of the juda-pietkiewicz.com website

Last updated: 2 September 2026

This document provides information on the rules for processing personal data and using cookie technologies on the juda-pietkiewicz.com website. The Policy should be read together with the consent settings available on the website.

1. Data controller

The controller of personal data is Atelier Mody Marta Pietkiewicz, ul. Nowogrodzka 10/14, 00-511 Warsaw, e-mail: info@juda-pietkiewicz.com (hereinafter: the “Controller”).

For matters concerning the processing of personal data and the exercise of rights under the GDPR, you may contact the Controller at: info@juda-pietkiewicz.com.

2. Scope of the Policy

This Privacy Policy describes the rules for processing personal data of persons using the juda-pietkiewicz.com website, in particular persons contacting the Atelier via the contact form, e-mail or telephone.

The Policy also covers information about cookies and similar technologies used by the website.

3. Contact form and arranging visits

The contact form is operated by the Contact Form 7 plugin. It may collect: first name, last name, e-mail address, message content and — if the user chooses to provide them — a wedding date, information about a first visit to the atelier, and preferred fitting days or times.

Data provided in the form are processed in order to handle the enquiry, contact the interested person, and arrange and organise a visit to the atelier. The legal basis is Article 6(1)(b) GDPR — processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.

Providing data is voluntary. Data marked as required in the form are, however, necessary to handle the enquiry and arrange a visit.

The content of submissions is not stored permanently in the WordPress database. The form sends a message to info@juda-pietkiewicz.com, and the data are retained in the e-mail system in accordance with the retention rules described below.

4. E-mail and telephone contact

If a user contacts the Controller directly by e-mail or telephone, data provided in the course of such contact are processed in order to reply, conduct correspondence and — where the contact concerns the Atelier’s services — take steps prior to entering into a contract or in connection with its performance.

The legal basis is, as applicable, Article 6(1)(b) GDPR, and, as regards ongoing organisational correspondence and protection against claims, also Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in efficient communication and in establishing, exercising or defending legal claims.

5. Hosting, e-mail and technical data

The website and e-mail in the juda-pietkiewicz.com domain are operated by home.pl S.A. with its registered office in Szczecin, ul. Zbożowa 4, 70-653 Szczecin. home.pl S.A. processes data on behalf of the Controller to the extent necessary to provide hosting and e-mail services, on the basis of a data processing agreement.

In connection with use of the website, technical data recorded in server logs may also be processed, such as IP address, date and time of the request, information about the browser or device, and the requested resource. These data are used to ensure security, diagnose errors and ensure the proper operation of the website. The legal basis is Article 6(1)(f) GDPR — the Controller’s legitimate interest in ensuring the security and stability of the website.

6. Google reCAPTCHA v3

The contact form uses Google reCAPTCHA v3 to protect against spam and automated abuse of the form. The service may process technical data related to use of the website, including IP address, device and browser information, data on interaction with the page, and information stored or read by Google technologies.

As regards the processing of personal data, the legal basis is Article 6(1)(f) GDPR — the Controller’s legitimate interest in securing the form and the website against spam, abuse and automated attacks. To the extent that the use of reCAPTCHA involves storing information or accessing information on the user’s terminal equipment and requires consent under the Electronic Communications Law, that technology is used in accordance with the consent settings on the website.

The reCAPTCHA service is provided by Google. Detailed information on Google’s data processing rules is available in the Google Privacy Policy.

7. Google Maps

A Google Maps map may be displayed on the Contact page. Google Maps is third-party content and may result in technical data being transferred to Google, such as IP address, device and browser information, as well as the use of cookies or similar technologies.

Google Maps is loaded on the basis of the user’s consent, if obtaining it is required under the website configuration. The legal basis for processing personal data in that case is Article 6(1)(a) GDPR. Consent may be withdrawn at any time via Cookie settings, without affecting the lawfulness of processing carried out before its withdrawal.

8. Meta Pixel and Conversions API

After marketing consent is obtained, the website may use Meta tools, in particular Meta Pixel and Conversions API, to measure the effectiveness of marketing activities, record conversions and optimise ads displayed in Meta services such as Facebook and Instagram.

In connection with the use of these tools, event data relating to use of the website may be transferred to Meta. For an event related to sending the form, the tool configuration may also include contact identifiers such as e-mail address, first name and last name, used to match the event. These data should not be transferred to Meta before the relevant marketing consent is obtained.

The legal basis for processing on the Controller’s side is Article 6(1)(a) GDPR — consent. Consent may be withdrawn at any time via Cookie settings. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The provider of the tools for users in the European Economic Area is, as a rule, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. To the extent specified in Meta’s terms for business tools, the Controller and Meta may act as joint controllers with regard to the collection and transmission of certain event data. Meta may then process the data on its own terms.

9. Google Analytics

As of the last update of this Policy, Google Analytics 4 is not active on the production version of the website. If the tool is enabled, this Policy will be updated, and analytics will be run in accordance with the requirements concerning consent and cookie settings.

10. Cookies and consent management

The website uses cookies and similar technologies. Some of them are necessary for the proper operation of the website and for managing privacy preferences. Other technologies, in particular analytics, marketing or those used to load certain third-party content, are enabled according to the user’s choice if the law requires prior consent.

Preferences can be managed via the Cookie settings panel available on the website. The user may refuse consent or later withdraw or change it. Refusal of consent to marketing or analytics technologies should not prevent sending the contact form.

Information about the use of cookies or similar technologies is provided to the user before they are used, to the extent required by Article 399 of the Electronic Communications Law.

11. Recipients of data

Personal data may be disclosed to entities supporting the Controller in operating the website and handling contact, solely to the extent necessary to provide those services. In particular, recipients or processors may include:

• home.pl S.A. — website hosting and e-mail;
• Google — in connection with Google reCAPTCHA and Google Maps;
• Meta Platforms Ireland Limited and entities in the Meta group — solely to the extent resulting from the use of Meta Pixel and Conversions API after the required consent is obtained;
• entities providing IT or maintenance services to the Controller, if access to the data is necessary to perform those services and has been appropriately regulated.

The Controller may also disclose data to competent public authorities if such an obligation arises from the law.

12. Transfers of data outside the EEA

Use of Google and Meta services may involve processing of data outside the European Economic Area, in particular in the United States. If such a transfer takes place, it is carried out using the mechanisms provided for in Chapter V GDPR, as appropriate to the specific data flow, in particular on the basis of a European Commission adequacy decision (if applicable) or standard contractual clauses together with the required safeguards.

Detailed information on the data transfer rules and safeguards applied by Google and Meta is available in those providers’ privacy documents.

13. Data retention period

Data related to an enquiry sent via the form or e-mail are stored for the period necessary to handle the enquiry and organise a visit, as a rule no longer than 12 months from the last contact if no contract is concluded.

If the contact leads to a contract being concluded, data needed to perform the contract may be processed for the duration of its performance, and then for the period required by law or necessary to establish, exercise or defend legal claims.

Data processed on the basis of consent are processed until the consent is withdrawn or the purpose of processing ceases earlier, subject to data that may continue to be processed on another legal basis.

Technical logs are stored for a period justified by the security and administration of the website, in accordance with the configuration of the hosting infrastructure.

14. Rights of data subjects

On the terms set out in the GDPR, the data subject has the right to:

• access their data and obtain a copy;
• rectify data;
• erase data;
• restrict processing;
• data portability — where the conditions for that right are met;
• object to processing based on Article 6(1)(f) GDPR;
• withdraw consent at any time if processing is based on consent; withdrawal of consent does not affect the lawfulness of earlier processing.

To exercise your rights, you may contact the Controller at info@juda-pietkiewicz.com.

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

15. Automated decision-making

Data provided to the Controller via the contact form are not used by the Controller to make decisions concerning the user based solely on automated processing that would produce legal effects or similarly significantly affect the user.

Third-party advertising tools may carry out their own profiling operations in accordance with their rules, if the user has consented to the use of marketing technologies.

16. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. The website uses an encrypted HTTPS connection. Access to systems and e-mail is limited to persons who need it to perform their duties.

17. Changes to the Privacy Policy

The Policy may be updated in the event of changes in the law, the way the website operates, or the providers and tools used. The current version is published on the website together with the date of the last update.

18. Useful information and provider documents

• GDPR — text of the regulation (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=en
• Electronic Communications Law — text of the Polish act: https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20240001221/O/D20241221.pdf
• home.pl — data processing agreement: https://regulaminy.home.pl/umowa-powierzenia-przetwarzania-danych-osobowych.pdf
• Google — Privacy Policy: https://policies.google.com/privacy?hl=en
• Meta — Meta Business Tools terms: https://www.facebook.com/legal/technology_terms
• Meta — Controller Addendum: https://www.facebook.com/legal/controller_addendum
• Meta — Privacy Policy: https://www.facebook.com/privacy/policy/