1. Data controller
The controller of your personal data is Elżbieta Cierlak, running unregistered business activity, e-mail: elza.cierlak@gmail.com.
2. What data we collect and why
- Contact form — name, e-mail, optionally phone and your message: to answer your question and, if you wish, book a class (Art. 6(1)(b) and (f) GDPR). A copy of the message is kept in the website admin panel so that it does not get lost.
- Enquiries and orders — name, e-mail, phone, chosen products and later the delivery address (given in our correspondence), and for made-to-measure tails your measurements: to prepare the offer, fulfil the order and keep the required sales records (Art. 6(1)(b) and (c) GDPR).
- Discount codes — if you use a code, we save it with your enquiry; a personal code may be linked to your e-mail address (Art. 6(1)(b) and (f) GDPR).
- How you found us — when you send a form, we save with your message which button you clicked (e.g. "Book — Trial lesson"), which page the form was on and which website you came from (e.g. Google, Instagram). This tells us which information on the site is helpful (Art. 6(1)(f) GDPR). Nothing is stored in your browser and we do not track you on other websites.
- Newsletter — e-mail address, site language, date, time and IP address of sign-up and confirmation (proof of consent), labels I assign so that you only get relevant messages (e.g. "student"), and where the sign-up came from: to send news about courses, photo sessions, articles and updates, based on your consent (Art. 6(1)(a) GDPR); proof of consent is kept under Art. 6(1)(f) GDPR. You confirm the sign-up via a link in an e-mail and can unsubscribe from every message with one click.
- Technical data — server logs (IP address, date, browser): security and operation of the website (Art. 6(1)(f) GDPR).
3. How long we keep data
- Messages and enquiries — up to 2 years after sending; after that they are deleted from the panel automatically. Earlier, if you ask.
- Orders and sales documents — for 5 years from the end of the year in which the tax payment deadline passed (required by tax law).
- Newsletter — until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep only the address and the date (so that we never e-mail you again) for 3 years, then they are deleted.
4. Who receives your data
Only to providers that help run the website and the business, to the extent necessary:
- website hosting — OVH Sp. z o.o.;
- e-mail provider — receiving messages and sending e-mails from the website, including the newsletter — Google (Gmail);
- Cloudflare, Inc. — spam protection for forms (Turnstile, cookieless);
- courier companies and InPost — when shipping an order; accounting office — sales documents;
- YouTube (Google) and Instagram (Meta) — only when you click to play a video. Before that the site does not connect to these services.
Some of these companies may process data outside the European Economic Area — under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
5. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent (without affecting earlier processing). Write to elza.cierlak@gmail.com. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).
Providing data is voluntary, but without it we cannot answer your message or fulfil an order. We do not make automated decisions or profile you.
6. Cookies and browser storage
The website stores in your browser only what is needed for features you use yourself — this does not require consent:
- browser storage (
syrena-zapytanie) — the list of products in your enquiry until you send or clear it; syrena_kod— a discount code you enter or open via a link (until the code expires, at most 60 days);syrena_kod_msg— a one-time message about the code (2 minutes);syrena_biblioteka— remembers access to the students' library after entering the password (about 30 days);- your choice in the cookie banner (if enabled) and that you closed the announcement bar at the top of the page;
- WordPress technical cookies — only for people logged in to the admin panel.
We do not use analytics or advertising cookies and we do not record which pages you view. After you click a YouTube or Instagram video, those services may set their own cookies under their policies. You can delete or block cookies in your browser settings.
7. Changes
We update this policy when the way the website works changes. The current version is always on this page.