Privacy policy
and cookies

Data controller

Who is responsible for your data

Picture Production (Produkcja Obrazu) sp. z o.o.
ul. Ketlinga 7, 83‑050 Łapino, Poland
VAT ID: 6040257866
kontakt@produkcjaobrazu.com

We have not appointed a data protection officer — for anything concerning privacy, please write to the address above.

The miloscwobrazie.pl website

What this website does not do

This website does not store cookies. We do not use Google Analytics or any other analytics, we do not embed advertising pixels, social plugins or external fonts. All scripts, styles and fonts are served from our own server, so simply browsing the site sends no information about you to third parties.

The only thing the site saves in your browser is the mwo_cookie_notice_dismissed marker in local storage (localStorage) — after you click „Got it” under the cookie notice, so that it is not shown again. It holds no data about you and you can delete it at any time in your browser settings.

The Instagram links and phone numbers are ordinary links — only clicking them takes you to an external service, which has its own privacy policy.

Contact

When you write or call

There is no contact form on the site. Contact is by e-mail or telephone, given on the Contact page. We then process the data you send us yourself — your name, e-mail address or phone number, the date and place of the planned celebration, and the content of your message.

The basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR), and after the contract is concluded — performance of the contract and our legitimate interest in maintaining correspondence (Art. 6(1)(b) and (f) GDPR).

Server logs

What the server records

The site runs on OVH servers in the European Union. The server records in its technical logs the IP address, the browser type, the address of the requested page and the time of access. We do this for security and diagnostics, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). We do not link the logs to any profile and we do not use them for marketing.

The private photo gallery

The gallery works differently from the website

The code from your invitation opens a private gallery at galeria.miloscwobrazie.pl. It is a separate application and — unlike this site — it does store cookies and data about how the album is used.

Once you enter an album, the gallery stores:

• An album access cookie — confirming that the code was entered correctly. Valid for 24 hours.
• Cookie gallery_visitor — a random, signed visitor identifier, valid for 365 days. It holds neither your name nor your e‑mail address, but it lets us recognise the same browser on later visits.
• Likes and download history linked to that identifier — so that your hearts do not disappear between visits, and so that we know which frames were downloaded.
• The selection of photos for printing — stored for the album as a whole, not against any one person's identifier. Anyone who knows the code can see the selections, and they do not disappear when cookies are cleared.
• The IP address and the time of entry to the album — in the security log, together with whether the code was correct. This protects your photographs against code guessing.

Because the visitor identifier is linked to a record of activity, this data is not fully anonymous — the GDPR treats such pseudonymised data as personal data. The basis is performance of the contract for providing the album (Art. 6(1)(b) GDPR) and our legitimate interest in protecting the gallery against unauthorised access (Art. 6(1)(f) GDPR).

You can delete the gallery_visitor cookie in your browser settings — you will lose your likes, but access to the album and the shared choice of photos for printing will remain. You can also write to us and we will remove the data linked to your album.

Photographs

Likeness on the website and in the gallery

The photographs in the portfolio and on the blog show recognisable people, so they are personal data. We publish them on the basis of consent from the people photographed (Art. 6(1)(a) GDPR and Art. 81 of the Polish Act on Copyright and Related Rights), given in the photography contract or separately.

Consent can be withdrawn at any time — write to kontakt@produkcjaobrazu.com and we will remove the photographs concerned from the portfolio, the blog and social media. Withdrawing consent does not affect the lawfulness of publication before the withdrawal.

Photographs in private galleries are not published — only someone who knows the code has access, and they are not indexed by search engines.

Data recipients

Who we entrust data to

We do not sell data and we do not share it for marketing purposes. We use providers who process data solely on our instructions:

• OVH — website hosting and the gallery server (European Union).
• Adobe (Frame.io) — the service the private gallery fetches photographs from for display. This applies only to code-protected albums; photographs in the portfolio and on the blog are on our own server and do not pass through Frame.io. It involves transferring data outside the European Economic Area (the United States), on the terms set out by the provider.
• Resend — sending the e-mails related to sharing an album.

We may also disclose data to bodies entitled to it under the law, should they request it.

Retention period

How long we keep data

• Correspondence — for the duration of discussions about working together, and after a contract is concluded for the period of its performance and the limitation period for claims.
• Your private gallery — with no time limit. The album stays for as long as you want it; we do not delete it after the season or after a year. Just write to us and we will remove it along with the likes, the download history and the print selections.
• Photographs published in the portfolio and on the blog — until consent is withdrawn.
• The security log (IP address and time of entry to an album) — 12 months, then deleted automatically.
• Technical logs of the hosting server — according to the configuration and policy of the hosting provider (OVH).

Your rights

What you can do

You have the right to:

• access your data and receive a copy of it,
• rectify inaccurate data,
• erase your data,
• restrict processing,
• port data that we process on the basis of consent or a contract,
• object to processing based on a legitimate interest,
• withdraw consent at any time.

We do not take decisions about you by automated means and we do not use profiling.

If you believe we are processing your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00‑193 Warsaw, Poland.