Privacy Policy
1. Data Controller
The controller of personal data collected through the website agnieszkaopala.pl (hereinafter: “Website”) is Agnieszka Opala, email: agnieszkaopala@wp.pl, phone: +48 602 138 681 (hereinafter: “Controller”).
The Controller takes special care to protect the interests of data subjects and ensures that collected data is processed in accordance with applicable law, including:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR),
- Applicable national data protection laws.
2. Scope of collected data
The Controller collects personal data in the following situations:
2.1 Contact form
- Full name
- Email address
- Subject
- Message content
2.2 Purchase of a painting via PayPal
- Data provided to PayPal for payment processing (name, email, shipping address)
2.3 Automatically collected data
- IP address
- Browser type and operating system
- Date and time of visit
- Pages viewed
- Referral source
3. Purposes and legal basis for processing
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to contact form messages | Art. 6(1)(b) GDPR (contract performance / pre-contractual steps) | Until correspondence ends, max. 12 months |
| Sale of paintings | Art. 6(1)(b) GDPR (contract performance) | 5 years (tax obligations) |
| Analytics and statistics | Art. 6(1)(a) GDPR (consent) | Until consent is withdrawn |
| Website security | Art. 6(1)(f) GDPR (legitimate interest) | Max. 30 days |
| Pursuing and defending claims | Art. 6(1)(f) GDPR (legitimate interest) | Until statute of limitations expires |
4. Data recipients
Personal data may be shared with the following categories of recipients:
- PayPal (Europe) S.a r.l. et Cie, S.C.A. — online payment processing
- Google Ireland Ltd — analytics services (Google Analytics) and video hosting (YouTube)
- Hosting provider — data storage on servers
- SMTP mail provider — sending messages from the contact form
The Controller does not sell or share personal data with third parties for marketing purposes.
5. Data transfers outside the EEA
In connection with the use of Google and PayPal services, personal data may be transferred to the United States. The transfer is carried out on the basis of:
- EU-U.S. Data Privacy Framework (European Commission adequacy decision of July 10, 2023),
- Standard Contractual Clauses (SCC) adopted by the European Commission.
6. Rights of data subjects
Under the GDPR, you have the following rights:
- Right of access to data (Art. 15 GDPR).
- Right to rectification of data (Art. 16 GDPR).
- Right to erasure (“right to be forgotten”) (Art. 17 GDPR).
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR).
- Right to object to processing (Art. 21 GDPR).
- Right to withdraw consent at any time (Art. 7(3) GDPR) — withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
- Right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office, Poland).
To exercise these rights, please contact us at: agnieszkaopala@wp.pl.
7. Data security
The Controller applies appropriate technical and organizational measures to ensure the protection of personal data, including:
- SSL/TLS encrypted connection
- Contact form protection against spam (honeypot, rate limiting)
- Access to data restricted to authorized persons only
- Regular software updates
8. Cookies
The Website uses cookies. Detailed information can be found in the Cookie Policy.
9. Profiling and automated decision-making
The Controller does not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.
10. Changes to the privacy policy
The Controller reserves the right to amend this Privacy Policy. Users will be informed of any changes through the publication of a new version on the Website.
Last updated: February 25, 2026