Privacy & Cookie Policy

1. Controller

The controller of personal data processed in connection with stittgallery.com (the "Site") is Joanna Stitt, a sole trader trading as Stitt Gallery, Sierotki Marysi 19, 60-193 Poznań, Poland, NIP: 7791984515, REGON: 544282589 (the "Controller"). Contact for data protection matters: joanna@stittgallery.com, tel. +48 501 40 90 20.

This Policy explains what data we process, for what purposes and on what legal basis, for how long, who receives it, and what rights you have under Regulation (EU) 2016/679 (GDPR).

2. What data, why, and on what legal basis

• Enquiries and correspondence (email, phone, WhatsApp, conversations at the gallery) — name, contact details, message content, information about the piece you are interested in. Purpose: answering your enquiry, preparing an offer, arranging a viewing. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) (our legitimate interest in handling correspondence). Retention: until the correspondence ends, then for the limitation period of possible claims.
• Orders and sales — identification and address data, delivery and invoicing details, payment confirmation. Card and Google Pay payments are processed by Stripe; we do not see or store full card details. Purpose: concluding and performing the sales contract, delivery, handling complaints and withdrawals, accounting. Legal basis: Art. 6(1)(b) GDPR, and for accounting and tax obligations Art. 6(1)(c). Retention: until the contract is performed and claims are settled; accounting and tax records for 5 years from the end of the tax year concerned.
• Security and operation of the Site — technical connection data (IP address, date and time, page address, browser type) in the hosting provider's server logs. Purpose: keeping the Site running and secure, detecting abuse. Legal basis: Art. 6(1)(f) GDPR. Retention: according to the hosting provider's policy.
• Site statistics (Google Analytics) — only with your consent: online identifiers (cookies), device and browser information, pages visited, clicks on email, WhatsApp and phone links. Purpose: understanding how the Site is used and improving it. Legal basis: Art. 6(1)(a) GDPR and Art. 173 of the Polish Telecommunications Law. Retention: per our Google Analytics retention setting (no longer than 14 months).
• Advertising and measurement (Google Ads) — only with your consent: advertising identifiers, information about an ad click and the action taken (enquiry, payment started). Purpose: measuring ad performance and showing our pieces (including remarketing). Legal basis: Art. 6(1)(a) GDPR and Art. 173 of the Polish Telecommunications Law. Retention: until you withdraw consent or the cookies expire (e.g. _gcl_au — 90 days).

Providing data is voluntary, but necessary to handle enquiries and orders. You can give, refuse or withdraw consent to statistics and advertising at any time; this does not affect your use of the Site.

3. Recipients and transfers outside the EEA

Data may be entrusted or disclosed to providers whose services we use: the Site's hosting provider (Netlify, Inc.), our email forwarding provider (ImprovMX), our payment provider (Stripe Payments Europe, Ltd.), the WhatsApp provider (Meta Platforms Ireland Ltd.) when you use it yourself, Google (Google Ireland Limited / Google LLC) for statistics and advertising — only after you consent, couriers and transport companies as needed for delivery, and providers of accounting, legal and IT services to us. We do not sell data.

Some of these providers are established or process data in the United States. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) for participating companies, or on standard contractual clauses.

4. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal — click "Cookie settings" in the footer of the Site or write to the Controller's email address.

You also have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (or the authority competent for your place of habitual residence in another EU country).

5. Cookies and similar technologies

• Essential / functional (no consent needed): stittgallery-theme (your chosen colour theme) and sg_consent_v1 (your consent choice, kept for up to 6 months) — stored in your browser's localStorage.
• Statistics (with consent): Google Analytics cookies, in particular _ga and _ga_* (up to 2 years).
• Advertising (with consent): Google Ads cookies, in particular _gcl_au (up to 90 days) and other Google cookies used for conversion measurement and remarketing.

Until you consent, no Google Analytics or Google Ads script is loaded. You can change your choice at any time via "Cookie settings" in the footer. You can also delete or block cookies in your browser settings.

6. Profiling

The Controller does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Advertising shown with your consent (e.g. remarketing) may involve profiling carried out by Google as described in Google's privacy policy.

7. Changes to this Policy

We may update this Policy, for example if the law or the services we use change. The current version is always available on this page. The Polish version is binding; versions in other languages are provided for information.