Privacy policy

Data controller

The controller of personal data is Oksana Fedotiuk, Warsaw, Poland. For matters concerning personal data: oksana@fedotiuk.com.

Scope and source of data

From the enquiry form — the data entered in the form:

• name, e-mail address, phone number (optional) and the message;
• extra fields depending on the form: city, wall area, painting size, subject, deadline;
• photos of the wall or photos for a portrait, if attached;
• the work number, if the enquiry concerns a specific painting.

Automatically, when the form is sent:

• the address of the page the form was sent from, including its parameters — for example a Google Ads click ID (gclid, gbraid, wbraid), if the page was opened from an ad;
• IP address and browser information;
• date and time of sending.

On every visit the hosting server technically processes the IP address in order to deliver the page. The site uses no analytics tools and no advertising cookies.

Purposes and legal bases of processing

Providing data is voluntary; however, without an e-mail address it is not possible to reply to the enquiry.

• Replying to the enquiry and preparing a quote or offer — steps taken at the request of the data subject before entering into a contract (Art. 6(1)(b) GDPR).
• Protection against spam and abuse: a limit on submissions per IP address and an event log — the controller's legitimate interest (Art. 6(1)(f) GDPR).
• Establishing which ad an enquiry came from — based on the page address with the click ID, without cookies — the controller's legitimate interest (Art. 6(1)(f) GDPR).

Recipients of data

The controller uses the services of processors that process data on the controller's behalf:

• Netlify, Inc. (USA) — website hosting and storage of form data, photos and the event log. Transfer to the USA based on EU-U.S. Data Privacy Framework certification and standard contractual clauses.
• Resend (Plus Five Five, Inc., USA) — sending form e-mails from the send.fedotiuk.com domain. Transfer to the USA based on EU-U.S. Data Privacy Framework certification and standard contractual clauses.
• Zoho Corporation B.V. (Netherlands) — the controller's mailbox, EU data centre. Any transfer outside the EEA within the Zoho group is based on standard contractual clauses.

Fonts are served from this website's own server, with no requests to Google.

Retention period

After these periods the data is deleted automatically, or earlier at the request of the data subject. If a commission follows, the enquiry is kept for the duration of the commission.

• Enquiries — 24 months from sending.
• Photos attached to enquiries — 12 months from sending.
• The security event log and rejected (spam) submissions — 12 months.

Rights of the data subject

The data subject has the right of access to the data, the right to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on the controller's legitimate interest. Requests can be sent to oksana@fedotiuk.com.

A complaint can be lodged with the President of the Polish Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa).

Cookies and browser storage

Only the data needed for the selected features is stored in the browser:

• light or dark theme (localStorage);
• the chosen language — a “locale” cookie for 12 months, only after the language has been changed manually;
• the scroll position when switching language (sessionStorage, until the tab is closed);
• the Google Ads click ID (gclid, gbraid, wbraid) and campaign parameters (utm_*), if the page was opened from an ad or a link carrying them — in sessionStorage, until the tab is closed; they are sent with the form in order to establish which ad the enquiry came from.

The admin panel uses a session cookie — this concerns only the person who manages the site.

Since the site uses no analytics or advertising cookies, consent is not required.