If you landed on this page, it means that the protection of your personal data is important to you. I want to assure you that I care about your privacy. I collect and process your data only when it is necessary.

The Privacy Policy may change, so stay up-to-date with it. Changes may be due to the development of internet technology, changes in generally applicable law, or the development of the site. The publication date of the current Privacy Policy is at the bottom of the page.

In accordance with GDPR, below I present the rules for processing your personal data by my company. Familiarize yourself with the most important questions concerning your personal data, and if you have any doubts about the privacy policy, please contact us at the address: info@natalialowicka.pl

PRIVACY POLICY

§1 Who is the Administrator of your personal data? The Data Administrator is Natalia Łowicka, conducting business under the name Atelier Natalia Łowicka, located in ul. Sienkiewicza 49/107, 15-092 Białystok, NIP 5423306789, REGON 369882600. You can contact the Administrator by writing to the e-mail address: info@natalialowicka.pl .

§2 For what purpose do we collect your data and how long do I store it? Data may be processed for the following purposes:

1. Communicating with you, including responding to inquiries sent through the contact form, email, Messenger, etc.

Data will be processed based on the legitimate interest of the Administrator, in the form of communication with Website Users (art. 6 ust. 1 lit. f RODO). Your data will be processed until you object or the business purpose ceases. Providing this data is voluntary, but also necessary for communication with you. Data may also be processed during the archiving process for internal purposes, based on the legitimate interest of the Administrator (art. 6 ust. 1 lit. f RODO), until objection or cessation of the business purpose.

2. Taking steps necessary to prepare an offer at your request or to conclude and execute a contract (placing an order);
3. Determining, defending, and pursuing claims;
4. Implementing legal obligations (e.g. tax and archiving obligations);

Data necessary for concluding and implementing the contract will be processed for the duration of the contract, including the period of execution of the rights arising from the contract, such as (Art. 6(1)(b and f) GDPR). Providing this data is voluntary, but also necessary to conclude and execute the contract. Additional data provided, e.g. to streamline the implementation of the contract, will be processed no longer than until you object or the business purpose ceases, based on the legitimate interest in customer service (Art. 6(1)(f) GDPR). After this time, data will be processed for the period of limitation of claims, based on the legitimate interest of the Administrator to defend against claims, as well as to determine and pursue claims (Art. 6(1)(f) GDPR). If data is necessary to fulfill legal obligations, imposed on the Administrator (e.g. issuing and storing invoices) – data will be processed for this purpose no longer than 6 years (archiving obligations for accounting documents), unless the law requires a longer period (Art. 6(1)(c) GDPR). Data may also be archived for internal and statistical purposes, until you object or the business purpose ceases, based on the legitimate interest of the Administrator (Art. 6(1)(f) GDPR).

5. Providing marketing information (e.g. sending newsletters and information about paid and free products and services, promotions, free content using other tools, e.g. chatbot, phone);

Data will be processed based on the legitimate interest of the Administrator, in the form of marketing products and services of the Administrator (Art. 6(1)(f) GDPR). Data will be processed until you object or the business purpose ceases, whichever occurs first. Providing data is voluntary but necessary to receive marketing/commercial information.

In accordance with Art. 10 of the Act on the provision of electronic services, for the purposes of maintaining commercial and telephone communication, I need your consent. You can withdraw it at any time by clicking the link in the footer of the email or writing to me at the address provided above.

6. Administering and managing pages and groups on social platforms (Facebook, (Meta), Instagram, LinkedIn, TikTok, Youtube), in the case of data processing on social platforms, including communication and directing marketing content;

This data will only be processed when you decide to: like / follow / subscribe to a page / join a group or otherwise leave your data on a platform managed by me, e.g. in the form of a post or comment. Data will be processed for the duration of the page/group or until you object, which can be done by unchecking the „Like” or „Follow” options, deleting a comment/post, or in another way provided for on the platform/page or by contacting me. Please note that the rules relating to the page/fanpage/group are set by the Administrator, while the rules for using the social media portal on which the page/fanpage/group is located are set by the entity managing these portals.

7. Analytical and statistical;

Data processing for analytical and statistical purposes mainly involves analyzing data obtained automatically when using the website, including cookies. Data is processed based on the legitimate interest of the Administrator, in adapting the content of the Website to the preferences of the User and optimizing the use of the Website; creating statistics that help understand how Users use the Website, allowing its structure and content to be improved (Art. 6(1)(f) GDPR). Data may also be archived for internal and statistical purposes, based on the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), until you object or the business purpose ceases.

8. Recovering abandoned carts;

If you do not complete your order, you will receive a reminder of the started but not finalized order. Data will be processed based on the legitimate interest of the Administrator, in serving potential and actual Customers (Art. 6(1)(f) GDPR). This data will be processed for the time necessary to achieve business purposes or until you object.

9. Promotion and marketing;

If you provide us with your data, especially in the form of an opinion about a product or service, including data on the image, they will be processed based on the legitimate interest of the Administrator in the form of marketing, to improve the quality of services and products and promote the Administrator’s services and products. This data will be processed for the period necessary to achieve business goals or until you object. Providing data is voluntary.

10. Recruitment;

Data may be processed for the time necessary for the recruitment process and the conclusion of a contract (Art. 6(1)(b) and Art. 6(1)(c) of the GDPR), and in the case of additional data provided voluntarily – based on your consent. They may also be used for future recruitment purposes – based on the consent you have given – for a period of up to 3 years (this period is counted from the end of the year in which the application was obtained). The provision of personal data is voluntary, however, providing some data may be necessary for the recruitment process and for the conclusion of a contract. The consequence of not providing this data will be the non-performance of the aforementioned actions.

§3 To whom can we disclose your data?

We disclose your data to other entities only when it is necessary for the purposes of processing mentioned in §2 and only to the extent necessary to achieve this purpose. As a rule, we collect and process only the data you provided us with, except for data collected automatically (cookies). More about cookies can be found in §7.

If necessary, your data may be transferred to entities we cooperate with in achieving the above purposes, in particular: entities providing hosting, IT, cloud, marketing, administrative, consulting, accounting, invoicing software, newsletter services, subcontractors, lawyers, couriers or mail operators, training platforms, social media platforms, customer service platforms, appointment booking platforms, product or service sharing platforms, and other entities supporting the Administrator in processing purposes.

As a rule, the data will not be transferred outside the EEA, except in the situations described below. In other cases, if the data is transferred outside the EEA, it will be based on your consent, standard contractual clauses or other safeguards provided for in the GDPR, after fulfilling the information obligation. Services provided by Google or Facebook (META) are, in principle, performed by entities based in the European Union. However, due to the global nature of these entities, your data may be transferred to the USA, as they are stored on American servers (in whole or in part). Regardless of this, Google and Facebook have implemented safeguards in accordance with GDPR requirements, using standard contractual clauses. More information on data processing by the aforementioned providers can be found in their Privacy Policies. Your data (if required for the purpose of processing) can also be transferred outside the EEA to the following entities:

1. Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518 (appointment booking platform)
2. Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113 (video-conference platform)

§4 What rights do you have?

Under the GDPR, you have the right to access your personal data, correct your personal data, delete your personal data, restrict the processing of your personal data, object to the processing of your personal data, transfer your personal data, and withdraw your consent to the processing; withdrawing your consent does not affect the legality of processing performed before its withdrawal. Detailed information on these rights can be found in the GDPR regulation, i.e., Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). If you believe that your personal data is processed unlawfully, you have the right to complain to the President of the Personal Data Protection Office. However, I encourage you to contact me first to clarify your concerns.

§5 Is your data being profiled?

The Administrator analyzes personal data automatically, using tools provided by software vendors (e.g., through statistics, history), only to the extent that it does not have any legal effects on you or significantly affect your situation, including guaranteed rights and freedoms. The purpose of automated data processing is to get to know the preferences of Users (more information on the analysis can be found in §7 Cookie Policy).

§6 Legal regulations applicable to personal data

In matters not regulated, the relevant provisions of the law, including European law (e.g., GDPR), apply.

§7 Cookie Policy

The website does not automatically collect any information, except for information contained in cookies. This data is collected in a way that does not allow for the identification of the User, i.e., anonymous data. Cookies are computer data, especially text files, stored on the User’s end device and intended for use on the Website. Cookies usually contain the name of the website they come from, the duration of their storage on the end device, and a unique number. Cookies are used to adapt the content of the Website to the User’s preferences, optimize the use of the Website, and create statistics that help understand how Users use the Website, allowing its structure and content to be improved. You can make changes to the cookie settings yourself. In many cases, web browsers by default allow cookies to be stored on the User’s end device. Detailed information on the possibilities and ways of handling cookies can be found in the software settings (web browser). Not consenting to cookies may limit some functionalities on the Website.

The Administrator uses technologies that observe the actions taken by the User within the Website:

• Facebook (Meta) conversion pixel provided by Meta Platforms Ireland Limited – for managing ads on Meta and conducting remarketing activities; Facebook Pixel is a piece of code published on a website that allows targeting a specific audience based on data from people who have used the website. Therefore, the Facebook Pixel function enables displaying published ads on Meta portals exclusively to portal users who have shown interest in products or services or have common factors with the aforementioned persons. This data is processed based on the legitimate interest of the Administrator (Article 6(1)(f) GDPR). Detailed information about the Facebook Pixel can be found on the Facebook (Meta) Privacy Policy page.
• Google tools, including Google Analytics provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The data obtained from using these tools is used for website statistics analysis. Google Analytics uses its cookies to analyze the actions and behaviors of Website Users. These files are used to store information, e.g., from which website the User came to the current website. They help improve the Website. This data is processed based on the legitimate interest of the Administrator (Article 6(1)(f) GDPR). Detailed information about Google Analytics can be found on the page: Google tools usage rules.

§8 Social plugins

The website uses plugins, widgets, and other social tools provided by portals such as: Facebook (Meta), Instagram, Tiktok, YouTube, LinkedIn. The rules for processing personal data are described directly on the websites of these Service Providers.

§9 Co-administration

Data processed for statistics collected on the Facebook (Meta) platform is co-administered by the Administrator and Meta Platforms Ireland Limited, located at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, hereinafter referred to as the Co-administrator. Detailed rules regarding data co-administration, including information about rights, are described on the Privacy Policy page.

Data processed within the LinkedIn platform are co-administered by the Administrator and LinkedIn Ireland Unlimited Company, address: Legal Dept. (Privacy Policy and User Agreement), Wilton Place, Dublin 2, Ireland, hereinafter referred to as the Co-administrator. Detailed rules regarding data co-administration, including information about rights, are described on the Privacy Policy page.

Data processed within the TikTok platform are co-administered by the Administrator and TikTok Technology Limited, a company registered in the Republic of Ireland, with its registered office at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, company number 635755, hereinafter referred to as the Co-administrator. Detailed rules regarding data co-administration, including information about rights, are described on the Privacy Policy page.

Data processed within the YouTube platform are co-administered by the Administrator and Google Ireland Limited, Gordon House Barrow Street Dublin 4, hereinafter referred to as the Co-administrator. Detailed rules regarding data co-administration, including information about rights, are described on the Privacy Policy page.

The Administrator processes data based on the legitimate interest of the Administrator, which consists of analyzing the activity of Users and their preferences, in order to improve the functionalities used and services provided. In matters related to personal data, you can contact both the Administrator and the Co-administrator.

Update: June 27, 2023.

Link to original Polish version.