Privacy Notice

Who is responsible

Artur Jedrczak is the data controller for personal data handled by this photography shop. Contact arturjagodajedrczak@gmail.com or +357 95 581246 with privacy questions or requests. Purchases are made as guests; the shop does not require a customer account.

Data and purposes

We collect your name, email address, telephone number, optional order notes, chosen photo licenses, order reference, payment status, payment-provider reference and purchase timestamps to process your order, deliver downloads and provide support. The legal basis is performance of the purchase contract. Avoid including sensitive personal information in order notes.

We process support messages and contact details to answer inquiries, resolve problems and handle privacy requests, based on contract performance or our legitimate interest in supporting visitors. We may retain records required for tax, accounting and consumer-law compliance on the basis of legal obligations.

Request and security data may include IP addresses, timestamps, browser/device information and error records used by hosting and payment services. We use hashed request identifiers and attempt counts to limit abuse, protect private links and secure owner access, based on legitimate interests in preventing fraud and keeping the shop secure. The shop stores hashes of private order credentials, not their readable values.

Donation click statistics record the selected EUR amount, whether it was custom, the homepage source and timestamp. These measure outbound clicks, not payments received, and are used on the basis of legitimate interests to understand support-link activity. The shop does not collect your card number or CVC; payment details are entered in Paddle’s checkout.

Sharing and payment providers

We use Lovable Cloud and its hosting, storage, database and operational service providers to run the shop. Paddle is our reseller and Merchant of Record and receives purchase-related information for sales, payment processing, tax compliance, invoicing, fraud prevention, customer service and refunds. Paddle processes data under its own Privacy Policy.

Following a donation link takes you to Revolut, where its own privacy terms apply. We may share necessary records with professional legal or accounting advisers and public authorities where required by law. We do not sell personal data or use order details for unsolicited marketing.

Retention

Order and payment records are retained for the time needed to deliver and support your license and meet applicable legal, tax and accounting duties. Support records are kept while an inquiry or dispute is active and for any necessary legal follow-up. Security and operational records are kept only as long as reasonably needed to prevent abuse and investigate incidents. Data that is no longer needed is deleted or anonymised; applicable mandatory retention may prevent immediate deletion of some purchase records. Contact us for the retention requirements applicable to your order.

Essential cookies and browser storage

The shop uses local browser storage to remember your cart, session storage for private order access and checkout retries, and an encrypted essential cookie for owner sign-in. A separate essential visitor cookie helps apply request limits where a trusted network identifier is unavailable. These support checkout and security rather than advertising. Paddle and hosting services may use essential security and checkout cookies under their own notices.

You can clear or block cookies and site storage in your browser settings. Doing so may remove your cart or remembered order access, prevent checkout or sign you out. Keep your private order link in a safe place. This shop does not install advertising or optional analytics cookies for donation click counting.

Security and international transfers

We use appropriate technical and organisational safeguards, including encrypted connections, restricted server access, private original-file storage and time-limited download links. No system can guarantee absolute security. Keep private order links confidential; anyone with an authorised link may be able to access the order. Report a lost or disclosed link so access can be revoked and ownership verified.

Service providers may process data outside the EEA. Where required, transfers rely on adequacy decisions, Standard Contractual Clauses or other lawful safeguards provided through the relevant service arrangements. Contact us for information about safeguards applicable to your data.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact us using the details above; we may need to verify your identity. We respond to GDPR requests within one month, subject to lawful extensions for complex requests. You may complain to your local data protection authority, including the Cyprus Commissioner for Personal Data Protection if applicable.

See the Terms & Conditions and Refund Policy for purchase information. This notice may be updated when the shop or its services change; the effective date is shown above.