Privacy Policy
Version 2.0 · Last updated: 2 June 2026
In short
- We only collect personal data you voluntarily send us through the contact form: your name, email, and optionally phone, message and budget.
- We use it solely to reply to you and discuss a possible collaboration. We never sell your data and never use it for advertising.
- We do not use analytics, marketing cookies, or tracking pixels. The only technical data we touch is what is needed to serve the site and keep it secure (e.g. your IP address for spam protection).
- The shopping basket is stored only in your browser and never reaches our servers.
- You can access, correct, delete, restrict, port or object to your data at any time. See “Your rights”.
1. Who is the data controller
The controller of your personal data is Studio VEJF Paulina Kuchta-Leśniak, a sole proprietorship registered in Poland.
- Address: Osiedle Kasprusie 8 lok. 10, 34-500 Zakopane, Poland
- NIP: 7361754250
- REGON: 542427010
- Contact for data matters: contact@studiovejf.com
In this policy, “we”, “us” or “Studio VEJF” means the controller named above, and “the website” means the site available at studiovejf.com.
2. Whose data we process and where we get it
We process the data of people who contact us through the website. We receive all of it directly from you, at the moment you fill in and submit the contact form. We do not buy data or obtain it from third parties.
3. What data we collect
Contact form data (you decide what to share):
- name and surname,
- email address,
- phone number (optional),
- message content,
- estimated budget (optional).
Technical data needed to run and protect the website:
- IP address (used for spam protection / rate limiting on the contact form),
- user-agent (basic information about your browser / device),
- an essential session cookie used by the hosting platform for security; the site does not work without it.
Stored only in your browser (never sent to us):
- the contents of your shopping basket, kept in your browser’s local storage so the store remembers your selection.
We do not use analytics tools (such as Google Analytics), marketing or advertising cookies, or any profiling tools. Providing your name and email is necessary to send us a message; the remaining fields are optional.
4. Special categories of data (Art. 9 GDPR)
We never ask for special categories of data (such as health, beliefs, or similar). Please do not include such information in the free-text message field. If you choose to provide it voluntarily, we will treat that as your explicit consent to process it (Art. 9(2)(a) GDPR), which you may withdraw at any time by writing to contact@studiovejf.com.
5. Why we process your data (purposes and legal bases)
Responding to your inquiry and communicating with you about a potential collaboration (handling the contact form).
Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to messages sent to us (Art. 6(1)(f) GDPR).
Keeping the website secure: protection against spam, abuse and unauthorised access (rate limiting, honeypot, server logs).
Our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
Remembering the items you add to your shopping basket so the store works (stored only in your browser).
Our legitimate interest in providing a working store feature (Art. 6(1)(f) GDPR). This data never leaves your device.
Complying with our legal obligations (e.g. accounting and tax records, responding to lawful requests from authorities).
Legal obligation (Art. 6(1)(c) GDPR).
Establishing, exercising or defending legal claims.
Our legitimate interest (Art. 6(1)(f) GDPR).
We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.
6. Who has access to your data
Only Studio VEJF reads the messages you send. We share data with the technical service providers below, which act on our behalf under data processing agreements (Art. 28 GDPR) and do not use your data for their own purposes:
- Vercel Inc. (USA): Website hosting. May process limited technical data (such as IP addresses and request logs) as part of serving the website.
- Resend (Resend Inc., USA): Transactional email delivery for contact form submissions. Processes your form data solely to deliver your message to us.
- Vimeo Inc. (USA): Video hosting. Embedded players on the site may process technical data (such as IP addresses) when a page with a video loads.
In specific cases we may be required to disclose data to public authorities (e.g. courts or law enforcement), but only where there is a clear legal basis and only to the extent required.
7. Transfers outside the European Economic Area
Some of our providers (Vercel, Resend, Vimeo) are US companies, so some data may be processed in the United States. Such transfers are based on the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU–US Data Privacy Framework. You can request a copy of the relevant safeguards by writing to contact@studiovejf.com.
8. How long we keep your data
Contact form data (name, email, phone, message, budget)
For as long as needed to handle your inquiry and any follow-up. If no collaboration results, we delete it within 12 months of our last contact.
Technical / security data (IP address, user-agent, server logs)
Kept for a short period for security and diagnostics, then deleted or anonymised, typically within a few weeks.
Shopping basket (local storage)
Stored only in your browser until you clear your basket or your browser data. We never receive or store it.
Accounting / tax records
For the period required by Polish law (generally up to 5 years).
Data needed to defend claims
Until the relevant limitation periods under the Polish Civil Code expire.
9. Your rights
Under the GDPR you have the following rights. You can exercise any of them by writing to contact@studiovejf.com. We will respond within one month (which may be extended by a further two months for complex requests, in which case we will let you know).
Access (Art. 15)
Request a copy of the personal data we hold about you.
Rectification (Art. 16)
Correct inaccurate or incomplete data.
Erasure (Art. 17)
Have your data deleted (the “right to be forgotten”).
Restriction (Art. 18)
Restrict how we process your data.
Portability (Art. 20)
Receive your data in a structured, commonly used format (e.g. JSON / CSV).
Objection (Art. 21)
Object to processing based on our legitimate interest (see “Why we process your data”).
Withdraw consent
Where processing is based on consent, withdraw it at any time. This does not affect processing carried out before withdrawal.
You also have the right to lodge a complaint with the supervisory authority. In Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
10. Data security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure, including:
- encryption in transit (TLS) between your browser and our servers,
- access limited to the people who genuinely need it,
- data processing agreements with every technical provider,
- basic anti-spam safeguards on the contact form (rate limiting, honeypot).
If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, in line with Art. 34 GDPR.
11. Cookies and local storage
The website uses only storage that is strictly necessary: an essential session cookie for security, and your browser’s local storage to remember your shopping basket. We do not use analytics, advertising or marketing cookies. Because these are strictly necessary, they do not require separate consent (in line with Art. 399(3) of the Polish Electronic Communications Law). You can clear or block this storage in your browser settings, though the site may then not work correctly.
12. Changes to this policy
We may update this policy when the way we process data changes or when the law requires it. The current version and its date are shown at the top of this document. For any questions, write to contact@studiovejf.com.