Privacy and cookie information

Updated: 14 October 2026

Data controller

The controller of data relating to instawhole.com is INSTAWHOLE Matthew Maijimi, ul. Wrocławska 18A/28, 45-707 Opole, trading under the INSTAWHOLE brand. Privacy contact: biuro@instawhole.com.

Cookies and privacy settings

You can use the website without consenting to analytics. On your first visit, we offer two equally available options: “Accept analytics” and “Essential only”. Scrolling or simply visiting the website does not constitute consent. If you make no choice, analytics remain disabled.

We store your choice in the browser's local storage (localStorage), under the key instawhole_consent_v1, for 180 days. The record contains the information version, your analytics choice and the date of that choice. It is used only to manage consent, not to identify visitors for analytics. After this period, we ask for consent again. If browser storage is unavailable, analytics remain disabled.

You can open “Cookie settings” in the footer of any page at any time and choose “Essential only” to withdraw consent. We stop measurement, delete Google Analytics cookies accessible to the website and reload the page to remove the running Google script. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not itself delete data already received by Google.

Google Analytics 4 statistics

We use Google Analytics 4 only with your voluntary consent (INSTAWHOLE – GA4 property, ID G-24GPEYFGTQ). The purpose is to analyse visits, page popularity and website usage to improve content and functionality. The legal basis is consent under Article 6(1)(a) GDPR; access to device storage for analytics also requires your prior consent.

We use Google Consent Mode v2 in basic mode. By default, analytics_storage, ad_storage, ad_user_data and ad_personalization are set to “denied”. The Google script is not downloaded until you consent to analytics. Refusing does not send cookieless measurements to Google. Analytics consent enables only analytics_storage; advertising consent remains disabled. We do not enable Google Signals or ad personalisation in the tag configuration.

After consent, Google may receive a cookie identifier, page view, session and interaction data, visit timing, traffic source, browser and device information, and approximate location. The network connection exposes your IP address to Google. GA4 does not log or store individual IP addresses; it may use them to determine approximate location. This does not mean that the remaining analytics data are fully anonymous.

For the initial page view measurement, we remove query parameters and the page URL fragment, as well as parameters in the referring URL. We do not send correspondence content or form data as custom analytics events.

Analytics cookies include _ga (distinguishing browsers) and _ga_24GPEYFGTQ (session state). In the tag configuration, we set a maximum lifetime of 180 days and disable automatic renewal on subsequent page views. The browser may shorten this period.

Data are received by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google entities operating the service. Processing may involve transfers outside the European Economic Area, including to the USA, under the terms described in Google's data processing and transfer conditions. More information: Google privacy policy and Google data processing terms.

In the GA4 property settings, event data retention is 2 months and user data retention is 14 months. The user data period resets with new activity. These settings do not apply to most standard reports based on aggregated data. Google's retention is separate from the 180-day cookie lifetime and storage of your choice.

Hosting and correspondence

Delivering the website requires a connection to the hosting server. The server may log the IP address, request time, resource address, response result and browser information. Technical logs are separate from Google Analytics and may be used for security and proper operation, based on the controller's legitimate interest (Article 6(1)(f) GDPR). Technical data may be processed by the hosting provider on the controller's behalf. Retention depends on log configuration and the period needed to maintain security, investigate incidents and establish or defend legal claims. Contact the controller for detailed information about logs.

When you email our contact address, we use the correspondence data to reply and handle your enquiry. Depending on the matter, the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) or the legitimate interest in handling correspondence (Article 6(1)(f) GDPR). Data may be entrusted to email and IT service providers. We retain correspondence for the time needed to handle the matter and then, where necessary, until the relevant limitation periods or mandatory retention periods expire. For correspondence unrelated to a contract, the criteria are closure of the matter and the end of any need for further contact.

Your rights

Within the limits set by the GDPR, you may request access, rectification, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interest and withdraw analytics consent through “Cookie settings”. Contact the controller about data already processed. You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

Links to other services

The showroom card links to the INSTAWHOLE store on Allegro. External services have their own privacy and cookie rules. Our analytics consent does not constitute consent to Allegro cookies.