Your data. Your rules.

The controller of personal data collected by eriz.studio is ERIZ.STUDIO Kacper Baranowski, NIP (tax ID) 7743301694, REGON 542908955, Ludwików, Masovian Voivodeship, Poland (“we”).

For anything about your personal data, write to [email protected]. We have not appointed a data protection officer, as the GDPR does not require one at our scale.

We collect only what we need, and only for these purposes:

• Contact form and email. Your name, email address and message, plus your company and phone number if you give them. We use them to reply and prepare a quote (Art. 6(1)(b) GDPR, steps before a contract) and to correspond with you (Art. 6(1)(f) GDPR, our legitimate interest).
• Working together. If we sign a contract, we process the data needed to perform it (Art. 6(1)(b) GDPR) and to issue invoices and keep accounts (Art. 6(1)(c) GDPR, legal obligation).
• Visit statistics. With your consent (Art. 6(1)(a) GDPR) we measure traffic in Google Analytics: which pages you view, where you come from and what device you use.
• Ad measurement. With your consent (Art. 6(1)(a) GDPR) we check whether our Google Ads campaigns bring in inquiries.
• Running and securing the site. The server records technical data about every request, such as IP address, browser type and time of visit, to keep the site running and secure (Art. 6(1)(f) GDPR).

Cookies are small files saved in your browser. Browser storage (localStorage and sessionStorage) works the same way, so we treat it like cookies. We sort them into three groups: essential, analytics and marketing. The full list is below, next to the settings.

Essential cookies always run, because without them the site could not even remember your choice. Analytics and marketing only switch on after you consent, under Art. 399 of the Polish Electronic Communications Law and, for the personal data involved, Art. 6(1)(a) GDPR.

We use Google Consent Mode v2. Until you decide, every Google consent signal is set to “denied”: Google tags do not write or read cookies. They can only send Google a signal without cookies or a user identifier, for example that a page was viewed, which Google uses to estimate statistics. Once you consent, we pass that on to Google and measurement runs in full.

You can change or withdraw consent at any time using the “Cookie settings” button in the footer or the one next to the cookie list. Withdrawing consent does not affect the lawfulness of what happened before. You can also delete cookies in your browser settings.

We do not sell data or share it with other companies for their own marketing. Only the service providers we use can access it, and only as far as their service requires:

• Vercel Inc. (USA): website hosting and the contact form.
• Resend (USA): delivering form messages to our inbox.
• Google Ireland Limited (Ireland) and, within the Google group, Google LLC (USA): Google Tag Manager, Google Analytics and Google Ads.
• Sanity AS (Norway): the content management system whose servers deliver the images on the site.
• Our email provider and, if we sign a contract, our accounting office.
• Public authorities, where the law requires it.

Some providers (Vercel, Resend, Google LLC) are based in the USA. Data goes there under the European Commission’s EU-US Data Privacy Framework decision where the provider takes part in it, and otherwise under the standard contractual clauses approved by the Commission (Art. 46 GDPR).

No longer than needed:

• Inquiries and correspondence: until the matter is settled, then up to 12 months in case it comes up again, unless you object earlier.
• Contract data: for as long as we work together, then until claims expire and for as long as tax law requires (as a rule 5 years from the end of the year in which the tax was due).
• Google Analytics data: up to 14 months.
• Your cookie choice: 12 months. Then we ask again.
• Server logs: for the short period set by the hosting provider.

You have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have your data erased or its processing restricted,
• data portability, where we process data on the basis of consent or a contract,
• object to processing based on our legitimate interest,
• withdraw consent at any time, without affecting what happened before.

To use these rights, write to [email protected]. We reply without undue delay, within one month at the latest.

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl).

Giving us data is voluntary. Without a name and email address, though, we cannot reply to an inquiry, and without invoicing details we cannot sign a contract.

We make no automated decisions about you, including profiling within the meaning of Art. 22 GDPR.

When we change our tools or how we process data, we update this page and the date at the top. If the change concerns cookies, we ask for your consent again.