Privacy and personal data
Privacy policy
This page explains in plain language what data may be processed when you use the website or contact the atelier, and what rights you have.
Effective from: 19 August 2026
1. Data controller
The controller of your personal data is PHU “KUT” OLHA KRYVENKO, a sole proprietorship, Polish tax ID (NIP) 5993308874, address: al. Konstytucji 3 Maja 102, 66-400 Gorzów Wielkopolski, Poland.
For privacy matters or to exercise your rights, contact olhakut626@gmail.com. The controller has not appointed a data protection officer.
2. Data we receive and its sources
The scope of data depends on how you use the website or contact the atelier:
- technical website data — IP address, request date and time, page address, browser and device type, operating system, and information needed for security and correct display;
- analytics data — after consent, including online identifiers, visited pages, events and visit source, approximate city and general device data;
- contact data and correspondence — for example your name, phone number, email address, messaging profile and message content;
- enquiry or order-related data — information about the item, requested service and order status and, if you provide them on your own initiative, garment photos, measurements or a photo of a person wearing clothes;
We receive data directly from you or automatically from your device while you use the website. The website has no contact form and no user accounts.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Delivering the website, maintaining security, diagnosing errors and preventing abuse | the controller’s legitimate interests — Article 6(1)(f) GDPR |
| Answering a question about a service or order status, agreeing and performing a service | pre-contractual steps and performance of a contract — Article 6(1)(b) GDPR |
| Establishing, pursuing or defending legal claims | the controller’s legitimate interests — Article 6(1)(f) GDPR |
| Google Analytics and the embedded Google map | consent to storing or accessing information on a device — Articles 399–400 of the Polish Electronic Communications Law; subsequent processing of personal data based on voluntary consent — Article 6(1)(a) GDPR |
Consent to Analytics and Maps is entirely voluntary. Refusal does not restrict access to the website or the ability to contact the atelier. Data provided when contacting the atelier are also voluntary, but the controller may be unable to answer, agree or perform a service without the information needed for that purpose. Where a contract is concluded, the data needed to agree and perform it are a contractual requirement.
4. Hosting, security and technical data
The website is delivered and protected using Cloudflare services. When handling requests, Cloudflare may process data such as IP addresses, traffic-routing data, system configuration information, and information about traffic to and from the website. This is needed to deliver content, defend against attacks and diagnose problems.
Cloudflare acts as a processor for the controller to the relevant extent and may act as a separate controller for processing identified in its own notice. Details are available in the Cloudflare Data Processing Addendum and Cloudflare Privacy Policy.
5. Cookies, consent and Google Analytics
Google Analytics 4 (measurement ID G-5SKZC7X68E) starts only after you consent to analytics. Without consent, analytics_storage remains denied, the Analytics tag is not loaded, and advertising and ad personalisation remain disabled.
Analytics helps us understand which pages are visited, where users arrive from and which actions they take. General device data and approximate city-level location collection are enabled. Google Signals, User-ID and user-provided data collection are disabled. Data sharing for “Google products & services” is disabled. The modelling and business-insights setting allows Google to use measurement data in aggregated form. Enabled technical-support and business-recommendation settings may allow authorised Google personnel to access account data to the extent needed to provide those features.
Your choice is stored in the browser’s local storage for 6 months. This record is used only to remember the requested settings and not for analytics. The website will then ask again. You can change or withdraw consent earlier using “Cookie settings” in the footer. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
| Technology | Provider | Purpose | Period |
|---|---|---|---|
olhaKutAnalyticsConsent — local storage | Olha Kut | remembering Analytics and Maps settings | 6 months |
siteTheme — local storage | Olha Kut | remembering the light or dark theme | until you change the setting or delete site data |
_ga | Google Analytics | distinguishing pseudonymous users | normally up to 2 years |
_ga_<identifier> | Google Analytics | maintaining session state | normally up to 2 years |
| Google Maps cookies or local storage | map operation, security and settings | under Google’s settings and rules |
Google Analytics cookies may be stored only after consent to Analytics, and Google Maps technologies after separate consent to the map. Refusing is as easy as accepting.
Detailed GA4 user and event data are retained for 14 months, without resetting that period on new activity. Standard reports based on aggregated data may remain available for longer. You can read how Google uses information from sites that use its services in Google’s information for partner sites.
6. Google Maps
The interactive Google map is blocked by default. It loads only after you consent to Google Maps. The browser then connects directly to Google, which may receive data such as your IP address, device information and the page visited, and may read or write its own cookies.
If you choose an external link to Google Maps — for example directions, the business profile or reviews — you will visit Google’s service under its terms. See the Google Privacy Policy for details.
7. Phone, email and messaging services
You may contact the atelier by phone, email, WhatsApp, Telegram or Viber. Providing data is voluntary, but we may be unable to answer or perform a service without the information needed for that purpose.
A message may concern, in particular, whether the atelier provides a particular service, details of an order, or its status or readiness. The controller does not require photos or measurements. If you attach a garment photo, measurements or a photo of a person wearing clothes on your own initiative, the material will be used only to handle your enquiry or order. Do not send identity documents, medical data or other unnecessary information.
olhakut626@gmail.com is a dedicated work mailbox hosted by Gmail, so Google processes the correspondence as the provider of that service under its Privacy Policy when you contact the atelier by email. If you choose a messaging service, you also use an external provider that processes data under its own rules. See the policies for WhatsApp, Telegram and Viber.
The Facebook link leads only to the atelier’s public page on Meta’s service. The atelier does not use that service as a correspondence channel. After following the external link, you use Facebook under the terms described in Meta’s Privacy Policy.
8. Who may receive data
Data may be disclosed only to the extent needed for the relevant purpose:
- hosting, security and website infrastructure providers, in particular Cloudflare;
- Google, as the Gmail provider when you contact the atelier by email and, after the relevant consent, as the provider of Google Analytics or Google Maps;
- messaging providers if you choose to contact us through their service;
- the person technically maintaining the website and holding authorised GA4 access, acting on the controller’s documented instructions;
- professional advisers, only where necessary to establish, pursue or defend legal claims;
- public authorities where disclosure is required by law.
The controller does not sell personal data.
9. Transfers outside the EEA
Google, Cloudflare, Meta and messaging providers operate globally, so data may be processed outside the European Economic Area in connection with their services. The transfer basis and safeguards depend on the provider’s role, the processing location and the current service terms. Where a provider acts as a processor, the controller uses the contractual safeguards available for that relationship.
Google states that, depending on the recipient and country, it uses adequacy decisions, including the EU–US Data Privacy Framework for certified US organisations, or standard contractual clauses. Cloudflare describes its standard contractual clauses and other safeguards in the Cloudflare Data Processing Addendum. Current information is also published by Google, while WhatsApp, Telegram and Viber provide it in the notices linked in section 7.
To request information about safeguards for a particular transfer or an available copy of the relevant terms, email olhakut626@gmail.com.
10. How long we keep data
| Data type | Period or criterion |
|---|---|
| Analytics and Maps choice | 6 months in browser storage unless you remove site data earlier |
| Google Analytics cookies | normally up to 2 years unless you withdraw consent or remove site data earlier |
| Detailed GA4 user and event data | 14 months; the period is not reset by new activity |
| Enquiries that do not lead to an order | generally up to 12 months after the last contact; old conversations are reviewed at least annually |
| Correspondence and materials for an active order | during performance and then for as long as needed to handle a complaint or establish, pursue or defend legal claims |
| Technical and security data | for the period needed to deliver and protect the website, in line with provider settings and rules |
A period may be extended where data are needed to establish, pursue or defend claims, investigate an incident or comply with a legal duty. When the purpose ends, data are deleted or anonymised.
11. Your rights
Depending on the legal basis and circumstances, you may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interests.
Where processing is based on consent, you may withdraw it at any time. To exercise your rights, email olhakut626@gmail.com. For security, the controller may request information needed to confirm your identity.
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office. Practical information is available in UODO’s citizen section.
12. Marketing and automated decisions
The atelier does not operate a newsletter or send marketing messages. Website and correspondence data are not used to make solely automated decisions about you that produce legal or similarly significant effects. The website does not personalise advertising.
13. Changes to this policy
This policy may be updated if the website, the services used or legal requirements change. The current version and effective date are always published on this page.