General provisions
This document sets out the Privacy Policy for the Studio Contrast website, available at www.studiocontrast.pl and operated by Magdalena Heciak, 96 Nene Road, PE29 1RF Huntingdon, Cambridgeshire, e-mail: kontakt@studiocontrast.pl, telephone: 722 266 809. In particular, it covers the rules on the protection of personal data and the security of other data entered into the Website by the User.
This Privacy Policy forms an integral annex to the Terms of Use of the Studio Contrast website.
Definitions
The terms used in this document have the following meanings:
Personal data controller (also referred to as the Controller) – Magdalena Heciak, 96 Nene Road, PE29 1RF Huntingdon, e-mail: kontakt@studiocontrast.pl, telephone: 722 266 809;
Website – the website available at www.studiocontrast.pl and all of its subpages;
User – a natural person who uses the Website and provides their personal data through it;
Personal data – information relating to a natural person who is identified or identifiable by reference to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity, including their image, voice recording, contact details, location data, information contained in correspondence, and information collected by means of recording equipment or other similar technology;
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
Terms of Use – the Terms of Use of the Studio Contrast website available at www.studiocontrast.pl.
Protection of personal data
The Controller is the controller of personal data within the meaning of the GDPR. The Controller collects and processes personal data in accordance with the applicable law, in particular the GDPR, and in line with the principles laid down therein. The Controller provides information about the processing of data at the time the data is collected. The Controller processes data to the extent, for the period and for the purposes specified in each case in the information provided beneath the forms used to collect personal data from the User. The Controller discloses Personal data only to the Controller’s trusted subcontractors, i.e. providers responsible for maintaining IT systems, entities such as banks and payment operators, providers of accounting and legal services, marketing agencies (in respect of marketing services), and providers of other IT and software development services. The Controller is entitled to disclose selected Personal data of the User to the competent authorities and third parties where this is required by applicable law and where those entities request such disclosure on an appropriate legal basis.
The Controller ensures the security and confidentiality of the personal data processed and enables the User to access information about the processing of their data. Should a personal data breach occur despite the security measures applied (e.g. a data ‘leak’ or loss of data), and should such a breach be likely to result in a high risk to the rights or freedoms of the User, the Controller will notify the User of that event in accordance with the law. As the Controller’s business is registered in the United Kingdom, and the Website may also be directed at users from Poland and other European Union member states, the processing of personal data may be subject, as applicable, to the GDPR, the UK GDPR and the Data Protection Act 2018 and, in respect of cookies and electronic marketing communications, also to PECR, to the extent that they apply to the Controller’s activities.
The User may contact the data controller using the following contact details:
Postal address: Magdalena Heciak, 96 Nene Road, PE29 1RF Huntingdon, Cambridgeshire.
E-mail address: kontakt@studiocontrast.pl
Telephone number: 722 266 809
Security of personal data
The Controller uses all technical and organisational means available to it to ensure the security of the User’s personal data and to protect it against accidental or deliberate destruction, accidental loss, alteration, and unauthorised disclosure or access. Users’ personal data is stored and processed on highly secure servers, with appropriate security measures in place that meet the requirements of Polish law. The data entrusted is stored on top-quality hardware and servers in suitably secured data centres, to which only authorised persons have access. The Controller carries out personal data processing activities in compliance with all legal and technical requirements imposed on it by data protection legislation.
The Controller continuously assesses the risks associated with its processing of personal data and ensures that only authorised persons have access to the data, and only to the extent necessary for the performance of their duties. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities also provide guarantees that appropriate security measures are applied whenever they process Personal data on the Controller’s behalf. The Controller undertakes to keep backup copies containing the User’s personal data.
User rights
If the User’s personal data changes, the User should update it by sending an appropriate message to the Controller.
The User has the following rights:
— the right to information about the processing of Personal data;
— the right to obtain a copy of the Personal data processed by the Controller;
— the right to rectification of Personal data;
— the right to erasure of Personal data (on this basis, the User may request the erasure of data whose processing is no longer necessary for any of the purposes for which it was collected);
— the right to restriction of processing of Personal data;
— the right to portability of Personal data;
— the right to object to the processing of Personal data for marketing purposes (the User may object at any time to the processing of Personal data for marketing purposes, without having to give reasons for the objection);
— the right to object to processing for other purposes (the User may object at any time – on grounds relating to their particular situation – to the processing of Personal data carried out on the basis of the Controller’s legitimate interest; such an objection must be justified);
— the right to withdraw consent where Personal data is processed on the basis of consent (withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal);
— the right to lodge a complaint with the supervisory authority for the protection of Personal data competent for the User’s habitual residence, place of work or the place of the alleged infringement. In Poland the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), and in the United Kingdom it is the Information Commissioner’s Office (ICO).
The Controller may refuse to erase the User’s personal data if its retention is necessary to comply with an obligation imposed on the Controller by law. The User has the right to submit a request to exercise the rights set out above by post or electronically (by e-mail). The Controller’s contact details are given in § 3(7).
Where, on the basis of a request referred to in paragraph 4, the Controller is unable to establish and identify the natural person to whom the request relates, it will ask the requester for additional information. Failure to provide the additional information will result in the request being refused. The Controller responds to a request within one month of receiving it. Should it be necessary to extend this period, the Controller will inform the requester of the reasons for the extension and of the expected date of its response.
Lawful basis, purpose and retention period of personal data
Personal data is processed for the following purposes and on the following lawful bases:
Use of the Website:
The personal data of all persons using the Website (including IP addresses or other identifiers, and information collected by means of cookies or other similar technologies) is processed by the Controller for the purposes of:
- providing services by electronic means (lawful basis: processing necessary for the performance of a contract – Article 6(1)(b) GDPR);
- analytics and statistics (lawful basis: consent – Article 6(1)(a) GDPR);
- establishing, exercising or defending legal claims (lawful basis: the Controller’s legitimate interest – Article 6(1)(f) GDPR – namely the protection of the Controller’s rights).
Newsletter:
Users who have informed the Controller that they wish to do so receive e-mails containing promotional content. Subscribing to the Newsletter involves providing the User’s Personal data to the Controller. Providing the data is not mandatory, but refusal to provide it means that the Newsletter service cannot be provided. The Personal data provided by the User is processed by the Controller for the purposes of:
- providing services by electronic means (lawful basis: processing necessary for the performance of a contract – Article 6(1)(b) GDPR – in respect of the data necessary to send the Newsletter);
- analytics and statistics (lawful basis: consent – Article 6(1)(a) GDPR);
- establishing, exercising or defending legal claims (lawful basis: the Controller’s legitimate interest – Article 6(1)(f) GDPR – namely the protection of the Controller’s rights).
Marketing:
The Controller processes Users’ Personal data in order to carry out marketing activities, which may consist in particular of displaying to the User marketing content matching their interests, or sending commercial information by electronic means for the purposes of direct marketing of goods and services. In such cases, the User’s Personal data is processed by the Controller on the basis of the User’s consent (Article 6(1)(a) GDPR), which may be withdrawn. The Controller’s marketing purposes may be pursued by means of profiling, consisting of the automated processing and evaluation of Personal data in order to analyse the User’s behaviour and make predictions about the future, which allows the User to be shown content consistent with their individual preferences and interests.
Contact form, traditional and electronic correspondence (e-mail) or correspondence via any means of distance communication. The User may send messages to the Controller by e-mail, using the Controller’s contact details available on the Website, in the Terms of Use or in this Privacy Policy, and via the contact form available on the Website. The Controller uses the Personal data contained in such correspondence solely for the purpose of communication and dealing with the matter to which the correspondence relates. The lawful basis for processing the Data is the Controller’s legitimate interest – Article 6(1)(f) GDPR – consisting in keeping correspondence addressed to it in connection with its business activity and, where the contact relates to services provided or a contract, processing necessary for the performance of a contract – Article 6(1)(b) GDPR.
Telephone contact
The User may contact the Controller by telephone in connection with services provided or a contract concluded, and on other matters. Where telephone contact concerns matters unrelated to a contract concluded or a service provided, the Controller may request Personal data only where this is necessary to deal with the matter raised. The lawful basis for processing Personal data is the Controller’s legitimate interest – Article 6(1)(f) GDPR – consisting in the need to resolve the matter raised in connection with its business activity and, where the contact relates to services provided or a contract, processing necessary for the performance of a contract – Article 6(1)(b) GDPR.
Social media profiles
The Controller maintains profiles on social media (including Facebook). The Controller processes Personal data left by persons visiting its profiles, e.g. comments or online identifiers. The Controller uses this data to run the profiles effectively, to enable activity on them, and for analytical or statistical purposes. The lawful basis for processing Personal data is the Controller’s legitimate interest – Article 6(1)(f) GDPR – consisting in promoting its business and the services it provides and, where applicable, establishing claims or defending against claims brought by third parties. The above does not apply to the processing of personal data by social media platforms. For information on how social media platforms process data, please refer to their own personal data processing policies.
Booking a free consultation
The User may book a free consultation with the Controller via the Calendly tool, a link provided on the Website or another designated contact channel. To book a consultation, the User may be asked to provide personal data such as their first name, e-mail address, telephone number, company name, website address, the chosen meeting time and information provided in the booking form. Personal data provided in connection with booking a consultation is processed in order to handle the request, arrange and conduct the consultation, contact the User and, where applicable, present a proposal for working together. The lawful basis for processing the data is taking steps at the User’s request prior to entering into a contract, i.e. Article 6(1)(b) GDPR, and the Controller’s legitimate interest, i.e. Article 6(1)(f) GDPR, consisting in conducting communication, handling enquiries and establishing or defending against any claims.
Ordering free digital content
The User may order free digital content, which is possible after they have provided the data indicated in the form. Where the User orders free digital content via the Website, the personal data provided by the User for this purpose is processed in order to fulfil the order and send the free digital content to the User.
The lawful basis for processing Personal data is:
- processing necessary for the performance of a contract – Article 6(1)(b) GDPR – in respect of the data necessary to send the free digital content and fulfil the order;
- the Controller’s legitimate interest – Article 6(1)(f) GDPR – namely the protection of the Controller’s rights, in relation to establishing, exercising or defending legal claims.
The period for which data is processed depends on the service provided and on the purpose and lawful basis of the processing. As a rule, data is processed for the duration of the service, the handling of the User’s enquiry or the fulfilment of the order. Where the lawful basis for processing Personal data is consent, the data is processed until consent is effectively withdrawn. Where the lawful basis for processing Personal data is the Controller’s legitimate interest, the data is processed until an effective objection is raised.
The period of processing of Personal data referred to in paragraph 2 may be extended where processing is necessary to establish, exercise or defend any legal claims. After that time, Personal data may be processed only where and to the extent required by applicable law. Once the processing period has expired, Personal data is erased or irreversibly anonymised.
Cookie policy
The Controller uses cookies. Cookies are small text files sent (saved) by the Website to the User’s end device (e.g. a computer or smartphone). The Controller uses cookies in order to provide services by electronic means. The Website uses two types of cookies: ‘session’ cookies and ‘persistent’ cookies. ‘Session’ cookies are temporary files that are stored on the User’s end device until the User logs out, leaves the website or closes the software (web browser). ‘Persistent’ cookies are stored on the User’s end device for the period specified in the cookie parameters or until they are deleted by the User.
The Controller uses the following types of cookies on the Website:
- ‘strictly necessary’ – these enable the use of services available on the Website, e.g. they are used to ensure that the contact form or Newsletter sign-up is submitted correctly;
- ‘preference’ – these make it possible to remember the settings chosen by the User and to personalise the User interface, e.g. with regard to the selected language or the User’s region, font size, the appearance of the Website, etc.;
- ‘analytics (tracking and performance)’ – these make it possible to obtain a range of information, including the number of visits and sources of traffic on the Website. This data is collected to determine which pages are visited most often and to compile statistics on traffic on the Website. The Controller uses this data to improve the performance of the Website. The data collected is processed in anonymised form. Google Analytics cookies fall into this category;
- ‘marketing (targeting and advertising)’ – these make it possible to tailor content displayed on and outside the Website, including advertisements, to Users’ interests. Data on browsing history, activity on websites (e.g. how services are used, the type of content and advertisements displayed) or geolocation data may be used to present personalised content. A profile of the User’s interests is built on the basis of information from the Website and the User’s activity on other websites.
The lawful basis for processing data in connection with the use of strictly necessary cookies is that the processing of personal data is necessary for the performance of a contract (Article 6(1)(b) GDPR). For all other cookies, the lawful basis for processing personal data is the User’s consent (Article 6(1)(a) GDPR).
The consent referred to in paragraph 4 is given by means of an appropriate form displayed on the User’s first visit to the Website. Consent may be withdrawn or adjusted at any time.
The User may change their cookie settings in their web browser. Changing the settings for cookies and similar technologies may affect how the Website and the services it provides function. Cookies may be placed by the Controller and its trusted partners via the Website. The Controller shares information about how the User uses the Website with trusted social media, advertising and analytics partners in order to provide the highest possible quality of services in terms of the Website’s functioning, analytics, tailoring and personalisation.
The list of trusted partners is set out below:
Google LLC – tools: Google Analytics, Google Tag Manager – privacy policy: https://policies.google.com/privacy?hl=pl;
Meta Platforms, Inc. – marketing tools (e.g. Meta Pixel / Facebook Pixel) – privacy policy: https://www.facebook.com/privacy/policy/;
Hotjar – privacy policy – https://www.hotjar.com/legal/policies/privacy/;
ManyChat – privacy policy – https://manychat.com/legal/privacy;
Calendly – privacy policy – https://calendly.com/legal/privacy;
MailerLite – privacy policy – https://www.mailerlite.com/legal/privacy-policy.
Logs
In line with the practice of most websites, the Controller stores HTTP requests sent to its server (server logs). Accordingly, the Controller stores the following information:
- the IP addresses from which users browse the informational content of our website;
- the time the request was received;
- the time the response was sent;
- the name of the client station – identification carried out by the HTTP protocol;
- information about errors that occurred during the HTTP transaction;
- the URL of the page previously visited by the user (referrer link);
- information about the user’s browser.
The logs collected are stored for an indefinite period as auxiliary material used to administer the Website. The information they contain is not disclosed to anyone other than persons authorised to administer the Website. Statistics may be generated from the log files to assist in administering the Website. Aggregate summaries in the form of such statistics do not contain any features that identify visitors to the website.
The Controller processes the information contained in the logs for technical and administrative purposes, to ensure the security of and manage the IT system, and for analytical and statistical purposes – in this respect, the lawful basis for processing Personal data is the Controller’s legitimate interest (Article 6(1)(f) GDPR).
Transfers of data outside the EEA
In connection with the Controller’s use of tools supporting its day-to-day business provided, for example, by Google, Users’ Personal data may be transferred to a country outside the European Economic Area (EEA), in particular to the United States of America (USA) or another country in which an entity cooperating with that provider maintains tools used to process Personal data in cooperation with the Controller. The Controller transfers Personal data outside the EEA only where necessary and subject to an adequate level of protection, primarily through the use of standard contractual clauses issued by the European Commission.
Final provisions
This privacy policy is subject to updates in line with the ongoing review of the technical and legal conditions relating to the processing of personal data.
This privacy policy is effective from 8 June 2026.