Order 5 photos and get 1 free. Take advantage of the offer for your next projectOrder now

Privacy Policy

Last updated: 6 October 2026

This policy explains what data we process on marszalstudio.pl, why, who we share it with and what rights you have. We apply the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) and the Polish Electronic Communications Law.

1. Data controller

The controller of your personal data is MARSZAL Mateusz Lis, ul. Konstancińska 2 (2nd floor), 02-942 Warsaw, Poland, tax ID (NIP) 5632364503, owner of the marszalstudio brand. For any matter concerning personal data, write to kontakt@marszalstudio.pl or call +48 786 966 333.

2. What data we process and why

Enquiries and quotes. When you write to us or call us, we process the data you provide (e.g. name, company name, email address, phone number, message content) to reply and prepare a quote. Legal basis: Art. 6(1)(b) GDPR (steps taken before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence).
Fulfilling orders. Data needed to carry out the photo session and settle payment, including invoicing details. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and accounting obligations).
Establishing and defending legal claims. Legal basis: Art. 6(1)(f) GDPR.
Visit statistics. Described in section 5. Tools that use cookies run only with your consent (Art. 6(1)(a) GDPR).
Website security. Traffic to the website passes through the Cloudflare network, which processes IP addresses and technical request data to protect the site from attacks and make it faster. Legal basis: Art. 6(1)(f) GDPR.

Providing data is voluntary, but without it we cannot reply to your message or fulfil an order. We do not make decisions based solely on automated processing, including profiling, that would have legal effects on you.

3. Who we share data with

We do not sell data. We share it only with parties that help us run the website and the business, to the extent necessary for their services:

Hetzner Online GmbH (Germany) - the server that hosts the website;
Cloudflare, Inc. - content delivery network and protection against attacks;
Google Ireland Limited - email (Google Workspace) and, with your consent, Google Analytics;
Microsoft Ireland Operations Limited - with your consent, Microsoft Clarity;
providers of accounting and legal services - to the extent needed for settlements;
public authorities, where the law requires it.

4. Transfers outside the European Economic Area

Google, Microsoft and Cloudflare may also process data in the USA. Such transfers rely on the European Commission's decision on the EU-US Data Privacy Framework, under which these companies are certified, or on standard contractual clauses approved by the European Commission.

5. Visit statistics and cookies

a) marszalstudio visit counter - no cookies. On every page view the page sends to our server: the page address, language version, screen type (phone, tablet, computer), the domain of the site you came from, campaign parameters (utm) and the fact that the page was scrolled, a certain time passed, a phone number, email address, order button or link to another site was clicked, a video was played or a choice was made in the consent banner. The counter stores nothing on your device and does not record your IP address, browser identifier or any personal identifier, so the data cannot be linked to an individual. That is why it runs without consent. The data is not shared with anyone.

b) Google Analytics 4 (Google Ireland Limited) - only with your consent to statistics cookies. It shows us where visitors come from and which pages they use. Cookies: _ga and _ga_VWVTZW1Z2C (up to 2 years; browsers may shorten this). Google Analytics 4 does not store IP addresses. We keep event data in Google Analytics for 2 months. More: Google Privacy Policy.

c) Microsoft Clarity (Microsoft Ireland Operations Limited) - only with your consent to statistics cookies. It shows, as session recordings and click maps, how visitors use the website (cursor movement, scrolling, clicks), so we can fix places where people get lost. Text typed into form fields is masked. Cookies: _clck (1 year) and _clsk (1 day); Microsoft may also set cookies on the clarity.ms domain. Microsoft keeps recordings for 30 days and aggregated reports, such as click maps, for up to 13 months. More: Microsoft Privacy Statement.

d) Necessary cookies - set without consent, because without them the website cannot remember your settings:

cmplz_banner-status, cmplz_consented_services, cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_policy_id - your choice in the consent banner (365 days);
wp-wpml_current_language - the selected language version (until you close the browser);
ms_bez_pomiaru - switches statistics off on our team's devices and in our studio network, so we do not count our own visits (400 days).

e) Changing your choice. You can change or withdraw your consent at any time: (the same button is in the footer of every page). Withdrawing consent does not affect the lawfulness of processing before the withdrawal. You can also delete or block cookies in your browser settings; blocking necessary cookies may make the website harder to use.

6. How long we keep data

correspondence - until the matter is closed, and then until any claims become time-barred;
order and invoice data - for the period required by tax law (5 years from the end of the year in which the tax obligation arose);
data in statistics tools - as described in section 5;
data processed on the basis of consent - until the consent is withdrawn.

7. Your rights

You have the right to access your data, to have it corrected, erased or restricted, to data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the data protection authority in your country. To exercise your rights, write to kontakt@marszalstudio.pl.