Privacy Policy and GDPR Compliance
Last updated: September 2026
At Mali Tea ([www.malitea.com](https://www.malitea.com)), operated by GoldenSiam Dorota Piątek, we take your privacy and the protection of your personal data seriously. This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you visit our website or make a purchase, in full compliance with the EU General Data Protection Regulation (GDPR) and applicable data protection laws.
1. Data Controller Identification
The legal controller of your personal data for [www.malitea.com](https://www.malitea.com) is:
Brand Name: Mali Tea
Website:
[www.malitea.com](https://www.malitea.com)Legal Entity: GoldenSiam Dorota Piątek
Registered Address: Bukowska 141c, 62-060 Sapowice, Poland
NIP (Tax ID): 7881346617
Contact Email:
support@malitea.com
2. Personal Data We Collect
When you browse our store, make a purchase, or communicate with us, we collect the following personal information:
Contact & Shipping Details: Full name, shipping address, billing address, email address, and telephone number.
Transaction & Order History: Purchased items, order dates, cart contents, order status, and total transaction amount (in USD).
Technical & Usage Data: IP address, browser type, device information, operating system, time zone, and interaction data collected via essential site cookies.
3. Payment Data Security (Stripe Payments)
No Storage of Card Details: We do not collect, store, process, or transmit credit card numbers, CVVs, or cardholder credentials on our local servers.
Third-Party Payment Processing: All card transactions and electronic payments on
[www.malitea.com](https://www.malitea.com)are handled directly by Stripe Payments Europe, Ltd. (“Stripe”).Security Standards: Stripe processes your payment credentials under strict encryption protocol standards (PCI-DSS Level 1 compliance). To view Stripe’s full privacy notice, visit:
[https://stripe.com/privacy](https://stripe.com/privacy).
4. Legal Basis and Purpose for Processing
We process your personal data under the following legal bases as permitted by the GDPR:
Contractual Necessity (Art. 6(1)(b) GDPR): To process payments, package orders at our international warehouse, arrange global delivery, send order updates, and provide customer support.
Legal Obligation (Art. 6(1)(c) GDPR): To comply with statutory tax, legal accounting, and bookkeeping requirements under Polish tax regulations.
Legitimate Interests (Art. 6(1)(f) GDPR): To secure our website infrastructure, prevent fraudulent transactions, and maintain effective customer relationship management.
Consent (Art. 6(1)(a) GDPR): For sending voluntary marketing newsletters or enabling non-essential analytics cookies (where explicitly accepted via our cookie consent banner).
5. Data Sharing and Third-Party Sub-Processors
We never sell, rent, or trade your personal data. We only share necessary data with trusted third-party service providers bound by strict confidentiality and GDPR data processing agreements:
Payment Processors: Stripe Payments Europe, Ltd. (secure transaction execution).
Fulfillment & Logistics Partners: International postal networks, courier services (such as DHL, FedEx, UPS, Thailand Post), and sorting partners strictly for shipping and parcel delivery.
IT Infrastructure: Secure cloud website hosting, domain providers, and encrypted database infrastructure.
When personal data is transferred outside the European Economic Area (EEA)—such as sending shipping address details to our primary fulfillment facility in Thailand—it is performed strictly under Standard Contractual Clauses (SCCs) to ensure equivalent GDPR protection standards.
6. Data Retention Period
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:
Order Records: Transaction, shipping, and billing record details are stored for a period of 5 years to comply with statutory accounting and tax retention regulations in Poland.
Customer Account/Support Records: Support communications are kept for as long as necessary to resolve customer inquiries or until consent is withdrawn.
7. Your Legal Rights Under GDPR
As an EU/EEA resident, you hold the following statutory rights regarding your personal information:
Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you.
Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): Request deletion of your personal data where retention is no longer legally required.
Right to Restrict Processing (Art. 18 GDPR): Request the temporary restriction of your data processing.
Right to Data Portability (Art. 20 GDPR): Request transfer of your data in a structured, standard, machine-readable format.
Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interest or direct marketing.
To exercise any of these rights, contact us directly at support@malitea.com. You also have the right to lodge a formal complaint with the Polish Data Protection Authority: UODO (Urząd Ochrony Danych Osobowych) at [https://uodo.gov.pl](https://uodo.gov.pl).
8. Cookies Policy
Our website uses cookies and similar tracking technologies:
Essential Cookies: Mandatory technical cookies required for proper store operation, session handling, shopping cart storage, and secure checkout navigation.
Analytical / Marketing Cookies: Activated only after your explicit consent via our site banner. You can update or revoke your cookie preferences at any time via the “Cookie Preferences” link in our website footer.
9. Contact Us
For questions regarding this Privacy Policy or data protection inquiries, contact us at:
Mali Tea
GoldenSiam Dorota Piątek
Bukowska 141c, 62-060 Sapowice, Poland
NIP: 7881346617
Email: support@malitea.com