This is an English translation. In case of discrepancies, the Polish version prevails.

This document explains what personal data we process in connection with the website magdalenatekieli.com/studio (in all language versions), the enquiry forms, orders placed in the online shop and by e-mail, and contact with us, for what purposes, to whom we pass it and what rights you have. We apply Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish data protection law.

1. Who is responsible for your data

The data controller is the person named in the box at the top of this page. For any data protection matter you can write to magdalena@tekieli.pl, call +48 606 480 143 or send a letter to ul. Ważewskiego 33G, 30-499 Kraków, Poland. The controller has not appointed a data protection officer, as there is no obligation to do so.

2. What data we process and where it comes from

Browsing the website. The website has no user accounts. To deliver the website and protect it against attacks, our hosting provider (Cloudflare) processes technical data of each request, including the IP address and information sent by the browser (e.g. its type and operating system version). We do not combine this data with other information about you. Fonts and photographs are loaded from our own domain, not from external servers.

Language choice and consents. If you choose a language version or make a decision in the consent window, your browser stores that choice on your device. This information is not sent to us. Details are in the Cookie policy.

Google Maps. If you consent to the map, your browser connects to Google’s servers, which receive, among other things, your IP address. Without your consent the map does not load and no data is sent to Google.

Google Analytics. If you consent to “Analytics”, we load Google Analytics through Google Tag Manager, which collects information about visits: pages viewed, traffic source, approximate location (country, city), device and browser type, and an identifier stored in cookies. We do not use Google’s advertising features. Without your consent Google Tag Manager does not load.

Enquiry forms. We receive the data you provide: your name, e-mail address, optionally your phone number, the name of your company or organisation, the product or type of project you are asking about, and your message. We also record which language version the enquiry was sent from. If the form is protected by Cloudflare Turnstile, your browser connects to Cloudflare’s servers, which receive your IP address and browser information and use them to tell people from bots. This is not used for tracking or advertising.

Orders in the shop. When you place an order we receive the data you provide: your name, e-mail address, phone number, delivery address or pickup point, optionally your company name and tax number, and notes to the order. We also record the products ordered, amounts, delivery method, the version of the terms, the order date and the history of its fulfilment (payment, shipping, tracking number). To limit abuse, we store a cryptographic hash of your IP address (not the address itself) for one day. When you choose a parcel locker, we check in InPost’s public service that the point exists; only the point code is sent.

Pickup point map. The map of Paczkomat lockers and PaczkoPunkt points in the order form loads only after you click “Choose an InPost locker”. Your browser then connects to the servers of aPaczka.pl (or InPost, if the map comes from InPost), which receive your IP address, browser information and the address or town you type, to show nearby points. The map does not receive your details from the order form.

Payment. You pay through Przelewy24. We do not receive your card details or bank login; Przelewy24 sends us information about the payment for the order: the amount, transaction ID, payment method and payment title.

Complaints. When you make a complaint, we process the data in your message: your name, contact details, order number, description of the problem, photos and your request, as well as our reply.

Withdrawal from the contract. When you withdraw from the contract on the website, we record the order number, your name, e-mail address, the scope of the withdrawal, your note and the date and time we received the statement, and we send you a confirmation by e-mail.

Orders and contact by e-mail or phone. When you order or contact us by e-mail or phone, we receive the data you provide, usually your name, phone number, e-mail address, delivery address, invoice details and your message.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Providing and maintaining the website and protecting it against attacks	Art. 6(1)(f): our legitimate interest in a secure and working website
Visit statistics (Google Analytics)	Art. 6(1)(a): your consent to “Analytics” in the consent window
Showing Google Maps	Art. 6(1)(a): your consent, given in the consent window or with the button in place of the map
Replying to your enquiry and preparing an offer or quote at your request	Art. 6(1)(b): steps prior to entering into a contract; when you contact us on behalf of a company or organisation, Art. 6(1)(f): our legitimate interest in contact with client representatives
Correspondence on other matters	Art. 6(1)(f): our legitimate interest in replying to people who contact us
Fulfilling an order, shipping, invoicing and accounting	Art. 6(1)(b) and (c), in connection with tax and accounting law
Messages about your order (confirmation, payment reminder, payment, shipping, cancellation, refund) and confirming a withdrawal	Art. 6(1)(b) and (c): performance of the contract and duties under consumer law
Handling complaints and refunds after withdrawal	Art. 6(1)(b) and (c): performance of the contract and duties under consumer law
Pickup point map in the order form	Art. 6(1)(b): steps prior to entering into a contract at your request (choosing the delivery point)
Protecting the shop against abuse (order limit per IP address)	Art. 6(1)(f): our legitimate interest in the security of the shop
Establishing, exercising or defending legal claims	Art. 6(1)(f): protecting our rights

We do not carry out marketing on the website and do not use Google Analytics data for advertising. We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

You can withdraw your consent to the map and analytics at any time in “Cookie settings” in the website footer. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

4. Do you have to provide data

Browsing the website involves processing technical data without which it cannot be displayed. Providing data in the form and in other contact with us is voluntary, but without your name and e-mail address we cannot reply, and without a delivery address we cannot ship an order.

Processors acting on our behalf, under data processing agreements:

Cloudflare, Inc. - hosting of the website and shop, content delivery network, protection against attacks and spam (including Cloudflare Turnstile in the forms), and a database (in the European Union) in which we store orders, withdrawals and enquiries from the forms;
Resend - an e-mail delivery service: order and withdrawal confirmations, messages about order fulfilment and refunds, and enquiries from the forms;
our e-mail provider - operating the magdalena@tekieli.pl mailbox;
our accounting office and invoicing software provider - issuing invoices and tax settlements;
IT service providers - where necessary in a given matter.

Independent controllers, who decide about the data under their own rules:

Google Ireland Limited - when you consent to the map or to “Analytics” (Google Analytics via Google Tag Manager; for collecting and transmitting data to Google we may be jointly responsible with Google); further processing follows the Google privacy policy;
InPost sp. z o.o. - when we ship ordered products (Paczkomat, PaczkoPunkt or courier): name, address or pickup point, phone and e-mail;
aPaczka.pl - the service through which we send InPost parcels: the same data as for InPost; and the provider of the pickup point map in the order form;
the payment operator PayPro S.A. (Przelewy24) and banks - when you pay for an order: your name, e-mail address, order number and amount; the operator is a separate controller for this data;
law firms - when needed to protect our rights;
public authorities - when the law requires us to disclose data.

6. Transfers outside the European Economic Area

Cloudflare, Resend and companies of the Google group may process data in the United States. For companies participating in the EU-US Data Privacy Framework, transfers are based on the European Commission’s adequacy decision of 10 July 2023; in other cases, on standard contractual clauses approved by the Commission. You can obtain a copy of the standard contractual clauses by contacting us.

7. How long we keep data

Technical data processed by Cloudflare - for the short time needed to deliver the website and protect it against attacks, under the provider’s rules.
Enquiries and correspondence that do not lead to an order - up to 12 months from the last contact.
Hash of the IP address for the order limit - up to 24 hours.
E-mail sending queue records (order number, type of message, sending status) - up to 30 days after sending; copies of sent messages are kept in the shop’s mailbox and by the e-mail delivery provider (Resend) under its rules.
Complaints - until the end of the liability period for conformity of the product and the limitation period for claims, and where the complaint involves a corrected invoice, for the period required by tax law.
Order, withdrawal and accounting data - for the time of fulfilling the order and then for the period required by tax and accounting law, as a rule 5 years from the end of the year in which the tax payment deadline expired.
Correspondence needed to protect claims - until the claims become time-barred.
Data in Google Analytics - 14 months (Google Analytics retention setting); _ga cookies in your browser up to 2 years or until you delete them.
Consents and chosen language stored in the browser - up to 12 months or until you clear the site data.

After these periods we delete or anonymise the data.

8. Your rights

Under the GDPR you have the right to:

find out whether we process your data and receive a copy;
have inaccurate data corrected and incomplete data completed;
request erasure of your data or restriction of its processing;
receive the data you gave us under a contract or consent in a portable form, if we process it by automated means;
withdraw consent at any time, where processing is based on consent.

Right to object. You may at any time object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR). We will then stop processing the data for that purpose unless we demonstrate compelling legitimate grounds that override your interests or grounds for establishing, exercising or defending legal claims.

To exercise your rights, write to magdalena@tekieli.pl. We will reply without undue delay, as a rule within one month. For complex or numerous requests this may be extended by two further months, and we will let you know. Some rights are limited by law; for example, we will not delete invoices before the end of their mandatory retention period.

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office in Poland (uodo.gov.pl) or with the supervisory authority in your country.

9. Security

The website works only over an encrypted HTTPS connection. The forms are protected against automated spam. We use technical and organisational measures appropriate to the risk to protect data against loss, unauthorised access and disclosure.

10. Changes to this policy

We update this policy when the law, the way the website works or our providers change, in particular before the online shop opens. The current version is always available at this address, and the date at the top of the page shows when it took effect.

Privacy policy