JAN MARIA TOMASZEWSKI / LEGAL DOCUMENTS
Privacy / GDPR
Updated: 27 October 2026
Jan Maria Tomaszewski is the data controller and Website operator.
01Scope and legal framework
This Privacy Policy explains how personal data of visitors to the website dedicated to Jan Maria Tomaszewski’s artistic work (the “Website”) is processed, particularly when visitors submit enquiries through the contact form. It is prepared with reference to Regulation (EU) 2016/679 (the “GDPR”) and applicable Polish law.
02Controller and contact details
The data controller is Jan Maria Tomaszewski. The controller may be contacted through the Website contact form. Requests concerning personal data should be addressed to the controller using the details provided here.
03Categories of personal data
The contact form may collect the sender’s name, email address, enquiry category, message and any other information voluntarily included in correspondence. Technical information, such as IP address, request time, browser parameters and error logs, may also be processed insofar as these are actually recorded by the Website infrastructure.
04Purposes and lawful bases
Enquiry data is processed to receive and respond to correspondence, generally under the controller’s legitimate interests (Article 6(1)(f) GDPR). Where the enquiry concerns steps taken at the individual’s request before entering into a contract, Article 6(1)(b) GDPR may apply. Technical data may be used for security, abuse prevention and operation of the Website (Article 6(1)(f) GDPR). Where a separate activity requires consent, its scope and withdrawal arrangements will be explained.
05Contact form and anti-spam measures
The form requests contact details, a topic and a message. A simple arithmetic challenge and hidden anti-spam field are used to reduce automated submissions. The form’s acknowledgement concerning use of data to respond to an enquiry does not constitute marketing consent. Sending a message does not conclude a contract.
06Recipients and processors
Data may be made available, as necessary, to website hosting and infrastructure providers (Vercel), email hosting providers (contact form messages are delivered via authenticated SMTP) and authorised persons working with the controller. Access should be limited to what is necessary and governed by appropriate safeguards and processor agreements where required.
07International data transfers
International technical service providers may involve access to or transfers of personal data outside the European Economic Area. Where such transfers take place, the controller must establish an appropriate mechanism under Chapter V GDPR, such as an adequacy decision or standard contractual clauses together with any necessary supplementary measures. The precise locations and safeguards must be verified against provider documentation.
08Retention periods
Correspondence is kept for as long as necessary to address an enquiry and, where justified, to establish, pursue or defend legal claims. Technical logs should be retained only for periods consistent with security needs and provider settings. Specific retention periods depend on the verified service configuration. Once no lawful basis remains, data should be erased or anonymised unless retention is required by law.
09Your rights
Subject to the conditions of the GDPR, you may request access and a copy of your data, rectification, erasure, restriction of processing, portability where applicable, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing. Requests should be addressed to the controller and will be handled within the periods required by the GDPR.
10Right to lodge a complaint
You may complain to a competent supervisory authority if you consider that processing infringes the GDPR. In Poland, this is the President of the Personal Data Protection Office (UODO). This does not prevent you from pursuing other legal remedies.
11Voluntary submission and automated decisions
Providing information through the contact form is voluntary, but without sufficient contact information a response may not be possible. The Website is not intended to make decisions producing legal or similarly significant effects solely by automated means, nor to profile visitors for that purpose.
12Security measures
The controller should use security measures appropriate to the risks, including HTTPS, access controls, limited administrative permissions and anti-abuse protections. No internet transmission or storage method can be guaranteed completely secure.
13Updates
This Policy may be updated to reflect legal changes, Website functionality or service providers. The current version and its revision date are published on the Website.