This English version is a translation provided for convenience. In case of any discrepancy, the Polish version prevails.

Privacy Policy

This privacy policy applies to the RMS LightStudio website. It explains what personal data the website's controller collects and processes, on what legal basis, how long the collected personal data are kept and what rights the users of the website have.

§ 1. Definitions

1. Controller - Michał Biliński Konsultant .NET (sole proprietorship), Osiedle Przyjaźń 116, 01-355 Warsaw, Poland, Tax ID (NIP): 5222831715, REGON: 147312613.
2. Personal Data - information about an identified or identifiable natural person, identified by one or more specific factors relating in particular to their physical or mental identity, including the IP address of a device, an online identifier and information collected through cookies or other similar technologies.
3. Contact Form - an electronically supplied service which consists in making available to the User a contact form with fields for entering information, including optional personal data, enabling correspondence with the Controller and sending a request for a commercial offer.
4. Privacy Policy - this privacy policy.
5. Terms - the terms of service of the Website.
6. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, as amended).
7. Website - the website available at https://rmslightstudio.com.
8. User - any person who uses the electronically supplied services provided through the Website, including the content of the Website or the Contact Form.
9. Terms defined in the plural also apply in the singular and vice versa.

§ 2. General provisions

1. The Controller can be contacted at contact@rmslightstudio.com or by phone at +48 453 102 666.
2. In connection with the User's use of the Website, the Controller collects, processes and stores personal data in accordance with the Privacy Policy.
3. Providing Personal Data is voluntary.
4. Users who provide the Controller with personal data of third parties are also bound by the applicable data protection laws.
5. In matters relating to the processing of your personal data by the Controller, you can use the Controller's contact details given at the beginning of the Privacy Policy (Introduction).
6. The Controller has not appointed a Data Protection Officer (DPO).

§ 3. Sources and scope of Personal Data

1. Personal Data are collected by the Controller or by recipients of Personal Data through:
   1. the Contact Form - scope of data:
      1. company (company name),
      2. first name and surname,
      3. e-mail address,
      4. phone number,
      5. town or city,
      6. type of venue,
      7. message content,
      8. selected plan and planned start date,
      9. IP address and the date and time of sending,
   2. direct contact with the Controller by e-mail, post or phone - scope of data:
      1. company (company name),
      2. first name and surname,
      3. e-mail address,
      4. phone number,
      5. other personal data provided that are necessary to handle the User's requests (e.g. complaints).
2. Providing Personal Data within the scope indicated in section 1 is voluntary. Personal Data collected within the scope indicated in section 1 are processed by the Controller only on the terms set out in the Privacy Policy.

§ 4. Purposes and legal bases of processing

1. Users' Personal Data are processed for the purpose of:
   1. providing electronically supplied services (in particular the Website and the Contact Form) - on the basis that the processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR),
   2. replying to correspondence, including messages sent via the Contact Form - on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR),
   3. handling Users' requests (including exercising their statutory rights) - on the basis that the processing is necessary for the performance of a contract or to take steps at the request of the data subject, or on the basis that it is necessary to comply with a legal obligation of the Controller (Article 6(1)(c) GDPR), or
   4. protecting the Website against abuse (IP address, timestamp of sending) and establishing and pursuing the Controller's claims or defending against Users' claims - on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR).

§ 5. Retention period of Personal Data

1. The period for which the Controller processes Personal Data depends on the type of service provided and the purpose of processing. As a rule, data are processed for the time necessary to achieve the purposes indicated in § 4 of the Privacy Policy or to fulfil legal obligations. After the processing period specified in the Privacy Policy for the relevant Personal Data has expired, they are irreversibly deleted or anonymised. The exception is Personal Data that the Controller needs to pursue or defend against claims - these are deleted after the limitation period has expired (3 years from the date the claim becomes due, with the period ending at the end of the calendar year - on the basis of the Controller's legitimate interest, Article 6(1)(f) GDPR).
2. In addition to the periods indicated in section 1, the Controller applies separate retention periods to the necessary scope of Personal Data from the following sources:
   1. the Contact Form and correspondence outside the Contact Form - 24 months;
   2. server access log - 30 days,
   3. security events of the form service - 7 days,
   4. addresses blocked for abuse - 1 day.

§ 6. Rights of data subjects

1. The User has the right to:
   1. request access to their Personal Data stored by the Controller and obtain a copy of them (Article 15 GDPR) - the User has the right to obtain the information contained in the Privacy Policy, including among other things the source and purposes of processing, the categories of data processed, the retention period, the recipients of Personal Data, as well as your rights under the GDPR, the right to object, the Controller's safeguards for Personal Data transferred outside the European Union and the technologies used by the Controller to collect and process Personal Data,
   2. request the Controller to rectify or correct their Personal Data (Article 16 GDPR) - where the User notices that the data are inaccurate or incomplete,
   3. request the Controller to erase their Personal Data (Article 17 GDPR) - in the cases set out in Article 17 of the Regulation, in particular where the personal data are no longer necessary for the purposes for which they were collected or an effective objection to the processing of personal data has been lodged,
   4. request the Controller to restrict the processing of their Personal Data (Article 18 GDPR) - where: the User contests the accuracy of their data; considers that the Controller should not process their data but at the same time does not want them erased; the Controller no longer needs the personal data, but the User needs them to pursue claims; the User has objected to the processing of their data and the Controller has to verify whether it should continue processing them,
   5. object to the processing of their Personal Data - in exercising this right, the User may object, on grounds relating to their particular situation, to the processing of their personal data based on the legitimate interests pursued by the Controller; despite the objection, the Controller may continue to process the personal data if it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims,
   6. withdraw consent to the processing of their Personal Data at any time - the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal,
   7. request that their Personal Data be transferred to another organisation,
   8. lodge a complaint about the processing of the User's Personal Data by the Controller with the President of the Personal Data Protection Office (UODO) - UODO contact details: https://uodo.gov.pl/p/kontakt.
2. The Controller will promptly consider the requests referred to in the preceding section concerning operations and actions on Personal Data.

§ 7. Recipients of Personal Data

1. Users' Personal Data may be disclosed to:
   1. entities processing Personal Data where the obligation to disclose them results from applicable law, including public authorities,
   2. entities processing Personal Data on behalf of or in accordance with the instructions of the Controller (including employees, associates and representatives, provided that they maintain confidentiality and are responsible for the Personal Data entrusted to them),
   3. providers of IT services, including hosting and cloud services, as well as financial and accounting services, in particular:
      • Website hosting: Hostinger - this provider makes available the server on which the Website runs. More information: https://www.hostinger.com/legal/privacy-policy;
      • E-mail: SEOHOST.pl - maintains the Controller's mailbox, which receives copies of messages sent via the Contact Form. More information: https://seohost.pl/polityka-prywatnosci.
2. The Controller has concluded appropriate data processing agreements with the service providers listed above.

§ 8. Transfers of Personal Data outside the European Economic Area

1. The Controller may disclose Personal Data to competent authorities or third parties who request such information on a specific and sufficient legal basis.
2. The Controller transfers Personal Data outside the European Economic Area, but only where this is necessary for all functions of the Website to work properly and provided that the recipients ensure an adequate level of protection, primarily through:
   1. being established in countries for which the European Commission has issued an adequacy decision regarding the protection of Personal Data,
   2. applying the standard contractual clauses adopted by the European Commission,
   3. applying binding corporate rules approved by the competent supervisory authority.
3. The server on which the Website runs is operated by Hostinger in the United Kingdom (referred to above). The United Kingdom is outside the European Economic Area, but the European Commission has found that it ensures an adequate level of personal data protection (Article 45 GDPR; the current decision is valid until 27 December 2031), so the transfer does not require additional safeguards.

§ 9. Security of Personal Data

1. The Controller carries out an ongoing and appropriate risk analysis to ensure that the Personal Data it processes are processed securely - above all, ensuring that only authorised persons have access to the data, and only to the extent necessary for the tasks they perform. The Controller ensures that all operations on Personal Data are recorded and performed only by authorised persons.
2. The Controller stresses that no method of transmitting data over the Internet or storing it electronically is completely secure. Therefore, the Controller does not guarantee absolute protection of data, including Personal Data, against unauthorised disclosure.
3. The Website is served exclusively over an encrypted connection (HTTPS). Enquiries are stored on a server with restricted access, in a file readable only by the service that receives them, and the form is protected against automated abuse. The public website runs as a service separate from the Controller's licensing systems.

§ 10. Cookies and similar technologies

1. The Controller does not use any cookies on the Website.
2. Cookies are small pieces of text that the Controller or other cookie providers send to the User's browser and that the browser sends back on subsequent visits to the Website or to third-party websites. These tools are used, among other things, to collect information about the User's device and visit in order to ensure security. More information is available at https://en.wikipedia.org/wiki/HTTP_cookie.

§ 11. Changes to the Privacy Policy

1. The Privacy Policy is reviewed regularly and, where necessary, updated in connection with the development of the Website or changes in the law.
2. The current version of the Privacy Policy was adopted and has been in force since 25 September 2026.

← Back to rmslightstudio.com · Terms of Service