Privacy policy
Privacy on delfinakopcinska.pl and delfinakopcinska.com
Updated: 20 October 2026.
Controller and contact
The data controller is VeryBRAND. Paweł Kopciński, ul. Senna 1, 70-893 Szczecin, Poland, tax ID (NIP) 9552113563. For personal data matters, contact buy@delfinakopcinska.com or write to the postal address above.
Messages and painting enquiries
Forms collect your name, email address, subject and message. In the commission form, you may also select up to 3 paintings as inspiration. Providing data is voluntary, but your name, a valid email address and a message are needed to handle your enquiry. Please do not submit sensitive information.
We use this information to respond, prepare arrangements or an offer, and handle follow-up correspondence. For steps you request before entering a contract, the legal basis is Article 6(1)(b) GDPR. For other messages, it is our legitimate interest in handling correspondence under Article 6(1)(f) GDPR. The form does not subscribe you to a newsletter.
We retain correspondence for the time needed to resolve the matter. Where it documents a contract, accounting obligation or dispute, relevant data is retained for the applicable statutory record-keeping period or limitation period for claims.
Website operation and security
The server may record technical information such as IP address, request time, page address, browser information and errors. This supports page delivery, abuse prevention and troubleshooting under Article 6(1)(f) GDPR. The form rate limiter stores a last-submission timestamp associated with a hash of the IP address to reduce spam. Logs support current diagnostics; records related to a specific incident may be retained until it is investigated and resolved.
Analytics only with your consent
Google Analytics and Hotjar load only after you select “Allow analytics”. Refusing does not block the website or its forms. You can withdraw consent using “Privacy settings” in the footer. Withdrawal does not affect the lawfulness of earlier processing. Optional analytics relies on consent under Article 6(1)(a) GDPR.
Google Analytics (Google Ireland Limited) measures visits, page views, traffic sources and interactions. After the server confirms submission, we send an enquiry event containing the form type and website language, without your name, email address or message. This measurement does not confirm delivery to an email inbox.
Google Analytics event data is retained for 2 months and user data for 14 months; new activity may reset user data retention. These settings do not apply in the same way to aggregated statistical reports.
Hotjar (Hotjar Limited, Malta) helps analyse clicks, scrolling and browsing through heatmaps and session recordings. Form fields are masked. We do not send message contents or a customer identifier to this tool. Hotjar generally retains recording and heatmap data for up to 365 days.
Cookies and browser storage
Your choice is saved in localStorage as dk-analytics-consent-v2 for 180 days. Consent is currently stored separately for each domain, so switching language may show the question again. Google Analytics cross-domain measurement may connect visits when you have consented on both domains.
After consent, Google Analytics uses _ga and _ga_… cookies to recognise a browser and session, while Hotjar uses _hj… cookies and local storage to measure visits. Google Analytics cookies set by this website expire after up to 180 days. Hotjar cookies may last for a session or up to 365 days, depending on their purpose. You can also delete them in your browser settings.
In “Privacy settings”, you can additionally exclude your own visits on this browser. The dk-exclude-this-browser setting remains until you enable measurement again or clear website storage, and applies separately to each domain.
Recipients and external services
Hosting, email and technical support providers may process data on our behalf; the website is hosted on a SeoHost server. Google and Hotjar receive analytics data after consent. Instagram and TikTok links lead to external services; their feeds are not embedded on this website.
Analytics providers may use infrastructure outside the European Economic Area, including in the United States. Such transfers require an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses. Provider policies and safeguards are linked below.
Your rights
You may request access, rectification, erasure or restriction of processing. Where the GDPR provides, you may request portability and object to processing based on legitimate interests. You can withdraw consent and lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl). Contact the controller to exercise a right.
We do not use website data to make solely automated decisions that produce legal or similarly significant effects on you.