Privacy policy

1. Data controller

The controller of personal data is Krzysztof Lewandowski, a natural person running an unregistered business, correspondence address: al. Waszyngtona 65 m. 8, 04-074 Warszawa, Polska. Contact on personal data matters: lewandowski.malarstwo@gmail.com or the form at https://biegajaca-sztuka.pl/kontakt.

2. What data I process

I may process: your first and last name, e-mail address, phone number if you give it, the content of our correspondence and information about your enquiry; data needed to agree, conclude and perform a contract, including data on the order, payment, delivery or collection; data in accounting documents; technical data and server logs, including IP address, browser information and connection time; and Google Analytics 4 statistics, if you consent to analytics cookies.

3. Purposes and legal bases

• a) Replying to messages, handling enquiries and correspondence: Art. 6(1)(f) GDPR (legitimate interest in handling correspondence), and where the enquiry concerns concluding a contract: Art. 6(1)(b) GDPR (steps prior to entering into a contract).
• b) Concluding and performing a contract, delivery or collection of a work: Art. 6(1)(b) GDPR.
• c) Meeting accounting and tax obligations: Art. 6(1)(c) GDPR.
• d) Security, maintenance and diagnostics of the site, and establishing, pursuing or defending claims: Art. 6(1)(f) GDPR.
• e) Visit statistics in Google Analytics 4: Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law, only after the required consent has been obtained.

4. Recipients and transfers outside the EEA

Data may be passed to entities that support the site or the performance of a contract, in particular:

• Vercel Inc.: website hosting and technical infrastructure;
• Plus Five Five, Inc., operating as Resend: sending messages from the form and transactional messages;
• Google Ireland Limited / Google LLC: e-mail and, only with consent, Google Analytics 4;
• carriers, payment operators or other service providers, where this is necessary to perform a particular contract.

Providers may act as processors or, for some of their own operations, as separate controllers. Data is not sold or shared with others for their own marketing.

Vercel and Resend publish documentation on international transfers, including standard contractual clauses (SCCs) and the EU–US Data Privacy Framework (DPF). Google also describes its transfer mechanisms for services covered by the DPF and the relevant contractual terms. The applicable mechanism depends on the service, the legal entity, the contract and the scope of certification. The providers' current documents:

Vercel: https://vercel.com/legal/dpa

Resend: https://resend.com/legal/dpa

Google: https://policies.google.com/privacy

Where data is transferred to a third country, a mechanism permitted by Chapter V GDPR is used, as appropriate to the relationship.

5. Retention

• Ordinary correspondence that did not lead to a contract: up to 12 months from the last contact, unless earlier deletion is appropriate or longer storage is needed to handle a dispute.
• Data on contracts and claims: for the duration of the contract and then for the limitation period of the relevant claims.
• Tax and accounting documents: for the period required by law.
• User and event data in Google Analytics 4: 2 months (the data retention setting in the GA4 panel).
• Google Analytics 4 analytics cookies: up to 13 months.
• Server logs: for the period resulting from the hosting configuration and from security and diagnostic needs.

After the relevant period, data is deleted or anonymised, unless the law requires it to be kept longer.

6. Your rights

Under and within the limits of the GDPR, you have the right of access to your data, to receive a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal. You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). To exercise your rights, write to the e-mail address in section 1.

7. Cookies and browser storage

The site may use:

• the strictly necessary bs_consent cookie, which remembers your cookie choice for up to 12 months;
• sessionStorage, to remember within a browser tab whether the animation has been shown, until the tab is closed;
• Google Analytics 4 analytics cookies, including _ga and _ga_<identifier>, only with consent.

The Google Analytics 4 script loads only after you consent, and withdrawing consent stops analytics and removes its cookies. You can change or withdraw your consent in the cookie settings available on the site.

Fonts are served locally, from the site's own server. Links to external services, e.g. Instagram, are subject to those services' privacy rules. By going to an external site, its operator may process data under its own rules.

8. Providing data is voluntary

Giving your data in the form is voluntary, but without contact details and a message it will not be possible to reply. Data necessary for a contract is needed to conclude or perform it. Do not include special categories of data in the form unless they are needed for the matter.

9. Automated decisions

Data is not used to make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

10. Changes to this policy

This policy may be updated when the way the site works, the tools it uses or the law changes. The current version is published on the site.