Privacy Policy
Effective Date: 1 January 2026
This Privacy Policy explains how Joanna Szmerdt (“I”, “me”, “my”) collects, uses, and protects personal data when you visit or use the website https://joannaszmerdt.com (the “Website”), purchase original artworks, or contact me.
I am committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Polish and EU data protection laws.
1. Data Controller
The data controller responsible for your personal data is:
Joanna Szmerdt
Poland
Email: joannaszmerdt@gmail.com
2. Personal Data I Collect
I collect only the personal data that is necessary to operate my website and sell original artworks. This may include:
-
Identification data: name and surname
-
Contact data: email address, postal/shipping address, phone number
-
Order data: details of purchased artworks, transaction history
-
Communication data: messages sent via contact forms or email
I do not intentionally collect sensitive personal data.
3. Purpose of Processing
Your personal data is processed for the following purposes:
-
to process and fulfill orders of original artworks;
-
to arrange shipping and delivery;
-
to communicate with you regarding your purchase or inquiry;
-
to comply with legal and tax obligations under Polish and EU law;
-
to manage and improve the Website.
Your data will not be used for purposes incompatible with those listed above.
4. Legal Basis for Processing (GDPR Article 6)
Personal data is processed based on one or more of the following legal grounds:
-
Performance of a contract – when processing is necessary to complete your purchase and deliver artwork;
-
Legal obligation – for accounting, tax, and record-keeping purposes;
-
Consent – when you voluntarily contact me or subscribe to optional communications;
-
Legitimate interest – to respond to inquiries and manage the Website.
5. Data Recipients
Your personal data may be shared only with trusted third parties when necessary, such as:
-
shipping and courier companies (for delivery purposes);
-
accounting or payment service providers (if applicable);
-
public authorities when required by law.
Your data is never sold, rented, or shared for marketing purposes.
6. International Data Transfers
Personal data is primarily processed within the European Union.
If any data is transferred outside the EU (e.g., through email or hosting services), appropriate safeguards required by GDPR are applied.
7. Data Retention
Personal data is retained only for as long as necessary:
-
to fulfill contractual obligations;
-
to comply with legal and tax requirements;
-
to resolve disputes or enforce agreements.
After this period, data is securely deleted or anonymized.
8. Your Rights Under GDPR
You have the following rights regarding your personal data:
-
the right to access your data;
-
the right to correct inaccurate or incomplete data;
-
the right to request deletion of your data (“right to be forgotten”);
-
the right to restrict processing;
-
the right to data portability;
-
the right to withdraw consent at any time;
-
the right to lodge a complaint with a supervisory authority.
In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).
9. Cookies
The Website may use basic cookies necessary for its proper functioning.
You can manage or disable cookies in your browser settings.
If additional cookies (e.g. analytics) are used, a separate cookie consent mechanism may apply.
10. Data Security
Appropriate technical and organizational measures are applied to protect personal data against unauthorized access, loss, or misuse.
11. Changes to This Privacy Policy
This Privacy Policy may be updated from time to time.
Any changes will be published on this page with an updated effective date.
12. Contact
If you have any questions about this Privacy Policy or how your personal data is processed, please contact me at: