DOCUMENTS · DRAFT
Privacy policy
1. Controller and contact
Agnieszka Mazur is identified as the person presenting this website. Privacy contact: kontakt@agamazur.pl. Full legal controller identity, address and country of establishment: [TO BE COMPLETED]. Confirm whether the controller is an individual business, company or another entity; the brand name alone does not establish this.
2. Data and current website functions
This is an informational website. It has no active data-collection form, payment checkout or connected booking calendar. Email enquiries may contain your name, email address, contact details and message. Infrastructure providers may handle IP addresses, browser details, request times and security logs. Actual logging scope and settings must be confirmed with the hosting provider.
3. Purposes and legal bases
Contract-related enquiries may be handled under GDPR Article 6(1)(b). Other correspondence, justified claims handling and website security may rely on Article 6(1)(f), subject to necessity and balancing of rights; the interests are communication, protecting rights and infrastructure. Legal duties may require Article 6(1)(c). Where required for a specific purpose, consent is a separate basis under Article 6(1)(a), not blanket permission for all processing.
4. Sensitive data and sessions
Do not send detailed health history or medical records in an initial enquiry. Before health or other special-category data are collected, both an Article 6 basis and an appropriate Article 9(2) condition, safeguards, scope and retention must be established: [TO BE CONFIRMED BEFORE SUCH PROCESSING]. Accepting terms does not constitute explicit consent to health-data processing. Session-related processing needs a separate tailored notice.
5. Providers and recipients
The published version uses Sites / ChatGPT infrastructure with Cloudflare. Google Fonts are requested from Google servers, disclosing connection-related technical data. Email correspondence may involve an email provider. Full entity names, roles, processing arrangements and locations: [TO BE VERIFIED]. FormSubmit and Calendly are not connected services in this website version.
6. Facebook and external links
The Facebook section currently displays sample cards and ordinary links. It does not fetch live posts or embed an active Meta widget. External websites apply their own terms when opened. Before enabling embeds, a newsletter, analytics, forms or booking, update this notice and introduce any required choice or consent mechanism.
7. Cookies and browser technologies
The website code does not add optional analytics or advertising cookies. Hosting, sign-in and security layers require separate verification. The final list of technologies, providers, purposes and durations must be checked on the production host. Optional technologies requiring consent should not load before consent; continued browsing alone is not consent.
8. Retention
Proposed ordinary-enquiry retention: while handling the matter and up to 12 months after correspondence ends. This is a proposal for approval, not a statement of established practice. Contract and accounting records follow applicable statutory periods; claims-related records are kept for a justified protection period. Specific periods for session records, logs and providers: [TO BE COMPLETED].
9. Transfers outside the EEA
Establish whether providers transfer data outside the European Economic Area. Where relevant, identify recipients, countries and Chapter V safeguards before transfer, such as an applicable adequacy decision or standard contractual clauses with necessary assessments. This draft does not verify a transfer merely because a provider is widely used.
10. Rights and complaints
Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawfulness. Contact kontakt@agamazur.pl. Replies are generally due within one month; extensions require GDPR conditions to be met. You may complain to a competent supervisory authority, particularly where you habitually reside, work or believe an infringement occurred, including Poland’s UODO or Ireland’s Data Protection Commission.
11. Voluntary provision and updates
Providing data in correspondence is voluntary, but reply details are needed to respond. The website code does not perform profiling or automated decisions with legal effects. Recheck the notice when services change or the site moves to WordPress. Draft prepared on 14 November 2026.