§1. General provisions
This Privacy Policy explains how personal data, cookies and similar technologies are handled on the Galeria Sztuki Witryna website available at https://www.galeriawitryna.pl/, hereinafter referred to as the “Website”.
The Policy applies to visitors to the Website, people using the contact form and people contacting the Gallery through the contact details made available on the Website.
The Controller takes due care to protect visitors’ privacy and processes personal data in accordance with applicable law, including Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act and the Polish Electronic Communications Law.
§2. Personal data controller
The controller of personal data is Galeria Sztuki Witryna Agnieszka Kuśnierz, a sole proprietorship operating at ul. Chopina 1, 20-026 Lublin, Poland, Tax Identification Number (NIP): 7121287211, hereinafter referred to as the “Controller”.
Contact details:
a) address: ul. Chopina 1, 20-026 Lublin, Poland;
b) email: galeriawitryna@wp.pl;
c) telephone: +48 81 441 24 15.
The Controller determines the purposes and means of processing personal data connected with the operation of the Website and the handling of correspondence addressed to the Gallery.
No Data Protection Officer has been appointed. For all matters concerning personal data protection and the exercise of GDPR rights, contact the Controller directly at galeriawitryna@wp.pl.
§3. Scope and collection of personal data
Depending on how the Website is used, the Controller may process:
a) Contact details and message content: first name, surname, email address, optional telephone number and the content of a message submitted through the contact form or by email.
b) Technical data: IP address, browser and device information, date and time of a request, requested resource and other data contained in server logs.
c) Data related to external services: technical information processed when Google Maps or embedded Facebook content is enabled, in particular an IP address and browser and device information.
d) Privacy preferences: information about the visitor’s choice concerning optional external content.
The contact form sends the submitted information through the Website server to the Gallery’s email inbox. The data is not stored in the Website database.
A visitor may also contact the Controller by email, telephone or through the contact links provided on the Website. Contact data is provided to the Controller only when the visitor knowingly sends a form or a message.
The Controller does not request special categories of personal data referred to in Article 9 GDPR. Visitors should not include such information in correspondence unless it is necessary.
§4. Purposes and legal grounds for processing
Personal data may be processed for the following purposes:
a) handling enquiries and correspondence — Article 6(1)(f) GDPR, the Controller’s legitimate interest in communicating with visitors and responding to enquiries;
b) taking steps at the request of a data subject before entering into a contract and performing a contract — Article 6(1)(b) GDPR;
c) ensuring the security, proper operation and reliability of the Website — Article 6(1)(f) GDPR;
d) establishing, pursuing or defending legal claims — Article 6(1)(f) GDPR;
e) complying with legal obligations incumbent on the Controller — Article 6(1)(c) GDPR;
f) displaying an interactive Google map after consent has been given — Article 6(1)(a) GDPR;
g) displaying embedded Facebook posts after consent has been given — Article 6(1)(a) GDPR;
h) recording and respecting the visitor’s privacy choice — Article 6(1)(f) GDPR and Article 399(3) of the Polish Electronic Communications Law in respect of storage necessary to remember that choice.
The Controller does not use contact details to send automated newsletters or unsolicited direct marketing messages.
§5. Contact form and email
The contact form may require a first name, surname, email address and message content. A telephone number is optional. Fields marked as required are necessary to send the message and receive a reply.
The form sends the message over an encrypted connection to galeriawitryna@wp.pl. The submitted information is not stored in the Website database and remains in the correspondence held in the Controller’s email inbox.
Providing data is voluntary, but failure to provide the required information will make it impossible to send the form or deal with the enquiry.
Electronic correspondence may be archived where justified by the need to document arrangements, handle a matter, perform a contract or protect the Controller’s rights, subject to the retention periods described in §11.
§6. Google Maps
The Website uses Google Maps to show the location of Galeria Sztuki Witryna on an interactive map. The service is provided by Google Ireland Limited. Information about Google’s processing of personal data is available in the Google Privacy Policy.
The interactive map remains blocked until the visitor consents to “External content”. Before consent, the browser does not load the map or connect to Google for this purpose. After consent, the map may load automatically during the current and subsequent visits.
Once enabled, Google may receive an IP address, device and browser information, the address of the visited page and information about interactions with the map. Google Maps may use cookies or similar technologies in accordance with Google’s own terms.
Consent may be withdrawn at any time through the privacy settings available in the Website footer. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.
Using Google Maps does not automatically provide the Controller with the visitor’s precise location.
§7. Embedded Facebook content
The Website may display public posts from the Galeria Sztuki Witryna Facebook page. The service is provided by Meta Platforms Ireland Limited. Information about Meta’s processing is available in the Meta Privacy Policy and the Meta Cookies Policy.
Facebook content remains blocked until the visitor consents to “External content”. Merely opening the Website before consent does not cause a Meta script, frame or resource to be loaded in the browser.
Once consent has been given, Meta may receive an IP address, device and browser information, the address of the visited page and information about interactions with the embedded content. If the visitor is signed in to Facebook, Meta may associate this information with the visitor’s account.
Meta may use cookies or similar identifiers under its own rules. The Controller has no control over Meta’s subsequent processing.
§8. Cookies and similar technologies
The Website may use cookies and similar browser storage technologies. They are divided into:
a) Necessary storage: used to operate the Website, provide security and remember privacy preferences. It does not require consent where it is technically necessary.
b) External-content technologies: related to Google Maps and embedded Facebook content. They are enabled only after consent to “External content”.
Cookies may be session cookies, removed after the browser session ends, or persistent cookies, stored for a specified period or until removed by the visitor.
Visitors can change their choice at any time through the privacy settings in the footer and can manage cookies in their browser settings, including limiting or deleting stored information.
Blocking optional technologies may make the interactive map and embedded Facebook posts unavailable, but does not prevent access to the Website’s essential content or the contact form.
The Website does not currently use Google Analytics, Meta Pixel or Vercel Analytics to analyse visitor activity or run personalised advertising campaigns.
§9. Recipients of personal data
Personal data may be disclosed, only to the extent necessary for a specified purpose, to:
a) hosting and infrastructure providers, in particular Vercel Inc.;
b) email service providers, in particular the provider of WP Poczta;
c) IT service providers supporting or securing the Website;
d) Google, when the embedded Google Maps service is enabled;
e) Meta Platforms Ireland Limited, when embedded Facebook content is enabled;
f) public authorities or other entities authorised under applicable law.
The Controller uses external providers subject to applicable personal data protection requirements and an appropriate legal basis for processing.
§10. Transfers outside the European Economic Area
Because the Website uses services provided by Vercel, Google and Meta, personal data may be processed in or transferred to countries outside the European Economic Area, including the United States.
Where required, transfers are based on an adequacy decision, participation in the EU–US Data Privacy Framework, standard contractual clauses approved by the European Commission or another transfer mechanism permitted by GDPR.
Information about the safeguards used and how to obtain a copy may be requested from the Controller at galeriawitryna@wp.pl.
§11. Retention periods
Personal data is retained only for as long as necessary for the purpose for which it was collected, in accordance with the storage limitation principle in Article 5(1)(e) GDPR.
Electronic correspondence may be retained for the duration of the correspondence and generally for up to three years after it ends where this is justified by documenting arrangements, protecting the Controller’s rights or establishing, pursuing or defending claims.
Data connected with a contract or claims may be retained for the applicable limitation period, generally three or six years depending on the nature of the claim. Documents subject to statutory retention duties are kept for the period required by tax, accounting or other applicable law.
Technical logs are retained in accordance with the hosting provider’s retention rules and only for as long as necessary for security and diagnostics. Information based on consent is processed until consent is withdrawn, unless another legal basis applies.
The Controller periodically reviews stored data and deletes or anonymises information whose continued processing is no longer justified. External providers such as Google and Meta determine their own retention periods under their privacy policies.
§12. Rights of data subjects
Under the conditions set out in GDPR, a data subject has the right to:
a) access their personal data and receive a copy;
b) rectify inaccurate or incomplete data;
c) request erasure or restriction of processing;
d) object to processing based on the Controller’s legitimate interests;
e) data portability where the statutory conditions are met;
f) withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
g) lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
To exercise these rights, contact the Controller at galeriawitryna@wp.pl. Requests are handled within the time limits laid down by GDPR, normally no later than one month after receipt, subject to extensions permitted by law.
§13. Automated decision-making and profiling
The Controller does not use Website visitors’ personal data for automated decision-making that produces legal effects or similarly significantly affects them within the meaning of Article 22 GDPR.
The Controller does not profile visitors for personalised advertising. These statements concern the Controller’s activities and do not replace the information provided by independent external service providers about their own processing.
§14. Personal data security
The Controller applies technical and organisational measures appropriate to the nature, scope and risks of processing. The Website uses encrypted HTTPS connections, restricted administrative access and security mechanisms provided by its hosting and technology suppliers.
The Controller takes steps to prevent unauthorised access, accidental loss, unauthorised alteration or disclosure of personal data. No method of transmitting information over the Internet can, however, guarantee absolute security.
§15. Links to external websites
The Website contains links to external websites and services, including Facebook, Instagram, Google Maps and email or telephone applications. Opening such a link takes the visitor outside the Website and may be governed by the privacy rules of the relevant provider.
The Controller is not responsible for the privacy policies or data-processing practices of independent external website operators.
§16. Changes to this Privacy Policy
The Controller may update this Privacy Policy following changes in law, technologies used by the Website or the way personal data is processed.
The current version is always published on this page. Material changes may additionally be communicated through an appropriate notice on the Website.
If new analytics, advertising or external tools are introduced, the Controller will update the relevant privacy information before or when they are enabled.
§17. Final provisions
This Privacy Policy is provided for information purposes and fulfils the Controller’s obligations under personal data protection law.
Matters not covered by this Policy are governed by GDPR, the Polish Personal Data Protection Act, the Polish Electronic Communications Law and other applicable legislation.
Last updated: 23 October 2026.