Skip to content
KShevchenko.art
※ Legal documents

Privacy Policy

This Privacy Policy explains what personal data is processed in connection with the use of the Kshevchenko website at kshevchenko.art — photo session bookings, contact and enquiry handling — for what purposes, on what legal basis, and what rights data subjects have.

1. Data Controller

The data controller is Kateryna Shevchenko (działalność jednoosobowa), with its registered address at Zawiszy Czarnego 6, 40-872 Katowice, Polska.

NIP (Polish tax ID): 6343060594, REGON: 542705577.

Privacy contact: k.shevchenko.gallery@gmail.com, phone: +48 732 959 892.

2. Scope of Data Collected

The website is a personal portfolio. Personal data is processed only when voluntarily provided by the User or when strictly necessary for the website to function.

Situation Data scope
Sending a message via the contact form name (or pseudonym), email address, message content, optionally phone number
Booking a photo session name, email address, phone number, preferred date and session type, location
Visiting the website IP address, basic browser technical data, session identifier (cookies)

No data outside the above scope is collected.

Personal data is processed for the following purposes:

  1. Replying to enquiries sent via the contact form and arranging a photo session — legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract and performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest of the Controller in maintaining contact with persons interested in photography services).
  2. Ensuring the website operates correctly (sessions, abuse protection, security) — legal basis: Art. 6(1)(f) GDPR.
  3. Compliance with legal obligations of the Controller (e.g. accounting, archiving of business correspondence) — legal basis: Art. 6(1)(c) GDPR.
  4. Publishing the data subject's image in the portfolio and promotional materials (website, Instagram, printed materials) — only after a separate, voluntary consent has been given — legal basis: Art. 6(1)(a) GDPR and Art. 81(1) of the Polish Act of 4 February 1994 on copyright and related rights. Consent may be withdrawn at any time.
  5. Establishment, exercise or defence of legal claims — legal basis: Art. 6(1)(f) GDPR.

4. Retention Period

  • Contact form correspondence: 12 months from the last contact, unless a longer period results from a contract or legal obligation.
  • Photo session contract data (e.g. invoices): for the period required by accounting regulations — generally 5 years from the end of the fiscal year.
  • Technical and security logs: up to 12 months.
  • Files from a completed session (Controller's working copy): up to 24 months after the finished gallery is delivered to the Client, unless otherwise agreed by the parties.

5. Recipients of Data

Personal data may be entrusted to the following categories of recipients acting on behalf of the Controller:

  • EU hosting infrastructure provider (region: UE, country: Litwa, Wilno) — application and database hosting.
  • Mailgun (Sinch) (UE (Frankfurt)) — delivery of transactional messages (https://www.mailgun.com/).
  • Accounting office and legal advisors — to the extent required by law.

Data is never sold or shared with third parties for marketing purposes.

6. Transfers Outside the EEA

The Controller does not transfer personal data outside the European Economic Area. All sub-processors entrusted with data are located or process data within the EEA.

7. Cookies

Cookie practices are described in a separate document — the Cookies Policy.

8. Data Subject Rights

Each data subject has the following rights under GDPR:

  • access to data and obtaining a copy,
  • rectification of inaccurate data or completion of incomplete data,
  • erasure of data ("right to be forgotten"),
  • restriction of processing,
  • data portability,
  • objection to processing based on legitimate interest,
  • withdrawal of consent at any time (where processing is consent-based),
  • lodging a complaint with the supervisory authority — Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl.

To exercise these rights, contact k.shevchenko.gallery@gmail.com.

9. Profiling and Automated Decisions

Personal data is not used for profiling or for fully automated decision-making.

10. Security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction — including connection encryption (HTTPS), password hashing, restricted access to the admin panel, and regular backups.

11. Changes to This Policy

This policy may be updated. The latest version is always available at /polityka-prywatnosci. Material changes may be additionally communicated (e.g. by an on-site notice).

12. Contact

For matters concerning the processing of personal data, please contact us by email: k.shevchenko.gallery@gmail.com.