Privacy policy (GDPR)

Last updated: 1 August 2026.

1. Data controller

The controller of your personal data is Tytus Kozak, email: tytuskozak@gmail.com, phone: +48 505 441 083. The controller's full postal details (address for correspondence) are set out in §1 of the Terms. I have not appointed a Data Protection Officer, so please write to the email address above in all matters concerning your data.

2. Purposes and legal bases of processing

  • performing the service and contract — Art. 6(1)(b) GDPR,
  • contact and preparing a quote — Art. 6(1)(b) and (f) GDPR (legitimate interest),
  • legal obligations, including tax and accounting — Art. 6(1)(c) GDPR,
  • pursuing or defending claims — Art. 6(1)(f) GDPR.

3. Scope of data

Full name, email address, phone number, data necessary to conclude a contract and issue an invoice, and the content of correspondence.

AI photo sessions and photo editing. If you order an AI photo session, photo editing or a graphic featuring a specific person, I additionally process the photographs you provide and the likeness they contain. I process them solely to perform the order (Art. 6(1)(b) GDPR), and I base any use of a person's likeness on that person's separate consent to its dissemination (Art. 81 of the Polish Copyright Act). I delete source photographs no later than 90 days after the order is completed, unless you ask me to keep them for further work. I do not use your photographs to train AI models.

4. Data recipients

Data may be entrusted to: the useme.com platform (contracts), bizky.ai (VAT invoices), the hosting and email provider, an accounting office, and entities authorized under the law. Analytics data may be transferred to Google Ireland Limited (Google Analytics), but only if you consent to cookies. Without your consent no connection to Google's servers is made at all.

Contact form. The form on the Contact page is handled by the external service FormSubmit (formsubmit.co), which forwards the message to my email address. The service operates outside the European Economic Area, in the United States, which means that the data you enter in the form (name, email, phone number, message content) is transferred to a third country. FormSubmit does not publish a data processing agreement or standard contractual clauses, so I cannot guarantee the safeguards under Chapter V GDPR for this route. For that reason the transfer takes place solely on the basis of your explicit consent (Art. 49(1)(a) GDPR), given via a separate checkbox under the form, after being informed of the above risk. Without that consent the form will not be sent. You do not have to give it. Instead of the form you can write directly to tytuskozak@gmail.com, call, or message me on WhatsApp. Those routes do not involve FormSubmit.

5. Retention period

We store data for the duration of the service and for periods required by law (e.g. accounting documents — under tax law), and until claims become time-barred.

6. Your rights

You have the right to: access your data, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).

7. Transfers outside the EEA and AI tools

In my work I use tools, including artificial intelligence tools, that may process data outside the European Economic Area. This takes place based on appropriate safeguards (e.g. standard contractual clauses). I pass to AI tools only the data necessary to perform the service.

8. Cookies and Google Analytics

This site uses the analytics tool Google Analytics 4 (provider: Google Ireland Limited), which uses cookies (including _ga, _ga_*) to create anonymous visit statistics and improve the site. Analytics cookies are not essential, so they run only after you give consent in the cookie banner (legal basis: consent under Art. 6(1)(a) GDPR and the provisions of the Polish Electronic Communications Law Act of 12 July 2024 on access to information on a terminal device). Until you consent, the Google script is not loaded at all, so your browser makes no connection to Google's servers and not even your IP address is transferred. Apart from the above, the site uses only essential (technical) cookies, which do not require consent by law. Fonts and animation libraries are served from my own server, not from external CDNs. If you consent, statistical data may be transferred to Google outside the European Economic Area based on standard contractual clauses.

8a. How to withdraw or change your cookie consent

Click “Cookie settings” in the footer of any page. The banner will reopen, show your current choice and let you change it with one click. Withdrawing consent is exactly as easy as giving it (Art. 7(3) GDPR) and does not affect the lawfulness of processing carried out before the withdrawal. Technical note: your choice is stored in your browser's localStorage under the key cc-consent-v1, so clearing cookies alone does not reset it. Use the footer link or clear the site data in your browser settings.

9. Automated decisions

I do not make decisions about you based solely on automated processing that would produce legal effects.

10. Voluntary provision of data

Providing data is voluntary but necessary to prepare a quote and perform the service.

← Back to home