Privacy policy

The Polish version of this policy prevails in case of any discrepancy.

1. Data controller

The controller of personal data processed on cojafoce.com is Marcin Zygmunt, running a business under the name mzygmunt Marcin Zygmunt, Przyłęk 112, 36-107 Przyłęk, Poland, VAT ID (NIP) 8172023385, REGON 522845526 (the "Controller").

For any data protection matter, contact me by email at kontakt@mzygmunt.com or by phone at +48 697 112 943.

2. Purposes, legal bases and retention

Answering your inquiry (form, email, phone)

Scope: first name, email address, phone number (if given), session type, preferred date and your message. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and otherwise Art. 6(1)(f) GDPR (the Controller's legitimate interest in handling correspondence). Retention: until the correspondence ends, then up to 12 months in case of possible claims.

Photo session and contract performance

Scope: contact details, data needed for booking and billing, and your image captured in the photographs. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention: for the duration of the contract, then until claims become time-barred. I keep backup copies of photos so I can re-send files, unless you ask me to delete them.

Publishing photos in the portfolio and on social media

I publish photos showing you in the portfolio, on the blog or on social media only with your separate consent (Art. 6(1)(a) GDPR and Art. 81 of the Polish Copyright Act). You can withdraw consent at any time, and I will then remove the photos from the channels I manage. Withdrawal does not affect the lawfulness of publication before it.

Billing, accounting and tax

Scope: identification data and data from sales documents. Legal basis: Art. 6(1)(c) GDPR (legal obligation). Retention: 5 years from the end of the tax year.

Establishing, pursuing or defending claims

Legal basis: Art. 6(1)(f) GDPR. Retention: until claims become time-barred.

Security and server logs

Scope: IP address, request time, requested resource, browser data. Legal basis: Art. 6(1)(f) GDPR (keeping the site secure and working). Retention: according to the hosting provider's settings.

Providing data in the form is voluntary but necessary for me to reply. Visit statistics (the Wix platform's analytics tools) and any marketing tools run only after you consent in the cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time.

3. Recipients

• Wix.com Ltd. and its group companies: site hosting, the form, blog, portfolio and contact database (Wix acts as a processor on my behalf),
• email, file storage and online gallery providers, as needed to deliver photos,
• an accounting office or accounting software provider, for billing,
• public authorities, where required by law.

I do not sell personal data.

4. Transfers outside the EEA

Wix.com Ltd. is based in Israel, which is covered by a European Commission adequacy decision. Some of Wix's sub-processors may process data in other countries, including the United States. Such transfers rely on an adequacy decision (the Data Privacy Framework, for certified entities) or on standard contractual clauses approved by the European Commission. A copy of the safeguards is available on request.

5. Your rights

You have the right of access and to a copy of your data, to rectification, erasure, restriction of processing, data portability (for automated processing based on consent or a contract), to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of earlier processing.

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa. Send requests to kontakt@mzygmunt.com.

6. Cookies

The site uses cookies that are necessary for it to work and, with your consent, analytics and marketing cookies. Consent is managed through the Wix platform's cookie banner. Details are in the Cookie policy.

7. Automated decisions

I do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

8. External links

The site links to Instagram and to mzygmunt.com. External services have their own privacy policies. The mzygmunt.com privacy policy concerns the same controller.

9. Changes

This policy may be updated, for example due to changes in law or in the site. The current version is always available on this page, with the date of the last update.