GDPR and Data Protection

Последнее обновление: 03.05.2025

1. Introduction

Wawafot respects your privacy and is committed to complying with all requirements of the General Data Protection Regulation (GDPR). This document explains how we process your personal data in accordance with GDPR.

2. Who is the Data Controller

The data controller for information collected through this website is the Photographer (an individual permanently residing in Poland), owner of the wawafot.com website.

3. What Personal Data We Collect

Depending on your interaction with our website, we may collect the following personal data:

Identification information (first name, last name)
Contact information (email, phone number)
Technical data (IP address, browser type and version, operating system)
Photographs and images that were created during the provision of services

4. Legal Basis for Data Processing

We process your personal data on the following legal grounds according to GDPR:

Consent (Article 6(1)(a) GDPR): When you give your explicit consent to the processing of your personal data for one or more specific purposes.
Performance of a Contract (Article 6(1)(b) GDPR): When processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.
Legitimate Interests (Article 6(1)(f) GDPR): When processing is necessary for the purposes of legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

5. Purposes of Data Processing

We process your personal data for the following purposes:

Providing photography services requested by you
Responding to your inquiries and questions
Improving our website and services
Complying with legal obligations
Marketing (only with your consent)

6. Recipients of Personal Data

We may share your personal data with the following categories of recipients:

Hosting providers who ensure the operation of our website
Fundacja Rozwoju Przedsiębiorczości "Twój StartUp" for billing and invoicing
Analytics services (e.g., Google Analytics)
Government authorities when required by law

7. International Data Transfers

Services located outside the European Economic Area (EEA) may be used to ensure the operation of the website and analytics. We ensure that any transfer of data outside the EEA is carried out with appropriate safeguards, such as standard contractual clauses approved by the European Commission.

8. Data Retention Period

We retain your personal data only for the period necessary for the purposes for which they were collected or to comply with legal requirements. Specific retention periods depend on the type of data and the purpose of processing:

Data for contract performance: for the duration of the contract and in accordance with accounting legislation requirements (usually 6 years)
Marketing data: until you withdraw your consent
Photographs and images: in accordance with the contract terms and copyright laws

9. Your Rights Under GDPR

In accordance with GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15 GDPR): The right to obtain confirmation as to whether we are processing your personal data and access to that data.
Right to Rectification (Article 16 GDPR): The right to rectify inaccurate personal data and to complete incomplete data.
Right to Erasure (Article 17 GDPR): The right to have your personal data deleted under certain circumstances.
Right to Restriction of Processing (Article 18 GDPR): The right to request restriction of processing of your personal data.
Right to Data Portability (Article 20 GDPR): The right to receive the data you provided in a structured, commonly used and machine-readable format.
Right to Object (Article 21 GDPR): The right to object to the processing of your personal data.
Right to Withdraw Consent (Article 7(3) GDPR): The right to withdraw your consent at any time.

10. How to Exercise Your Rights

To exercise any of the above rights, please contact us through the feedback form on our website. We will respond to your request within one month of receiving it.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with a data protection supervisory authority in your country or in the country where the alleged violation occurred.

12. Changes to the GDPR Policy

We may update this GDPR policy from time to time. Any changes will be published on this page with an updated date of the last change.

13. Contact Information

If you have any questions or requests regarding this GDPR policy or the processing of your personal data, please contact us through the feedback form on our website.