Privacy policy
Controller and scope
The controller of personal data processed by jakubfischer.pl is Jakub Fischer, ul. Zabrzańska 7E, 41-907 Bytom, Poland, telephone +48 500 038 998. For privacy matters, write to hello@jakubfischer.pl.
This policy covers use of the portfolio, shop, contact and support channels, order delivery and optional analytics. It was last updated on 30 September 2026. No newsletter, unsolicited marketing or behavioural advertising is used.
Data, purposes and legal bases
When the website is used, limited technical request data may be processed, such as the network address, time, requested page, browser and device information. It is used to deliver and secure the website, prevent abuse and diagnose faults. The legal basis is the controller’s legitimate interest in operating a secure and reliable service under Article 6(1)(f) GDPR and, where a requested function is involved, performance of a contract or steps requested before entering one under Article 6(1)(b).
For an enquiry or complaint, the controller processes the name, reply email address, message, selected category and language, and an optional public order reference. A photography enquiry also includes a callback phone number and the supplied shoot details: car, session type, budget, date and optional notes. Providing data is voluntary; the photography form requires a phone number so the controller can call to discuss the shoot. You can also contact hello@jakubfischer.pl without using the form. The bases are Article 6(1)(b) GDPR for contractual or pre-contractual matters and Article 6(1)(f) for correspondence, abuse prevention and the establishment, exercise or defence of claims.
The data is not sold and is not used for unsolicited marketing or behavioural advertising. jakubfischer.pl does not make decisions producing legal or similarly significant effects solely by automated means.
Browser storage and analytics
Necessary browser storage supports functions requested by the visitor, including interface preferences, navigation continuity, the local cart, the saved privacy choice and secure access to the password-protected shop or an order. After a successful shop login, the server sets a necessary shop-access cookie. It contains a signed access token, not the entered password, is unavailable to page scripts, uses SameSite=Lax and expires after no more than seven days. It also receives the Secure attribute over HTTPS. These records do not contain payment-card data. Session records end with the session or after use; preferences and the cart remain until changed or site data is cleared.
If optional Google Analytics 4 is available, it is not loaded and no request is sent to Google before the visitor expressly accepts analytics. After consent under Article 6(1)(a) GDPR, it may measure the page path without its query string, language, product information, a pseudonymous public transaction reference and limited shop events. The application does not intentionally send a name, email address, payment data or private Gumroad identifier. Advertising features, Google Signals and User-ID remain disabled.
Analytics can be rejected or withdrawn at any time in Privacy settings as easily as it can be accepted. Withdrawal stops future analytics and removes analytics records accessible to the website; it does not affect earlier lawful processing. Analytics cookies set by this site expire within 90 days and are not extended on later visits. The GA4 property retains user-level and event-level data for two months without resetting that period on new activity.
Orders and Gumroad checkout
Order data comes from the buyer and from Gumroad checkout, order notifications and provider responses. jakubfischer.pl may process the selected product and language, public order reference, Gumroad transaction identifiers, amount, currency and payment, refund and fulfilment statuses, as well as evidence of the accepted terms and digital-delivery consent. Payment-card data is entered directly in Gumroad and is not received or stored by jakubfischer.pl.
The data is required to complete and deliver an order, provide support, comply with legal obligations, prevent abuse, reconcile transactions and establish or defend claims. The bases are Article 6(1)(b), (c) and (f) GDPR. Without the required checkout and delivery data, the purchase and delivery cannot be completed. Optional analytics is never required for an order.
Recipients and international transfers
Data is disclosed only where needed for a particular function. Recipients may include Gumroad, Inc. for checkout, payment, tax and transaction support; Supabase for database services; Vercel for website hosting; Resend for transactional email; Hostinger for the hello@jakubfischer.pl mailbox; and Google only for analytics accepted by the visitor. Professional advisers or public authorities may receive data when required by law or necessary for a specific claim.
Gumroad is an independent seller and controller for checkout, payment and its own compliance purposes; its notice is at https://gumroad.com/privacy. Other providers act in the role applicable to the relevant processing. Where personal data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, where required. Information about the applicable safeguard can be requested from the controller.
Retention
Ordinary photography enquiries submitted through the form, including the phone number and associated email delivery records, are stored in the private website database for 365 days from submission and then automatically deleted. This database period does not automatically delete copies in the mailbox or provider systems. Other enquiry and support data is kept for the time needed to handle the matter and then only for as long as required by an applicable legal duty or the establishment, exercise or defence of claims. Order, consent and transaction records are kept for the performance of the contract and for the periods required by consumer, tax, accounting and limitation rules. When no purpose or legal basis remains, data is deleted, anonymised or restricted.
Necessary browser records remain for the periods described above or until the visitor changes a preference or clears site data. Analytics retention is described in the analytics section. Independent providers, including Gumroad, retain data under their own legal obligations and privacy notices.
Your rights and contact
Depending on the legal basis and circumstances, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw consent at any time. Rights are not absolute where the law requires or permits continued processing. You may also lodge a complaint with the President of the Polish Personal Data Protection Office; current instructions are at https://uodo.gov.pl/pl/526.
Send a request to hello@jakubfischer.pl. A response is provided without undue delay and normally within one month. Additional information may be requested only where reasonably necessary to verify the requester’s identity and protect another person’s data.