Privacy Policy and Cookie Policy - Shot by Kacper

This document explains how HEX Studio Monika Domagała processes personal data of people who visit shotbykacper.pl and people who get in touch about booking a photography session. You'll also find information here about the cookies used on the site and about copyright to the photos in the portfolio.

1. Who controls your data

The data controller is HEX Studio Monika Domagała, ul. Kusocińskiego 92a lok. 1, 94-054 Łódź, Poland, Tax ID (NIP) 7251705894, Business ID (REGON) 524456013 - the company behind the Shot by Kacper brand.

For anything related to your personal data, write to biuro@hexstudio.pl. We don't handle these matters by phone - everything goes through email, partly because we're required to keep a record of these conversations.

We're not required to appoint a data protection officer (DPO) - the scale of the business doesn't trigger that obligation under Article 37 GDPR. The controller itself acts as the point of contact for these matters.

2. What data we collect and why

Contact form

When you fill out the form on the /kontakt page, we collect: your full name, email address, event date, event address, event type, and the event description you write yourself.

We process this data to answer your inquiry and put together a quote for your session - the legal basis is Article 6(1)(b) GDPR (steps taken prior to entering into a contract). If your message includes extra information that isn't needed for the quote, such as details about third parties, please keep that to a minimum.

The form is protected by Cloudflare Turnstile, which checks that a message is being sent by a person and not a bot. Turnstile looks at technical browser signals (including your IP address and request characteristics) without showing a traditional image-based captcha. The legal basis for this processing is our legitimate interest (Article 6(1)(f) GDPR) - protecting the form from spam and automated attacks.

Email correspondence

If you write to us directly at biuro@hexstudio.pl, we process the content of that correspondence and your email address in order to reply. The legal basis is Article 6(1)(b) or (f) GDPR, depending on whether the message relates to setting up a contract or is a more general inquiry.

Data during the course of a booking

If you sign a contract with us for a photography session, we also process the data needed to carry out and invoice that contract - for example, billing details. The legal basis is performance of a contract (Article 6(1)(b) GDPR) and our tax and accounting obligations (Article 6(1)(c) GDPR).

Traffic statistics and ad performance measurement

The site runs Google Analytics 4, Meta Pixel, and TikTok Pixel. They let us see where visitors come from, how people use the site, and whether our ads are actually reaching the right audience.

These tools set cookies and only start running once you've given consent through the cookie banner shown on your first visit - not before. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time through the cookie settings link in the site footer. You'll find the full breakdown of how these tools work and exactly which cookies they set in the Cookies section.

3. Who we share your data with

Your data goes to external companies that provide the technical infrastructure needed to run the site and handle your inquiries. Each of them processes data on our behalf under a data processing agreement (Article 28 GDPR) and isn't allowed to use it for its own purposes - with one exception described below: the analytics and advertising providers (Google, Meta, and TikTok), which also process some data as independent controllers in their own right. That's simply how those services work.

Hosting works a bit differently from the rest of the stack here - Hetzner is based in Germany and stores data exclusively in European data centers, so there's no transfer of data outside the European Economic Area with this provider. For the other providers based in the US or UK, transfers rely on Standard Contractual Clauses approved by the European Commission or on the Data Privacy Framework - mechanisms the GDPR treats as adequate safeguards.

We don't share your data with anyone beyond the providers listed above. We don't sell your data, and we don't hand it over to third parties for marketing purposes outside the tools listed above, which you've consented to through the cookie banner.

4. How long we keep your data

We keep contact form data for 12 months from the last contact - if no contract is signed within that time, we delete it. If an inquiry turns into a signed contract, we keep the data for the length of the working relationship, and afterward for as long as tax law requires - typically 5 years from the end of the year in which the tax obligation arose.

Technical logs generated by the Hetzner server and by Cloudflare (IP addresses, request timestamps) are kept for a shorter period - usually anywhere from a few days to a few weeks, depending on retention settings. After that, they're deleted automatically.

Data collected through Google Analytics 4, Meta Pixel, and TikTok Pixel is kept according to each provider's settings - you'll find the specific retention period for each cookie in the Cookies section.

5. Your rights

Under the GDPR, you have the right to:

• access your data and get a copy of it,
• have inaccurate or incomplete data corrected,
• have your data erased ("the right to be forgotten"), unless a legal obligation prevents that (for example, tax record-keeping),
• request restriction of processing in certain situations,
• have your data transferred to another controller, where processing is based on consent or a contract,
• object to processing based on our legitimate interest,
• withdraw your consent to analytics and marketing cookies at any time, without affecting the lawfulness of processing carried out before the withdrawal,
• file a complaint with the President of the Polish Data Protection Authority (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw), if you believe we're processing your data unlawfully.

To exercise any of these rights, write to biuro@hexstudio.pl. We respond within 30 days of receiving your request - that's the statutory deadline under Article 12 GDPR.

6. Cookies

How the cookie banner works

On your first visit to shotbykacper.pl, you'll see a banner with three equally weighted options: accept all cookies, reject the optional ones, or choose categories yourself in the settings. Strictly necessary cookies are always set - without them, the contact form and spam protection simply won't work. Google Analytics 4, Meta Pixel, and TikTok Pixel wait for your decision in the banner before running - none of these scripts load by default.

You can change your decision at any time through the "Cookie settings" link in the site footer.

Strictly necessary cookies (no consent required)

These cookies are required for the site to function, so under Article 173(3) of the Telecommunications Law and the corresponding Article 402 of the Electronic Communications Law, we don't ask for consent to set them.

Analytics cookies (consent required)

Event data and user identifiers within Google Analytics itself are kept server-side for 14 months - the maximum setting available in GA4, longer than the 2-month default.

Marketing cookies (consent required)

If you accept only analytics cookies and reject marketing cookies in the banner, Meta Pixel and TikTok Pixel won't run - only Google Analytics 4 will.

Managing cookies yourself

Regardless of the settings on the site, you can manage cookies directly in your browser - block them entirely or delete the ones already stored. You'll find instructions in the settings of whichever browser you use (Chrome, Safari, Firefox, Edge). Keep in mind that fully blocking strictly necessary cookies may affect how the contact form works.

7. Copyright to the photos

The photos published in the portfolio on shotbykacper.pl are copyrighted works under Polish copyright law (and, where relevant, corresponding protections under US and international copyright law). The economic copyright to these photos belongs to Kacper Domagała / HEX Studio Monika Domagała, unless stated otherwise for a specific session.

Copying, downloading, processing, or otherwise using these photos without prior written consent - including on other websites, on social media, or in advertising materials - is prohibited and constitutes copyright infringement.

Photos from a session are published based on consent given by the client in the contract signed before the session. Each contract sets the scope and duration of publication individually. If you're a person shown in a portfolio photo and you'd like it taken down - regardless of what the earlier consent covered - write to biuro@hexstudio.pl. We handle these requests on a case-by-case basis and without undue delay.

8. Changes to this policy

We may update this document - particularly if providers change, processing methods change, or the list of cookies described in Section 6 changes. The current version is always available at shotbykacper.pl/polityka-prywatnosci, and the "last updated" date at the top of the document reflects the most recent change.

9. Contact

For anything related to personal data, cookies, or copyright to the photos, write to:

HEX Studio Monika Domagała ul. Kusocińskiego 92a lok. 1, 94-054 Łódź, Poland Tax ID (NIP): 7251705894, Business ID (REGON): 524456013 Email: biuro@hexstudio.pl