Privacy Policy and Terms of Use of the Website and Correspondence

1. Controller and scope of this document

The controller of personal data is Izabela Olszewska, conducting business activity based in Warsaw, Poland (“Controller”). You may contact the Controller at ••••••@••••••••.•• or by telephone at ••• ••• •••.

This document applies to the website olszewska.pl, its contact forms and technical functions, as well as business correspondence sent or received by the Controller, including e-mail messages and attachments. It also sets out the rules governing the use of materials made available through the website or correspondence.

2. Categories and sources of personal data

Depending on the relationship and method of contact, the Controller may process, in particular, name and surname, business or organisation represented, position or function, e-mail address, telephone number, information concerning an intended or ongoing project, correspondence and documents exchanged, as well as other information voluntarily provided in connection with a matter.

The website, hosting and security systems may process technical data such as IP address, request date and time, browser and device information, requested URL, referrer, language, security-event data and information necessary to operate privacy preferences.

Data is generally obtained directly from the data subject. In professional relationships it may also be obtained from a client, contractor, person representing an organisation, publicly available professional sources or public registers, where justified by the purpose of the contact.

3. Purposes and legal bases

Personal data may be processed to handle enquiries and related communications; take steps at the request of a data subject prior to entering into a contract; conclude and perform contracts; maintain professional and business relations; organise cooperation with clients, contractors and persons acting on their behalf; operate and secure the website and communications infrastructure; prevent abuse; maintain necessary technical records; comply with legal obligations; and establish, pursue or defend claims.

Depending on the circumstances, processing is based on Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR. Legitimate interests include, in particular, conducting professional correspondence, maintaining business relations, ensuring IT security, preventing abuse and protecting or pursuing claims. Where consent is legally required for a particular activity, Article 6(1)(a) GDPR applies.

4. Contact form and correspondence

Providing data in the contact form or correspondence is voluntary, but failure to provide information necessary to identify or handle a matter may make it impossible to respond or continue the requested communication. Data submitted in connection with an enquiry may also be used for subsequent communications concerning that matter and, where relevant, for steps preceding a contract or performance of a contract.

If the Controller contacts a person using data not obtained directly from that person, this policy is intended to provide the information applicable to that professional contact, subject to the exceptions provided by law.

5. Recipients, processors and technical providers

Data may be processed by entities supporting the Controller, in particular providers of hosting, IT administration, cybersecurity, e-mail delivery, cloud or backup services, professional advisers and other contractors, but only to the extent necessary for the relevant purpose and subject to an appropriate legal basis.

The technical services actually enabled on the website may change over time. The website may therefore display, below this policy, information about the services currently active in its configuration.

6. Transfers outside the EEA

If a provider used by the Controller processes data outside the European Economic Area, the transfer will be based on a mechanism permitted by the GDPR, as applicable, including an adequacy decision, standard contractual clauses or another lawful safeguard.

7. Retention

Correspondence and project-related data may be retained for the time necessary to handle the matter, maintain the relevant professional relationship and, where justified, until expiry of limitation periods for potential claims. Accounting or other legally required records are retained for the period required by law. Security and technical logs are generally retained for up to 30 days unless a particular event must be retained longer in order to investigate an incident, ensure security or establish, pursue or defend claims. Data processed solely on the basis of consent is retained until consent is withdrawn or the relevant purpose ceases, unless another legal basis permits further processing.

8. Rights of data subjects

Subject to the conditions laid down in the GDPR, a data subject may request access to personal data, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. A complaint may be lodged with the competent supervisory authority, in Poland the President of the Personal Data Protection Office.

9. Cookies, device storage and analytics

The website uses mechanisms necessary for its operation, security and the storage of privacy choices. Optional analytics technologies are activated only where the user has made the corresponding choice in the privacy manager. Privacy choices can be changed using the privacy settings available on the website.

Technologies that are not necessary for the provision of a service requested by the user are not intended to be activated before the legally required choice has been made.

10. Automated decision-making

The Controller does not use the website to make decisions producing legal effects or similarly significant effects solely by automated means within the meaning of Article 22 GDPR.

11. Security

The Controller applies organisational and technical safeguards appropriate to the nature of the website and communications, including mechanisms intended to limit abuse and unauthorised access. No method of transmission or storage on the Internet can guarantee absolute security.

12. External services and social media

The website may contain links to third-party services, including social media. Opening an external service may result in processing by its operator under that operator’s own terms and privacy information. A link to a third-party service does not imply that the Controller controls that service.

13. Rights to the website and materials — no implied licence

Unless expressly stated otherwise, all texts, photographs, architectural and interior-design projects, drawings, plans, layouts, visualisations, graphics, compositions, presentations, files, website elements and other creative materials made available by the Controller are protected by copyright and other applicable rights. Rights may also belong to photographers, collaborators, clients or other entitled persons.

Public availability of any material does not constitute a licence, consent or authorisation for its further use. No rights are granted by implication, by silence, by publication on the website or by sending material in correspondence, except to the extent strictly necessary for the purpose for which a specific material has been made available to a particular recipient.

14. Prohibited or restricted uses

To the fullest extent permitted by mandatory law, prior express permission of the relevant right holder is required before copying, reproducing, republishing, distributing, transmitting, modifying, adapting, cropping, removing authorship information, creating derivative materials from, commercially exploiting or otherwise reusing protected materials.

This restriction also applies, in particular, to publishing screenshots or screen recordings of the website or correspondence; reproducing photographs, visualisations, drawings or project fragments; embedding or framing website content; hotlinking media files; creating previews or thumbnails that reproduce protected materials; use in advertising, promotion, press materials, social media or third-party portfolios; and making materials available in databases or collections.

15. Media, journalists and online publications

Access to the website does not grant journalists, publishers, media organisations, portals, bloggers, social-media accounts or other third parties any additional licence or permission to use the Controller’s materials. Any use relying on a statutory exception or limitation to copyright remains subject to the conditions and limits of that exception, including attribution and source requirements where applicable. Nothing in this policy is intended to exclude rights that cannot lawfully be excluded, but no broader consent is granted.

16. Links, framing and presentation in third-party services

A standard hyperlink to a lawfully and freely accessible public page does not, by itself, grant any rights to the content of that page. Without an appropriate legal basis or permission, a link may not be accompanied by unauthorised reproduction of protected materials, screenshots or photographs, nor presented in a manner that falsely suggests endorsement, partnership, authorship or approval by the Controller. Framing, embedding, hotlinking or other techniques that display the Controller’s materials within a third-party service are not authorised to the fullest extent permitted by law.

17. E-mail messages, attachments and mistaken recipients

E-mail messages and attachments may contain confidential, project-related or copyright-protected information. Their delivery to a recipient does not transfer copyright or grant a right to publish, redistribute, upload, reproduce or otherwise exploit their content beyond the purpose of the particular communication, unless a separate agreement or applicable law provides otherwise.

If a message is received by mistake, the recipient is requested to notify the sender and delete the message and attachments, subject to any retention duties imposed by law. Accidental delivery is not consent to further disclosure or use. Where the nature of a message, an agreement or the circumstances of the communication require confidentiality, those obligations remain unaffected by this policy.

18. Automated scraping, AI and text and data mining

To the fullest extent permitted by law, The Controller reserves the rights required to prevent automated extraction, systematic copying, scraping, creation of datasets, text and data mining and the use of website or correspondence materials to train, fine-tune, evaluate, benchmark, retrieve for, supply or otherwise develop artificial-intelligence or machine-learning systems without prior express permission.

For online materials, this reservation is also expressed in a machine-readable form made available by the website. This provision does not limit mandatory statutory exceptions that cannot be contractually excluded.

19. Changes and current version

The Controller may amend this document when the website, technical configuration, scope of services, business processes or applicable law changes. The current version is always the version made available at olszewska.pl/privacy/. Where a change requires a new consent or other action by the user, the website will request it separately rather than treating a mere editorial change to this document as renewed consent.

20. Contact

Questions concerning personal data, correspondence or the permitted use of materials may be sent to ••••••@••••••••.••.