PL
Privacy · GDPR
Privacy policy
I respect your privacy. I only collect the data I genuinely need to reply to your message, carry out your order, or show photos in my portfolio with your consent.
In short: this website does not use cookies or analytics tools and has no forms that send data to a server. Contact happens by email. Fonts are stored on the same server as the website, so your IP address is not passed to Google.
Effective from 31 October 2026.
1. Data controller
The controller of your personal data is Katarzyna Wójcik, operating under the Chera Lab brand (including Chera Lab Photography and Chera Lab Web Design).
Contact for all data matters: katarzynawojcik1@gmail.com.
2. What data I process, why, and on what legal basis
- Contact and enquiries. When you email me, I process your name, email address, phone number if given, and the content of your message to reply and prepare an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or my legitimate interest in handling correspondence (Art. 6(1)(f) GDPR).
- Carrying out an order. When you order a photo session, event coverage, a website or an AI implementation, I process the data needed to conclude and perform the contract and to settle payment. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Legal obligations. I keep data from bills and sales records because tax law requires it. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
- Image and portfolio. I show photos of you in my portfolio and on social media only with your consent, given for example through the consent form. Legal basis: consent (Art. 6(1)(a) GDPR) and Art. 81 of the Polish Copyright Act. You can withdraw consent at any time with a single email. Withdrawal does not affect publications made before it.
- Legal claims. In case of a dispute, I may keep the data needed to establish, pursue or defend claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
3. How long I keep data
- Correspondence that did not lead to an order: up to 12 months from the last message.
- Contract-related data: for the duration of the contract and then until claims become time-barred.
- Accounting records: 5 years from the end of the tax year in which the tax payment deadline passed.
- Copies of photos from sessions and events: up to 12 months after delivery, unless agreed otherwise.
- Photos published on the basis of consent: until consent is withdrawn.
4. Who receives the data
I do not sell data or share it for marketing. Only the service providers I use may have access to it, and only as far as necessary:
- Google - email (Gmail) and file storage,
- WeTransfer - delivery of finished photos and files,
- GitHub (GitHub, Inc.) - hosting of this website,
- Lovable - servers from which some portfolio thumbnails load,
- public authorities, where required by law.
5. Transfers outside the European Economic Area
WeTransfer is based in the Netherlands. Google, GitHub and WeTransfer may also process data in the United States. This is based on the European Commission's decision on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
6. Your rights
You have the right to:
- access your data and receive a copy,
- rectify your data,
- have your data erased,
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time,
- lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
To exercise your rights, write to katarzynawojcik1@gmail.com. I will reply without undue delay and within one month at the latest.
7. Do you have to provide data
Providing data is voluntary. Without an email address I cannot reply to you, and without the data needed for a contract I cannot carry out the order. I do not make automated decisions or use profiling.
8. Cookies, server logs and links
- Cookies and analytics: this website does not store cookies and does not use analytics tools or advertising pixels.
- Server logs: GitHub, as the hosting provider, may automatically log IP addresses and technical browser data to keep the service secure. See the GitHub privacy statement.
- External links: this website links to other services, such as LinkedIn, Facebook and portfolio project websites. Their own privacy policies apply once you go there.
9. Changes to this policy
If the way I process data changes, I will update this page and the date at the top.