Privacy policy

1. Data controller

The controller of your personal data is Paweł Zienkiewicz, a natural person operating under the ZIEN Studio brand (the “controller”, “I” or “me”).

For anything concerning your personal data, including exercising the rights described in this policy, write to: info.pzgraphics@gmail.com.

No data protection officer has been appointed.

2. What data I process

I only process the data needed to run the website and handle correspondence:

• email data — your email address, your name or sender name, and whatever you include in your message, such as a company name, phone number, website address, project description and attachments;
• technical data — IP address, date and time of the request, the page requested, the referring page, and information about your browser and operating system, processed every time the site is displayed;
• project data — if we decide to work together: the data needed to prepare a quote and to conclude and settle a contract.

I do not ask for special categories of data (such as health data) — please do not include them in your messages.

3. Purposes and legal bases

Each purpose has its own legal basis under the GDPR (Regulation (EU) 2016/679):

• replying to your message and further correspondence — my legitimate interest in answering enquiries and communicating with people who contact me (Art. 6(1)(f) GDPR) and, when you write on your own behalf about a contract, taking steps at your request before entering into it (Art. 6(1)(b) GDPR);
• preparing a quote, concluding and performing a contract — necessity for a contract to which you are a party (Art. 6(1)(b) GDPR) or, when you represent a company or other organisation, my legitimate interest in communicating with the person acting on its behalf (Art. 6(1)(f) GDPR);
• legal obligations, such as tax obligations if we enter into paid work — compliance with a legal obligation (Art. 6(1)(c) GDPR);
• establishing, exercising or defending legal claims — my legitimate interest (Art. 6(1)(f) GDPR);
• delivering the site, keeping it secure and diagnosing errors — my legitimate interest in providing a working and secure website (Art. 6(1)(f) GDPR).

No processing is currently based on consent — the site uses no tools that would require it.

4. Contacting me by email

The site has no contact form. The “Send me an email” button opens your email app with my address filled in — you send the message from your own mailbox, and the site neither sees nor stores its content.

Your message arrives in my Gmail (Google) mailbox. I read it and reply personally. I use the correspondence only to reply, prepare a quote and, if we work together, for the project — I do not add you to mailing lists or send marketing you have not asked for. Your own email provider processes the message under its own terms.

5. Technical data and security

The site is static: there is no database, no login and no server-side code processing visitors’ data. It is delivered by Cloudflare — every time the site is displayed, Cloudflare’s servers process the technical data described in section 2 to deliver the page to your browser, speed it up and protect it from attacks and automated traffic (bots). The connection is encrypted (HTTPS).

As part of this protection:

• Cloudflare may ask your browser to send reports about failed connections (Network Error Logging) — according to Cloudflare, these reports contain no data identifying the user;
• the email address in the page code may be protected from harvesting bots — a small Cloudflare script served from this domain restores it in your browser, without cookies;
• if traffic looks suspicious, Cloudflare may show a short security check and set a technical cookie (section 7).

I do not use technical data to identify visitors or to build profiles.

6. Hosting and email providers

I use external providers who have access to data:

• Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) — website hosting (Cloudflare Pages), content delivery network, DNS and abuse protection. Cloudflare processes technical data on my behalf as a processor, under its Data Processing Addendum. More: Cloudflare’s privacy policy.
• Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — Gmail, where I receive and keep correspondence. Google processes data as described in the Google Privacy Policy.

The site loads nothing from other services: fonts, images and recordings are served from this domain.

7. Cookies and browser storage

The site itself sets no cookies and stores nothing in your browser (localStorage, sessionStorage). I use no analytics or advertising tools, tracking pixels or content embedded from other services (maps, videos, social media plugins). That is why the site shows no consent banner.

The exception may be technical Cloudflare cookies, set only in specific situations and only to keep the site secure. They are not used for tracking or advertising, and normal browsing usually does not set them. They do not require consent because they are strictly necessary to deliver the page you ask for (Art. 399(3) of the Polish Electronic Communications Law).

You can delete and block cookies in your browser settings; blocking Cloudflare’s cookies may make it harder to pass a security check. If I ever switch on analytics or another tool that requires consent, I will update this policy first, and the tool will only run once you consent.

8. Recipients and transfers outside the EEA

Data may only be received by the providers described in section 6 and — where the law requires it — by authorised public authorities. I do not sell data or share it for marketing purposes.

Cloudflare and Google operate globally, so data may also be processed outside the European Economic Area, in particular in the USA. Such transfers rely on:

• the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework — Cloudflare, Inc. and Google LLC participate in it;
• the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), which the providers use where they are required.

You can ask me for information about these safeguards. You can check the providers’ participation in the Data Privacy Framework list.

9. How long I keep data

• Correspondence that does not lead to a project — for as long as we exchange messages, then no longer than 12 months after the last message, in case we pick up the conversation again.
• Correspondence and data related to a project — for the duration of our work together, then until the statutory limitation periods for claims expire.
• Accounting documents — for the period required by tax law (as a rule 5 years from the end of the year in which the tax payment deadline passed).
• Technical data — for a short period set by Cloudflare’s rules, as needed for security and error diagnosis; cookies — for the periods given in section 7.

I delete data processed on the basis of my legitimate interest earlier if you successfully object or ask for erasure and there is no reason to keep it.

10. Your rights

Under the conditions set out in the GDPR, you have the right to:

• access your data and receive a copy (Art. 15 GDPR);
• rectify your data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• data portability for data processed by automated means on the basis of a contract (Art. 20 GDPR);
• object to processing based on my legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, write to the address given in section 1. I will reply without undue delay and within one month at the latest — in particularly complex cases this may be extended by two further months, and I will let you know. Exercising your rights is free of charge. I may ask for information needed to confirm your identity.

11. Complaints to the supervisory authority

If you believe I process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland). The UODO website explains how. You can also contact the supervisory authority in the EU country where you live or work.

12. Is providing data required?

Providing data is voluntary. Without your email address, however, I cannot reply to your message, and without the data needed to conclude and settle a contract, I cannot enter into it; some billing data is required by tax law. Your browser sends technical data automatically — without it the site cannot be displayed.

13. Automated decisions and profiling

I make no decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Cloudflare’s automated protection assesses traffic for security only and can at most ask for an additional check.

14. External links and social media

The site links to other services — including the websites of projects shown in the portfolio (such as IQ Fence and Paola Nails) — which only open when you click. From then on, the owner of that service processes data under its own terms. The site embeds no social media plugins, “Like” buttons, chat widgets or pixels, so it passes no data to those services before you click a link.

15. Changes to this policy

I update this policy when the way data is processed changes — for example when analytics is switched on, a contact channel is added or a provider changes. The current version is always available on this page, and the date at the top shows the latest change. Tools that require consent will not be switched on before this policy is updated, nor without your consent.