The data controller is: Adamczyk Art Studio Aleksandra Adamczyk, Chmielna 100, Warsaw, Poland.
Contact for personal data matters: adamczyk_maluje@o2.pl.
Data is processed in accordance with the GDPR (Regulation (EU) 2016/679).
§2 Purposes, Legal Bases and Scope of Processing
Order and contract fulfilment (name, delivery address, e-mail, phone, payment-related data) — Art. 6(1)(b) GDPR.
Compliance with legal obligations, including accounting and tax — Art. 6(1)(c) GDPR.
Sending the newsletter and one-time product-availability or collection-launch notifications (e-mail address) — consent, Art. 6(1)(a) GDPR.
Website visit statistics (the identifier described in §9) — consent, Art. 6(1)(a) GDPR.
Painting popularity statistics (aggregate counter of views and clicks on sales links, described in §10) — the controller's legitimate interest, Art. 6(1)(f) GDPR.
Handling inquiries, complaints and returns (including submitted photos) and establishing or defending claims — the controller's legitimate interest, Art. 6(1)(f) GDPR.
Handling custom commission requests submitted via the Commissions form, including reviewing submitted reference photos to prepare a quote and create the painting — Art. 6(1)(b) GDPR (pre-contractual steps taken at the Customer's request).
Providing data is voluntary but necessary to place an order or use a given service.
Data is not used for automated decision-making or profiling.
§3 Data Recipients and Transfers Outside the EEA
Data may be shared with processors acting on the controller's behalf: Stripe (payment processing), courier companies (order delivery), Resend (e-mail delivery), Supabase (database and file hosting) and Vercel (website hosting and performance statistics).
Some of these providers are based in the United States; data transfers take place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses (SCC).
§4 Retention Periods
Order data — for the period required by accounting and tax regulations (as a rule, 5 years from the end of the tax year).
Newsletter — until you unsubscribe.
Waitlist — until the one-time notification is sent, after which the address is deleted.
Return and complaint records (including photos) — for the period of their handling and the limitation of any claims.
Reference photos submitted with custom commission requests — retained together with the related order data (see point 1 above); the Customer may request earlier deletion under §5.
Statistical data — 12 months (see §9).
§5 User Rights
The User has the right to: access their data, rectify it, erase it, restrict its processing, data portability, and to object to processing.
Where processing is based on consent, it may be withdrawn at any time — without affecting the lawfulness of processing carried out before the withdrawal.
The User has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or their local supervisory authority.
To exercise these rights, please contact: adamczyk_maluje@o2.pl.
§6 Cookies and Similar Technologies
The website uses cookies and local storage mechanisms (localStorage) to function properly.
Cookies and localStorage may include cart handling, user preferences, and — after consent is given — the statistical identifier described in §9.
The User can manage cookies in browser settings and via the consent banner displayed on first visit.
§7 Newsletter
Rules: The newsletter involves the periodic transmission of information by electronic means to the email address provided by the User, in particular: information about new paintings available in the store, information about novelties, artistic events, and special offers.
Consent: By subscribing to the newsletter, the User consents to the processing of their email address for the purpose of sending commercial information regarding the Store's activities and informing about new products (paintings). Providing an email address is voluntary but necessary to receive the newsletter.
Unsubscription: The User has the right to unsubscribe from the newsletter at any time without giving any reason by clicking the "unsubscribe" link in each message or sending an email to the Store's contact address. Unsubscribing does not affect the possibility of using the Store.
§8 Waitlist
The User may join a waitlist to receive a one-time notification when a chosen product becomes available again, or when a chosen upcoming collection launches.
The e-mail address is used solely to send that notification — it is not added to the newsletter or used for marketing, and it is deleted from the list once the notification is sent.
§9 Statistics and Traffic Analysis
To analyze website traffic and improve the Store's functioning, after consent is given via the cookie banner, a randomly generated identifier is stored in the User's browser, not linked to the User's name or email address.
The data collected includes: visited Store subpages, the referring page address (referrer), and the date and time of the visit.
The legal basis for processing this data is the User's consent given by accepting the cookie banner.
Statistical data is not combined with personal data provided when placing orders, subscribing to the newsletter, or joining a product waitlist.
The User may withdraw consent at any time by rejecting it in the cookie banner or by clearing browsing data (including localStorage) in browser settings — this will stop the collection of new statistics for that device.
Statistical data is stored for 12 months from the date of collection, after which it is permanently deleted.
§10 Painting Popularity Statistics
Separately from the traffic statistics described in §9, every painting subpage in the Store includes a simple aggregate counter of views and of clicks on links to external sales platforms (Allegro, Vinted, Etsy) and posters, used solely for internal purposes to gauge the popularity of individual paintings.
This mechanism does not store any User identifier, IP address, or cookies/localStorage tied to the User — it only increments an aggregate counter attached to the given painting, with no way to link it to a specific person.
The legal basis for this processing is the controller's legitimate interest (Art. 6(1)(f) GDPR) in analyzing interest in the offering and optimizing the Store.
Given the nature of this data (aggregate counter only, no User identifier), this mechanism operates independently of the consent given via the cookie banner described in §9 and does not require its withdrawal to stop.