Privacy & cookies

Information we use

We use the information needed to run this website and handle enquiries:

• Website visits: the server receives your IP address, connection time, requested page and browser information. We use this to deliver the portfolio, fix errors and prevent abuse — our legitimate interests under GDPR Article 6(1)(f).
• Email: we use the sender’s address, message and attachments to reply and discuss a project. General correspondence and contact with company representatives rely on legitimate interests, Article 6(1)(f). If you enquire about a contract in your own capacity, steps you request before entering it rely on Article 6(1)(b).
• Claims: we may retain necessary information to establish, exercise or defend legal claims, under Article 6(1)(f).

Providing information in an email is voluntary, not a statutory requirement. Without details of your enquiry and a reply contact, we may be unable to help. We do not profile visitors or make decisions with legal or similarly significant effects solely by automated means.

How long we keep it

Enquiries that do not lead to work are kept until the discussion closes and for up to 12 months afterwards. Information needed for contractual matters or claims is kept until the applicable limitation period expires, or until a dispute is finally concluded and settled.

We manually review and remove security records and working backups after the relevant issue is resolved, or work on that version is complete and its restoration has been checked, unless needed for an ongoing security matter or dispute. Provider-managed logs and backups also follow retention periods for their services.

Cookies and browser storage

We do not use visitor analytics or advertising trackers. Videos, images and fonts are served by this website.

When you use the pause/play button, we remember your choice for the tab session (inframe-motion in sessionStorage). It does not identify you or reach our server. It lasts for the tab session, which your browser may restore after a restart. When updating, we remove the older preference from localStorage.

WordPress cookies support administrator sign-in and dashboard settings; ordinary portfolio viewing does not need them. Their lifetime depends on the session and “Remember me”; dashboard settings may last up to a year. See the WordPress cookie documentation.

Current storage supports transmission or a function you request, so we rely on the exemption in Article 399(3) of the Polish Electronic Communications Law. Optional tools requiring consent will only run after consent, with a way to withdraw it. You can clear or block site data in your browser settings; your playback preference may then no longer be remembered.

Providers and data transfers

OVH sp. z o.o. (OVHcloud) provides hosting and email. It processes connection data and correspondence for these services under a data processing agreement. Its data protection notice explains the provider’s own purposes.

Earlier correspondence may also be held in Outlook.com (Microsoft Corporation / Microsoft Ireland Operations Limited).

These providers’ subprocessors and legally authorised authorities may also receive data. Microsoft services may involve processing outside the EEA, including in the USA. Its linked statement describes safeguards, including standard contractual clauses. You can email us for information and a copy of the applicable safeguards.

Your rights

Subject to GDPR conditions, you can request access and a copy, correction, erasure or restriction of processing. Portability applies to data you supplied that is processed automatically under a contract or consent. Erasure does not cover information still needed on another valid legal basis.

Email contact@inframe-studio.eu. We respond without undue delay, normally within one month. In GDPR cases, this may be extended by two months; we will tell you why within the first month. Requests are generally free. If necessary, we may ask for information to verify your identity.

You can complain to the President of the Polish Personal Data Protection Office or another competent supervisory authority. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Controller and contact

The data controller is the individual operating the InFrame portfolio: