation is voluntary, but the absence of certain information may limit the scope of Personalisation.
3. Providing data for the Newsletter is entirely voluntary and is not a condition of purchase.
4. Consent to optional cookies is not a condition for using the basic features of the Service.

Part II – Cookies Policy

15. What cookies are

1. Cookies are small pieces of information stored on the user's device or read from it while the Service is being used.
2. Other technologies may perform a similar function, e.g. localStorage, session identifiers, pixels or other browser storage mechanisms.
3. In this Policy, the term “cookies” also covers similar technologies, unless the context indicates otherwise.

16. Legal basis for cookies

1. The rules for storing information on the user's device and accessing it follow in particular from Articles 399–400 of the Polish Electronic Communications Law of 12 July 2024.
2. As a rule, optional cookies require the user's prior consent.
3. Consent is not required where the storage of or access to information is necessary:
   • to carry out the transmission of an electronic communication over a public telecommunications network, or
   • to provide a telecommunications service or a service provided by electronic means requested by the user.
4. If information obtained from cookies constitutes personal data, its processing is also subject to the GDPR.

17. Categories of cookies

The Service may use the following categories.

18. Essential cookies

1. Essential cookies may be used, among other things, to:
   • ensure security,
   • protect against bots and attacks,
   • maintain the session,
   • operate the shopping cart or the Order process,
   • remember privacy settings,
   • provide access to purchased Digital Content.
2. The Service uses infrastructure and security services that may apply technical identifiers needed to protect the website against abuse.
3. The scope and names of cookies may depend on the current technical configuration of the Service.

19. Analytics and marketing cookies

1. Analytics or marketing cookies, if used, should remain disabled until the required consent has been obtained.
2. Refusing consent to optional cookies should not prevent basic use of the Service, the placing of an Order or access to a purchased Product.
3. The current list of technologies and providers in use at any given time should be available in the cookie settings panel.

20. Consent management

1. On the first visit, the Service may display a panel or banner allowing the user to:
   • accept optional cookies,
   • reject optional cookies,
   • select individual categories.
2. The user may change or withdraw consent at any time in the “Cookie settings” panel available in the Service.
3. Withdrawing consent should be as easy as giving it.
4. Withdrawal of consent does not affect the lawfulness of actions taken before its withdrawal.

21. Browser settings

1. Most browsers allow users to delete cookies, block them or be notified before they are stored.
2. Disabling all cookies in the browser settings may cause some features of the Service, especially those requiring essential cookies, to stop working properly.
3. Browser settings operate independently of the consent panel available in the Service.

22. Third-party content and services

1. The Service may contain elements provided by third parties, e.g. payment tools, players, forms or external materials.
2. If such an element uses optional cookies or similar technologies, it should be activated only after the relevant consent has been obtained, unless a statutory exception applies.
3. Third-party providers may be separate data controllers to the extent determined by their own services and the applicable law.

23. Security

The Controller applies appropriate technical and organisational measures adapted to the risk; in particular, it may apply:

• TLS/HTTPS connection encryption,
• restrictions on access to data,
• separation of transactional data from data used for Personalisation,
• backups,
• security monitoring,
• anti-abuse mechanisms,
• data minimisation,
• periodic deletion of data that is no longer needed.

24. Changes to the Policy

1. This Policy may be updated in particular in the event of:
   • changes in the law,
   • changes to the way the Service operates,
   • the implementation of new tools,
   • changes of technology providers,
   • changes to the scope of data processed.
2. The current version is published in the Service together with its effective date.
3. If a change requires consent to be obtained again, the user will be asked to provide it.

25. Contact

For matters concerning privacy, personal data or cookies, please contact us:

Wirebase Sp. z o.o.
Aleja Jana Pawła II 27
00-867 Warsaw, Poland
e-mail: [email protected]