Privacy Policy

1. General provisions

This Privacy Policy sets out the rules for the processing and protection of personal data provided by Users in connection with their use of the website dominikaskrzypek.pl (hereinafter: the “Website”).

This document fulfils the information obligation arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

2. Personal data controller

The controller of your personal data is:

Dominika Skrzypek
Photography Studio
ul. Międzyborska 8B/42, 04-041 Warszawa
NIP (Tax ID): 1132555385
REGON (Business ID): 382807436

Contacting the Controller:

• Email: dominikaskrzypek@gmail.com
• Phone: +48 601 833 201

3. What data we collect, on what legal basis and for what purpose

A. Contact form

When you send an enquiry via the form on the Website, you provide:

• your first name and surname,
• your email address,
• your phone number,
• the content of your message (optionally also contextual information, e.g. your approximate due date or preferred session date).

Purpose and legal basis:

• Responding to your enquiry and contacting you regarding the photo session offer — on the basis of your consent resulting from sending the enquiry (Article 6(1)(a) GDPR).
• Once you decide to book a date — taking steps prior to entering into a contract and performing the contract for the photo session (Article 6(1)(b) GDPR).

B. Carrying out the photo session

If we begin working together, we process the data necessary to organise and settle the service (including address details for the receipt/invoice, and detailed arrangements regarding the date, place and course of the session).

In the case of family and newborn/children’s sessions, this data may also include the child’s name and age, provided voluntarily by the parent or legal guardian, solely for the purpose of carrying out the session smoothly and safely.

C. Image and portfolio

Photos taken during a session may be published in the portfolio on the Website, in promotional materials or on the Controller’s social media profiles solely on the basis of separate, voluntary and explicit written/electronic consent of the person photographed (and in the case of minors — of the parent or legal guardian) in accordance with Article 81 of the Polish Act on Copyright and Related Rights and Article 6(1)(a) GDPR. This consent may be withdrawn at any time.

D. Analytics and visit statistics

The Website uses analytics tools, including Google Analytics (managed via Google Tag Manager), to analyse traffic and optimise the performance of the Website.

• The information collected is aggregated and anonymous (e.g. browser type, approximate location, time spent on the website).
• These tools are activated on the basis of your consent given via your browser settings or the cookie banner (Article 6(1)(a) GDPR) and on the basis of the Controller’s legitimate interest in keeping qualitative statistics (Article 6(1)(f) GDPR).

E. Directions map (Google Maps)

On the home page, on the Contact page and on the Studio page we display a map showing how to get to the studio, provided by Google Maps (Google Ireland Limited / Google LLC). The map only loads once you scroll down to it; at that point your browser connects to Google’s servers and transmits technical connection data, in particular your IP address, information about your browser and the address of the page you are visiting. Google may also use cookies in accordance with its own privacy policy.

• Purpose and legal basis: making it easier to get to the studio, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR).

F. Fonts (Google Fonts)

To display text, the Website uses Google Fonts, which are downloaded from Google’s servers each time a page is opened. In doing so, your browser transmits technical connection data to Google, in particular your IP address and information about your browser. The fonts do not store cookies.

• Purpose and legal basis: a consistent and legible appearance of the Website, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR).

G. Google reviews (Trustindex widget)

On the home page and on the offer pages we display customer reviews published on the Controller’s Google Business Profile. The reviews widget is provided by the Trustindex service. When a page with the widget is displayed, your browser connects to the servers of Trustindex (to download the widget’s script and graphics) and of Google (to download the profile pictures of review authors). As a result, these entities receive technical connection data, in particular your IP address, information about your browser and the address of the page you are visiting. The widget does not store cookies on your device.

• Purpose and legal basis: presenting customer reviews of the Controller’s services, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR).

4. Data recipients and transfers outside the EEA

Your data may be transferred to trusted third parties supporting the Controller in its day-to-day activities, solely to the extent necessary to achieve these purposes:

1. Hosting and email service provider — maintenance of the technical infrastructure and servers.
2. Accounting tools provider / accounting office — to the extent necessary to issue accounting documents and settle taxes.
3. Google LLC / Google Ireland Limited — in connection with analytics tools (Google Analytics, GTM), the directions map (Google Maps), fonts (Google Fonts) and the display of profile pictures of Google review authors.
4. Trustindex — provider of the Google reviews widget, with regard to technical connection data (IP address, browser data).

In connection with the use of Google services, data may be transferred to servers located outside the European Economic Area (mainly in the USA). This transfer takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses (SCCs) approved by the European Commission, which ensure an adequate level of data protection.

The Controller does not sell or share your data with third parties for commercial or marketing purposes.

5. Data retention period

• Enquiries from the contact form: stored for as long as necessary to handle correspondence and any session booking, but no longer than 12 months from the last contact (if no cooperation is established).
• Data related to the performance of the contract and settlements: stored for the period required by tax and accounting law (usually 5 years from the end of the calendar year in which the tax payment deadline expired).
• Image published in the portfolio: published until the consent given for the publication of the image is withdrawn.
• Analytics data: in accordance with the retention cycle of Google Analytics (by default up to 14 months).

6. Your rights

Under the GDPR, you have the following rights:

• The right of access to your data and to obtain a copy of it (Article 15 GDPR),
• The right to rectification (correction) of your data (Article 16 GDPR),
• The right to erasure (“the right to be forgotten”) in the cases provided for by law (Article 17 GDPR),
• The right to restriction of processing (Article 18 GDPR),
• The right to data portability (Article 20 GDPR),
• The right to object to processing based on legitimate interest (Article 21 GDPR),
• The right to withdraw consent at any time — without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa), if you believe that the processing of your data infringes the GDPR.

To exercise your rights, please get in touch at: dominikaskrzypek@gmail.com.

7. Cookies

The Website uses cookies — small text files stored on the User’s end device.

• Strictly necessary cookies: enable the Website and its basic mechanisms to function properly.
• Analytics cookies: (including Google Analytics) help us understand how Users use the Website, which allows us to improve it.

Users may change their cookie preferences at any time using their web browser settings (including blocking or deleting cookies completely). Restricting the use of technical cookies may affect the proper functioning of some features of the Website.

8. Data security

The Controller makes every effort to ensure the security of the personal data processed by applying appropriate technical and organisational measures, including:

• encryption of the connection using the SSL/TLS protocol,
• securing access to email accounts and systems with highly complex passwords and two-factor authentication (2FA),
• regular updates of the software and the website’s CMS.

9. Changes to the Privacy Policy

The Controller reserves the right to update this Privacy Policy in the event of changes in the law or the implementation of new technological solutions on the Website. The current version of the document is always published at dominikaskrzypek.pl together with the date of the last update.

Date of last update: 4 October 2026