Security and changes<\/a><\/li><\/ul>\n\n<\/div>\n\n\n\n1. Controller and contact details<\/h2>\n\n\n\n The controller of your personal data is Agata G\u00f3rna.Design<\/strong>, ul. Szamotulska 40\/3, 60-366 Pozna\u0144, Poland, Tax ID (NIP) 6912155818, Business Register No. (REGON) 081151776.<\/p>\n\n\n\nFor privacy matters, contact us by email \u2709<\/span> Show email<\/button>Viewing the email address requires JavaScript.<\/span><\/noscript>, by phone \u260e<\/span> Show phone<\/button>Viewing the phone number requires JavaScript.<\/span><\/noscript> , or by post at the address above.<\/p>\n\n\n\n2. Data we process<\/h2>\n\n\n\n Depending on how you use the website, we may process:<\/p>\n\n\n\n
contact and identity data, such as your name, email address, phone number, and delivery and billing addresses;<\/li> company details provided for an invoice, including company name and Tax ID;<\/li> order details, such as the selected artwork, portrait options, price, destination country, status history, complaints, returns, and correspondence;<\/li> payment data, such as the selected method, transaction identifier, and payment status; we do not receive or store your full card number, CVC, or online banking or PayPal login details;<\/li> messages sent through the contact form, order chat, or email;<\/li> for commissioned portraits: source photographs, information about the people pictured, occasion and deadline, and private progress and final-work photographs;<\/li> technical data, such as IP address, request time, browser and device type, visited pages, referring page, security logs, and cookie identifiers;<\/li> records of consent and cookie or marketing preferences.<\/li><\/ul>\n\n\n\nA photograph of an identifiable person may be personal data. We do not use facial recognition or process photographs for unique biometric identification. Do not submit special-category data or photographs you are not entitled to use.<\/p>\n\n\n\n
3. Where the data comes from<\/h2>\n\n\n\n We receive most data directly from you when you place an order, submit a form, send a message, or set cookie preferences. We may receive payment status from your selected payment provider and delivery status from a carrier. If you submit another person's data or photograph, you are responsible for having a lawful basis to do so and for giving that person any information about the processing that they require.<\/p>\n\n\n\n
4. Purposes and legal bases<\/h2>\n\n\n\n We process data for the following purposes:<\/p>\n\n\n\n
operating the basket, entering into and performing a contract, taking payment, delivering an order, order-related contact, and handling a portrait commission \u2014 Article 6(1)(b) GDPR;<\/li> answering a question before a contract \u2014 Article 6(1)(b) GDPR, or otherwise our legitimate interest in handling correspondence \u2014 Article 6(1)(f) GDPR;<\/li> issuing and retaining accounting records and meeting tax and consumer-law duties \u2014 Article 6(1)(c) GDPR;<\/li> securing the website, preventing abuse, establishing, pursuing or defending claims, and keeping basic business records \u2014 our legitimate interests under Article 6(1)(f) GDPR;<\/li> sending news about Agata's new works if you give separate consent \u2014 Article 6(1)(a) GDPR and the applicable Polish Electronic Communications Law;<\/li> storing or reading optional functional and analytics cookies \u2014 your consent under Article 6(1)(a) GDPR together with Articles 399\u2013400 of the Polish Electronic Communications Law.<\/li><\/ul>\n\n\n\nYou may withdraw consent at any time without affecting processing already carried out lawfully. Providing order data is voluntary, but we cannot perform the contract without it. Information marked optional is not required to make a purchase.<\/p>\n\n\n\n
5. Commissioned portraits and photographs<\/h2>\n\n\n\n We use source photographs only to assess suitability, paint the portrait, show progress, and handle agreed corrections. They are stored outside the public media library under random filenames and made available through a protected link. We do not publish customer, progress, or portrait photographs without a separate legal basis and separate agreement.<\/p>\n\n\n\n
The person placing the order must be entitled to use the submitted photographs and, where required, have permission from the people pictured or their legal representatives. We do not target our offer directly at children. An order involving a child's image must be placed by an adult entitled to submit the photograph.<\/p>\n\n\n\n
6. Recipients<\/h2>\n\n\n\n We share data only to the extent needed for a particular task. Recipients or processors may include:<\/p>\n\n\n\n
the hosting provider, entities maintaining WordPress, WooCommerce, and technical security, and IT support providers;<\/li> your selected payment provider \u2014 Stripe Payments Europe, Limited (Ireland), PayPal (Europe) S.\u00e0 r.l. et Cie, S.C.A. (Luxembourg), or PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Pozna\u0144, Poland, KRS 0000347935, NIP 7792369887;<\/li> Brevo as the provider of transactional and, after consent, marketing email;<\/li> carriers, logistics operators, shipment insurers, and customs authorities where needed for delivery;<\/li> the accounting-tool provider, accountants, banks, legal or tax advisers;<\/li> public authorities where disclosure is required by law.<\/li><\/ul>\n\n\n\nEach independent payment provider also processes some data as a separate controller under its own privacy policy.<\/p>\n\n\n\n
7. Transfers outside the EEA<\/h2>\n\n\n\n Some technology or payment providers operate globally. Depending on the selected service, data may be processed outside the European Economic Area. Any such transfer relies on a European Commission adequacy decision, Standard Contractual Clauses, or another mechanism permitted by the GDPR. You can request information about safeguards from us or the relevant provider.<\/p>\n\n\n\n
8. Retention<\/h2>\n\n\n\n We use the following retention periods or criteria:<\/p>\n\n\n\n
order, payment, invoice, and delivery data \u2014 for performance of the contract, handling complaints, and the period required by tax law or needed to defend claims; tax records are normally kept until five years have elapsed from the end of the year in which the tax-payment deadline fell;<\/li> source, progress, and final portrait files \u2014 during the commission and for 90 days after completion; longer only where necessary for a dispute, a legal duty, or on the basis of separate consent;<\/li> portrait-chat text and the order arrangements \u2014 for up to six years after completion, unless longer retention is needed for an ongoing dispute;<\/li> ordinary correspondence that does not lead to a contract \u2014 for up to 12 months after the last message, unless it is needed to defend a claim;<\/li> data processed on the basis of marketing consent \u2014 until withdrawal, with the consent record retained for as long as needed to demonstrate compliance;<\/li> security logs \u2014 normally for up to 12 months, unless a particular record is needed to investigate an incident or pursue a claim.<\/li><\/ul>\n\n\n\nBackups are overwritten according to the backup cycle and remain isolated from ordinary use until then.<\/p>\n\n\n\n
9. Your rights<\/h2>\n\n\n\n To the extent provided by the GDPR, you have the right to:<\/p>\n\n\n\n
access your data and receive a copy;<\/li> rectify your data;<\/li> erase your data;<\/li> restrict processing;<\/li> data portability;<\/li> object to processing based on legitimate interests;<\/li> withdraw consent at any time;<\/li> complain to the President of the Polish Personal Data Protection Office.<\/li><\/ul>\n\n\n\nSend a request through \u2709<\/span> Show email<\/button>Viewing the email address requires JavaScript.<\/span><\/noscript> or to the controller's postal address. We may ask for information needed to verify your identity. Complaint information is available at uodo.gov.pl<\/a>.<\/p>\n\n\n\nWe do not make decisions about you that produce legal effects solely by automated means, and we do not carry out such profiling.<\/p>\n\n\n\n
10. Cookies and similar technologies<\/h2>\n\n\n\n Cookies are small pieces of information stored on or read from your device. We use the following categories:<\/p>\n\n\n\n
Necessary \u2014 always active.<\/strong> These enable secure operation, the basket, checkout, sessions, login, form protection, and storage of your consent choices. The service you request cannot work correctly without them. Most last for the session; selected cookies, such as privacy preferences, may last for up to 12 months.<\/li>Functional \u2014 with consent.<\/strong> These remember choices that are not required for core operation, such as additional language or interface preferences. They normally last for up to 12 months.<\/li>Analytics \u2014 with consent.<\/strong> These help us understand in aggregate how the website is used, which pages work well, and where errors occur. We do not activate them before consent. The provider, purpose, and duration of each tool are shown in the cookie settings panel.<\/li><\/ul>\n\n\n\nWe do not currently use advertising cookies for cross-site tracking. If this changes, we will update this policy and the consent panel before activating such tools.<\/p>\n\n\n\n
On your first visit you can accept all optional cookies, reject them, or select categories. You can change your choice at any time through the Cookie settings<\/strong> control available on the website. A change applies going forward; you can also delete previously stored cookies in your browser. Blocking necessary cookies in your browser may prevent the basket or payment flow from working.<\/p>\n\n\n\n11. Security and policy changes<\/h2>\n\n\n\n We use organisational and technical safeguards appropriate to the risk, including HTTPS, access controls, restricted public access to portrait photographs, and backups. No transmission or storage method can provide an absolute guarantee.<\/p>\n\n\n\n
We may update this policy when the law or the operation of the shop changes. We publish the new version here and identify the update date. If a change requires new consent, we will ask for it before starting the new processing.<\/p>","protected":false},"excerpt":{"rendered":"
Ostatnia aktualizacja: 1 wrze\u015bnia 2026 r. Poni\u017cej wyja\u015bniamy, jakie dane przetwarzamy w sklepie gorna.design, po co to robimy, komu mo\u017cemy je przekaza\u0107 i jakie prawa Ci przys\u0142uguj\u0105. Polityka obejmuje r\u00f3wnie\u017c zdj\u0119cia przesy\u0142ane przy zam\u00f3wieniu portretu oraz pliki cookies. Na tej stronie Administrator i kontakt Jakie dane przetwarzamy Sk\u0105d mamy dane Cele i podstawy prawne Portrety […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":6,"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":209,"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/pages\/3\/revisions\/209"}],"wp:attachment":[{"href":"https:\/\/www.gorna.design\/en\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}