1. This Privacy Policy sets out the rules for the processing and protection of Users’ personal data in connection with the use of FLAME STUDIO services and website.

 

2. The Data Controller is Artsemi Ryzhankou (JDG), NIP: 8992950831, REGON: 524372144, ul. marsz. Józefa Piłsudskiego 74/131, 50-020 Wrocław, , Polska. Contact: e-mail: flame.studio.pl@gmail.com, tel.: 571 414 554.

 

3. The Controller applies organizational and technical measures to ensure data security and compliance with GDPR, the Personal Data Protection Act, and the Act on the Provision of Electronic Services. We use, among others, TLS/SSL encryption, access restrictions, regular backups, and software updates. The website is hosted by an external provider; server logs may include: the requested URL, date and time of the request, IP address, browser information, and error information – solely for technical and security purposes.

 

4. Legal bases for data processing:

a) User consent (Art. 6 sec. 1 lit. a GDPR),

b) necessity for concluding and performing the rental agreement (Art. 6 sec. 1 lit. b),

c) legal obligations of the Controller (Art. 6 sec. 1 lit. c),

d) legitimate interest of the Controller (Art. 6 sec. 1 lit. f) – including pursuing claims and ensuring website security.

 

5. The categories of personal data processed may include: first and last name or business name, email address, telephone number, billing details (including address and Polish tax identification number (NIP), if provided or required), information about reservations and orders, the product purchased, the selected payment method and payment status. When a digital product is purchased, the data is used to the extent necessary to receive and fulfil the order, process the payment, deliver the product, issue required documents and handle complaints. The Controller does not receive or store complete payment card details.

 

6. Purposes of processing: booking management, performance of the agreement, communication, settlements, complaints, pursuing claims, statistics, and website security.

 

7. Recipients of data: personal data may be disclosed to entities providing services necessary for the operation of the Website, reservations, the online store and payments, in particular:

a) the provider of the Bookero reservation system – SAFI STUDIO Paweł Nowakowski;

b) Wix.com Ltd. and entities working with Wix to provide hosting, operate the online store and process orders;

c) payment service providers used for a given transaction, including PayU S.A., PayPro S.A. (Przelewy24), or the entity processing Fondy payments, if the relevant payment method is available and selected;

d) providers of email, IT and accounting services;

e) public authorities, where disclosure is required by law. Data is disclosed only to the extent necessary to provide the relevant service or comply with a legal obligation.

 

8. The retention period for personal data depends on the purpose for which it is processed:

a) data relating to a reservation or order is retained for the time necessary to perform the agreement and subsequently for any period required by law or necessary to establish, pursue or defend legal claims;

b) accounting and tax documents are retained for the period required by applicable law;

c) data processed on the basis of consent is retained until consent is withdrawn, unless another legal basis permits its continued processing;

d) technical data relating to the security of the Website is retained for the time necessary to ensure security and investigate any incidents.

 

9. User rights: the right to access data, rectify data, erase data where there is no basis for further processing, restrict processing, data portability, object to processing, and withdraw consent at any time, without affecting the lawfulness of processing carried out before consent was withdrawn.

 

10. Cookies: the Website uses cookies necessary for the operation of the website, reservation system and online store, including the shopping cart, order placement and security functions. The Wix platform and integrated services may also use other cookies. Where their use requires the User’s consent, they are used only after that consent has been obtained. The User can manage cookies through the consent settings available on the Website and through their browser settings.

 

10a. Payment-related cookies:

when payment forms are used, payment service providers may use their own cookies to process payments, ensure security and prevent fraud. Further information is available in the privacy policy of the provider processing the relevant payment.

 

11. Providing data is voluntary, but necessary to conclude the rental agreement and provide services.

 

12. Data is not sold or transferred to third parties for marketing purposes without separate consent.

 

13. Personal data may be processed outside the European Economic Area in connection with the use of technology providers, in particular Wix.com Ltd. Data is transferred on the basis of a European Commission adequacy decision or subject to appropriate safeguards, in particular Standard Contractual Clauses. Information about the safeguards used can be obtained by contacting the Controller at flame.studio.pl@gmail.com.

 

14. Changes to the Policy: technological development, changes in law, or changes in services may result in updates; the current version will be published on the website.

 

15. Complaints: The User has the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if they believe that the processing violates the regulations.