Privacy policy

Who controls your data

The controller of your personal data is Piotr Bugaj Media, ul. Mała 14, Warszawa, Poland, tax ID (NIP) 5253024022 (“I”). For anything about your data, write to hello@piotrbugaj.com or call +48 691 747 355.

What data I process

• From the enquiry form on this site: your name, email address, phone number and your answers to the questions (for example type of property, location, scope of photography, date).
• From an email sent directly or a phone call: the data you provide yourself (email address, name, phone number, content of the message).
• Technical data about your visit (for example IP address, browser type, page visited): processed by the hosting provider, Cloudflare, in server logs and in anonymous visit statistics.
• The source of your visit (for example a search engine or a campaign link) and the page you entered on: I store them together with your enquiry, to know where you found me.

Why, and on what legal basis

• Replying to your enquiry, discussing a commission and preparing a quote: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and point (f) (my legitimate interest in corresponding with someone who wrote to me).
• Defending and pursuing legal claims, site security, anonymous visit statistics and assessing where enquiries come from: Article 6(1)(f) GDPR (my legitimate interest).
• If we work together: performance of the contract (Article 6(1)(b) GDPR) and tax and accounting obligations (Article 6(1)(c) GDPR).

Who processes data on my behalf

The following processors handle data on my behalf under data processing agreements:

• Google Ireland Limited: Google Workspace (Google Sheets, Gmail, Apps Script) to store enquiries from the form and handle email.
• Cloudflare, Inc.: hosting and content delivery network for this site, and anonymous visit statistics (Cloudflare Web Analytics).

Data may also be disclosed to bodies entitled to it by law and to my advisers (for example my accountant), to the extent necessary. I do not sell data or share it for marketing.

Transfers outside the European Economic Area

Google and Cloudflare may process data outside the EEA, including in the United States. Transfers rely on a European Commission adequacy decision (the EU–US Data Privacy Framework, where the provider is certified under it) or on standard contractual clauses (Article 46 GDPR). For details of the safeguards, write to hello@piotrbugaj.com.

How long I keep data

• Enquiries that do not lead to a collaboration: up to 12 months after our last contact.
• Collaboration: for the duration of the contract and then for as long as tax and accounting law requires (in principle 5 years from the end of the year in which the tax obligation arose), and until any claims are time-barred.
• Server logs and visit statistics: briefly, according to the provider’s rules, and they do not allow you to be identified.

Your rights

You have the right to:

• access your data and receive a copy,
• have your data rectified,
• have your data erased,
• restrict processing,
• object to processing based on my legitimate interest (on grounds relating to your particular situation),
• data portability (where I process data under a contract and by automated means),
• lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl) or another EU supervisory authority.

To exercise your rights, write to hello@piotrbugaj.com. I will reply without undue delay and within one month at the latest.

Providing data is voluntary

Providing data is voluntary. However, your name, email address and phone number in the form are needed for me to reply to your enquiry; without them I cannot handle it.

Profiling

I do not make automated decisions and I do not profile visitors to this site.

Cookies and browser storage

This site does not use tracking, advertising or analytics cookies. Anonymous visit statistics (Cloudflare Web Analytics) work without cookies and without building a user profile.

The site stores in your browser’s session storage (sessionStorage) only technical information: that the welcome animation and the expandable sections have already been shown, and the source and page of your visit. It disappears when you close the tab, and the source and entry page leave your device only together with the enquiry you send. I do not use localStorage.

If Cloudflare sets technical cookies necessary for the security and operation of the service (for example bot protection), they are not used for tracking.

Changes to this policy

I may change this policy, for example if the way the site works changes. The current version is always at this address.