PRIVACY POLICY
for the website alicjabodak.com
Last updated: 01.10.2026
§1. General provisions
This Privacy Policy sets out the principles concerning the processing and protection of personal data of Users of the website available at https://alicjabodak.com/ (the “Website”).
The Administrator of personal data processed through the Website is Alicja Bodak, conducting business activity under the name Harmony Alicja Bodak, with its address: ul. Racławicka 51/5, 53-149 Wrocław, Poland, NIP: 8992944724 (the “Administrator”).
Contact with the Administrator is possible by e-mail at: alicja.painter@gmail.com.
The Website presents the Administrator’s artistic work and enables Users to contact the Administrator, including in matters concerning artistic collaborations and commissioned works.
The Administrator processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”) and applicable provisions of Polish law.
§2. Scope of personal data
The Administrator may process personal data provided voluntarily by Users, in particular where a User contacts the Administrator by e-mail.
Depending on the nature of the contact, the data may include, in particular:
a) first and last name;
b) e-mail address;
c) other contact details provided by the User;
d) information contained in the User’s message or correspondence;
e) information necessary to respond to an enquiry or to perform a contract.
The Administrator does not require Users to provide more personal data than is necessary for the purpose for which the data are processed.
The Website does not provide a contact form. Contact with the Administrator is made by e-mail.
§3. Purposes and legal bases for processing personal data
Personal data may be processed for the following purposes:
a) responding to enquiries and correspondence sent by e-mail – pursuant to Article 6(1)(f) GDPR, based on the Administrator’s legitimate interest in responding to enquiries and conducting correspondence;
b) taking steps at the request of the User prior to entering into a contract and performing a contract – pursuant to Article 6(1)(b) GDPR;
c) fulfilling legal obligations imposed on the Administrator, including tax and accounting obligations – pursuant to Article 6(1)(c) GDPR;
d) establishing, pursuing or defending against claims – pursuant to Article 6(1)(f) GDPR, based on the Administrator’s legitimate interest in protecting and pursuing legal claims.
If personal data are processed on the basis of consent, the legal basis is Article 6(1)(a) GDPR.
Where processing is based on consent, the User may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
The provision of personal data is generally voluntary. However, failure to provide data that are necessary to respond to an enquiry, enter into or perform a contract, or comply with a legal obligation may make it impossible for the Administrator to take the requested action.
§4. Processing of data contained in e-mail correspondence
If a User contacts the Administrator by e-mail, the Administrator processes the personal data contained in that correspondence for the purpose of handling the enquiry, responding to the message and, where applicable, taking steps related to a potential or existing contractual relationship.
The legal basis for processing such data is, depending on the circumstances, Article 6(1)(f) GDPR or Article 6(1)(b) GDPR.
The Administrator may also process correspondence where necessary to establish, pursue or defend against claims, pursuant to Article 6(1)(f) GDPR.
The Administrator does not use e-mail correspondence for automated profiling or for making decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect the User.
§5. Retention of personal data
Personal data contained in correspondence are processed for the period necessary to handle the matter and, after its completion, for the period necessary to protect the Administrator against potential claims or to pursue such claims.
Where personal data are processed in connection with the performance of a contract, they are processed for the duration of the contractual relationship and thereafter for the period required by applicable law or necessary to establish, pursue or defend against claims.
Personal data contained in accounting and tax documentation are retained for the periods required by applicable law.
Where processing is based solely on consent, the data are processed until the consent is withdrawn, unless another legal basis permits or requires further processing.
The retention period may be extended where the processing is necessary for the establishment, pursuit or defence of claims, until such claims become time-barred.
§6. Recipients of personal data
Personal data may be disclosed to entities supporting the Administrator in operating the Website and conducting business activity, where such disclosure is necessary for the relevant purpose.
Depending on the circumstances, recipients or categories of recipients may include:
a) hosting and website infrastructure providers;
b) e-mail service providers;
c) accounting service providers;
d) IT service providers and technical support providers;
e) public authorities and entities authorised by law, where disclosure is required by applicable law.
The Administrator does not sell personal data or make them available to unauthorised third parties.
Where a service provider processes personal data on behalf of the Administrator, the Administrator takes appropriate measures to ensure that such processing is carried out in accordance with applicable data protection law.
§7. Rights of Users
In accordance with the GDPR, a User whose personal data are processed by the Administrator has, subject to the conditions and limitations provided for by law, the right to:
a) access their personal data;
b) rectify inaccurate or incomplete personal data;
c) request erasure of personal data;
d) request restriction of processing;
e) receive personal data in a structured, commonly used and machine-readable format and transmit those data to another controller, where the conditions for data portability are met;
f) object to the processing of personal data where the legal basis for processing is the legitimate interest of the Administrator;
g) withdraw consent at any time where processing is based on consent.
The right to erasure is not absolute and may not apply where further processing is necessary, for example, to comply with a legal obligation or to establish, pursue or defend against legal claims.
To exercise their rights, Users may contact the Administrator at alicja.painter@gmail.com.
The User also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if the User considers that the processing of their personal data violates the GDPR or applicable data protection laws.
§8. Voluntary provision of personal data
Providing personal data through e-mail correspondence is voluntary.
However, certain information may be necessary to respond to an enquiry, communicate with the User, prepare or perform a contract, or fulfil a legal obligation.
The Administrator does not require Users to provide personal data that are not necessary for the relevant purpose.
§9. Cookies and similar technologies
The Website uses cookies and similar technologies only to the extent necessary for its proper, secure and technically correct operation.
The Website does not use cookies for advertising, marketing or behavioural profiling purposes.
The Website does not use Google Analytics, Google Ads, Meta Pixel, Hotjar, Microsoft Clarity or similar analytical or marketing technologies.
The Administrator has disabled the Squarespace Activity Log functionality.
During the verification of the Website, only necessary technical cookies were identified. Their names and technical parameters may change as a result of updates to the Website or the technical infrastructure used by the Website.
Detailed information concerning the use of cookies is provided in the Cookie Policy available on the Website.
§10. International transfers of personal data
Depending on the services and technical solutions used to operate the Website and e-mail communication, personal data may potentially be processed outside the European Economic Area.
Where personal data are transferred to a country outside the European Economic Area, the Administrator takes appropriate measures required by applicable data protection law to ensure an adequate level of protection of personal data.
Such measures may include the use of a European Commission adequacy decision or appropriate safeguards provided for by the GDPR, where applicable.
§11. Security of personal data
The Administrator applies appropriate technical and organisational measures to ensure the security of processed personal data and to protect them against unauthorised access, loss, alteration, disclosure or destruction.
Access to personal data is limited to persons and entities that need such access for legitimate purposes related to the operation of the Website or the Administrator’s business activity.
The Administrator periodically reviews the technical and organisational measures applied to protect personal data.
§12. Automated decision-making and profiling
The Administrator does not use personal data for automated decision-making, including profiling, that produces legal effects concerning Users or similarly significantly affects them.
The Website does not use technologies designed to create advertising or behavioural profiles of Users.
§13. Changes to the Privacy Policy
The Administrator reserves the right to amend this Privacy Policy where necessary, in particular in the event of:
a) changes in applicable laws;
b) changes in the way the Website operates;
c) changes in the technologies or services used by the Administrator;
d) changes in the purposes or methods of processing personal data;
e) introduction of new functionalities on the Website.
The current version of the Privacy Policy is published on the Website.
The date of the latest update is indicated at the beginning of this Privacy Policy.
§14. Final provisions
This Privacy Policy provides general information concerning the processing of personal data in connection with the use of the Website.
This Privacy Policy does not replace an individual information notice required under Article 13 or Article 14 GDPR. Where a separate information notice is provided to a particular person, that notice shall apply to the extent specified therein.
In matters not regulated by this Privacy Policy, the provisions of the GDPR and applicable Polish law shall apply.
If you have any questions concerning the processing of personal data, you may contact the Administrator at:
Alicja Bodak
Harmony Alicja Bodak
ul. Racławicka 51/5
53-149 Wrocław, Poland
NIP: 8992944724
E-mail: alicja.painter@gmail.com