This policy explains what data we process at gorna.design, why we use it, who may receive it, and what rights you have. It also covers photographs submitted for commissioned portraits and cookies.
On this page
1. Controller and contact details
The controller of your personal data is Agata Górna.Design, ul. Szamotulska 40/3, 60-366 Poznań, Poland, Tax ID (NIP) 6912155818, Business Register No. (REGON) 081151776.
For privacy matters, contact us by email , by phone , or by post at the address above.
2. Data we process
Depending on how you use the website, we may process:
- contact and identity data, such as your name, email address, phone number, and delivery and billing addresses;
- company details provided for an invoice, including company name and Tax ID;
- order details, such as the selected artwork, portrait options, price, destination country, status history, complaints, returns, and correspondence;
- payment data, such as the selected method, transaction identifier, and payment status; we do not receive or store your full card number, CVC, or online banking or PayPal login details;
- messages sent through the contact form, order chat, or email;
- for commissioned portraits: source photographs, information about the people pictured, occasion and deadline, and private progress and final-work photographs;
- technical data, such as IP address, request time, browser and device type, visited pages, referring page, security logs, and cookie identifiers;
- records of consent and cookie or marketing preferences.
A photograph of an identifiable person may be personal data. We do not use facial recognition or process photographs for unique biometric identification. Do not submit special-category data or photographs you are not entitled to use.
3. Where the data comes from
We receive most data directly from you when you place an order, submit a form, send a message, or set cookie preferences. We may receive payment status from your selected payment provider and delivery status from a carrier. If you submit another person's data or photograph, you are responsible for having a lawful basis to do so and for giving that person any information about the processing that they require.
4. Purposes and legal bases
We process data for the following purposes:
- operating the basket, entering into and performing a contract, taking payment, delivering an order, order-related contact, and handling a portrait commission — Article 6(1)(b) GDPR;
- answering a question before a contract — Article 6(1)(b) GDPR, or otherwise our legitimate interest in handling correspondence — Article 6(1)(f) GDPR;
- issuing and retaining accounting records and meeting tax and consumer-law duties — Article 6(1)(c) GDPR;
- securing the website, preventing abuse, establishing, pursuing or defending claims, and keeping basic business records — our legitimate interests under Article 6(1)(f) GDPR;
- sending news about Agata's new works if you give separate consent — Article 6(1)(a) GDPR and the applicable Polish Electronic Communications Law;
- storing or reading optional functional and analytics cookies — your consent under Article 6(1)(a) GDPR together with Articles 399–400 of the Polish Electronic Communications Law.
You may withdraw consent at any time without affecting processing already carried out lawfully. Providing order data is voluntary, but we cannot perform the contract without it. Information marked optional is not required to make a purchase.
5. Commissioned portraits and photographs
We use source photographs only to assess suitability, paint the portrait, show progress, and handle agreed corrections. They are stored outside the public media library under random filenames and made available through a protected link. We do not publish customer, progress, or portrait photographs without a separate legal basis and separate agreement.
The person placing the order must be entitled to use the submitted photographs and, where required, have permission from the people pictured or their legal representatives. We do not target our offer directly at children. An order involving a child's image must be placed by an adult entitled to submit the photograph.
6. Recipients
We share data only to the extent needed for a particular task. Recipients or processors may include:
- the hosting provider, entities maintaining WordPress, WooCommerce, and technical security, and IT support providers;
- your selected payment provider — Stripe Payments Europe, Limited (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), or PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, Poland, KRS 0000347935, NIP 7792369887;
- Brevo as the provider of transactional and, after consent, marketing email;
- carriers, logistics operators, shipment insurers, and customs authorities where needed for delivery;
- the accounting-tool provider, accountants, banks, legal or tax advisers;
- public authorities where disclosure is required by law.
Each independent payment provider also processes some data as a separate controller under its own privacy policy.
7. Transfers outside the EEA
Some technology or payment providers operate globally. Depending on the selected service, data may be processed outside the European Economic Area. Any such transfer relies on a European Commission adequacy decision, Standard Contractual Clauses, or another mechanism permitted by the GDPR. You can request information about safeguards from us or the relevant provider.
8. Retention
We use the following retention periods or criteria:
- order, payment, invoice, and delivery data — for performance of the contract, handling complaints, and the period required by tax law or needed to defend claims; tax records are normally kept until five years have elapsed from the end of the year in which the tax-payment deadline fell;
- source, progress, and final portrait files — during the commission and for 90 days after completion; longer only where necessary for a dispute, a legal duty, or on the basis of separate consent;
- portrait-chat text and the order arrangements — for up to six years after completion, unless longer retention is needed for an ongoing dispute;
- ordinary correspondence that does not lead to a contract — for up to 12 months after the last message, unless it is needed to defend a claim;
- data processed on the basis of marketing consent — until withdrawal, with the consent record retained for as long as needed to demonstrate compliance;
- security logs — normally for up to 12 months, unless a particular record is needed to investigate an incident or pursue a claim.
Backups are overwritten according to the backup cycle and remain isolated from ordinary use until then.
9. Your rights
To the extent provided by the GDPR, you have the right to:
- access your data and receive a copy;
- rectify your data;
- erase your data;
- restrict processing;
- data portability;
- object to processing based on legitimate interests;
- withdraw consent at any time;
- complain to the President of the Polish Personal Data Protection Office.
Send a request through or to the controller's postal address. We may ask for information needed to verify your identity. Complaint information is available at uodo.gov.pl.
We do not make decisions about you that produce legal effects solely by automated means, and we do not carry out such profiling.
10. Cookies and similar technologies
Cookies are small pieces of information stored on or read from your device. We use the following categories:
- Necessary — always active. These enable secure operation, the basket, checkout, sessions, login, form protection, and storage of your consent choices. The service you request cannot work correctly without them. Most last for the session; selected cookies, such as privacy preferences, may last for up to 12 months.
- Functional — with consent. These remember choices that are not required for core operation, such as additional language or interface preferences. They normally last for up to 12 months.
- Analytics — with consent. These help us understand in aggregate how the website is used, which pages work well, and where errors occur. We do not activate them before consent. The provider, purpose, and duration of each tool are shown in the cookie settings panel.
We do not currently use advertising cookies for cross-site tracking. If this changes, we will update this policy and the consent panel before activating such tools.
On your first visit you can accept all optional cookies, reject them, or select categories. You can change your choice at any time through the Cookie settings control available on the website. A change applies going forward; you can also delete previously stored cookies in your browser. Blocking necessary cookies in your browser may prevent the basket or payment flow from working.
11. Security and policy changes
We use organisational and technical safeguards appropriate to the risk, including HTTPS, access controls, restricted public access to portrait photographs, and backups. No transmission or storage method can provide an absolute guarantee.
We may update this policy when the law or the operation of the shop changes. We publish the new version here and identify the update date. If a change requires new consent, we will ask for it before starting the new processing.