Privacy Policy
Effective 11 September 2026, applicable to the reflectreality.pl website.
Controller and contact
The data controller is Kamila Kosarzecka, operating the Reflect Reality studio. For matters concerning personal data, write to office@reflectreality.pl.
Data, purpose and legal basis
- When you submit the contact form, we process your name, email address and the content of your message in order to respond to your enquiry and prepare a quote. The legal basis is Article 6(1)(b) GDPR - steps taken at your request prior to entering into a contract.
- Your IP address is used solely in application memory to limit form abuse. It is not stored in a database. The legal basis is our legitimate interest in protecting the website against spam - Article 6(1)(f) GDPR.
- We collect basic technical data about how the website performs: the path visited, the language selected, errors and page speed metrics. Server-side visit counters do not use cookies or a device identifier. The legal basis is our legitimate interest in maintaining and developing the website - Article 6(1)(f) GDPR.
- Once you give consent, we enable browser-based analytics to measure errors and page performance metrics. The analytics do not set any additional cookies. The legal basis is consent - Article 6(1)(a) GDPR.
Form data is delivered directly to our mailbox through a message delivery provider and is not stored in the website's database. We retain it for as long as is necessary to handle the correspondence and, where a message is relevant to establishing, pursuing or defending claims, for the period until those claims become time-barred. Telemetry data is retained for 30 days.
Recipients and place of processing
We do not sell data. Data may be processed on our behalf by providers of hosting, technical infrastructure, website performance monitoring and message delivery - solely to the extent necessary to provide those services. Data is stored on infrastructure within the European Union and is not transferred outside the European Economic Area.
Cookies and analytics
| Cookie | Purpose | Duration |
|---|---|---|
locale | remembering the language | 1 year |
rr-consent | remembering the consent choice | 184 days |
authjs.session-token / __Secure-authjs.session-token | session of a logged-in administrator, not a visitor | 24 hours |
authjs.csrf-token | protecting the administrator sign-in form | session |
authjs.callback-url | return address after an administrator signs in | session |
The language, consent decision and administrator sign-in cookies are necessary for the relevant feature to work. The last three are set only for the site administrator - a visitor never receives them. Analytics and marketing cookies are not used. You may withdraw or change your consent to analytics at any time in the cookie settings available in the footer. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
Your rights
You have the right to request access to your data, its rectification, erasure, restriction of processing and data portability, and - where the legal basis is our legitimate interest - to object. You may also withdraw your consent at any time. We accept requests at office@reflectreality.pl. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Poland).
Providing data in the form is voluntary, but without it we cannot respond to your message. We do not take decisions about you based solely on automated processing, including profiling.
We update this policy whenever the way data is processed on the website changes.