Privacy policy

1. Data controller

The controller of your personal data is [COMPANY DETAILS — TO BE COMPLETED].

For anything related to your personal data, write to gnx.vision@icloud.com.

2. Quote form

The quote form collects your first name, email address, the service you are interested in and a description of your project, and — if you provide it — an approximate budget.

The data is used only to reply to your enquiry and prepare a quote. Providing it is voluntary, but the enquiry cannot be sent without the required fields.

Legal basis — proposed: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or the controller’s legitimate interest in replying to your enquiry (Art. 6(1)(f) GDPR). [TO BE CONFIRMED BY A LAWYER — the form has a required consent checkbox; decide whether the basis is consent (point (a)) or point (b)/(f), and adjust the checkbox wording]

Retention — proposed: until the conversation about the job ends and for up to 12 months afterwards. [TO BE CONFIRMED]

Submissions are not stored on the site. The site’s server checks the fields and emails them to the controller through Resend. Resend keeps copies and logs of sent messages for the period described in its own privacy policy.

3. Spam protection

The quote page — and only that page — uses Cloudflare Turnstile, a tool that tells people apart from spam bots. The quote page loads the Turnstile script from Cloudflare servers, which see your IP address and technical browser data. When the form is sent, the site’s server passes the sender’s IP address to Cloudflare to check the verification result.

4. Hosting

The site and its server run on Cloudflare infrastructure. Like any server, Cloudflare records IP addresses and request details in technical logs in order to deliver the site and protect it from attacks.

5. Site content

Texts, photos and project descriptions are stored in Sanity. The site fetches them when it is built and serves its own copies, so your browser does not contact Sanity and no visitor data reaches it.

6. Video

Videos are delivered by Bunny (BunnyWay d.o.o., Slovenia). Pages with videos load them from Bunny servers, which see the visitor’s IP address.

The video player on the home page is provided by Bunny. It does not set cookies; it stores the selected picture quality in your browser and sends viewing statistics (such as playback time) to Bunny. [TO BE CONFIRMED BY A LAWYER — whether player statistics require consent]

7. Instagram

Instagram posts are fetched by the site’s server through the Meta API, and the server keeps copies of the thumbnails, so simply viewing the posts does not connect your browser to Meta servers.

The exception: hovering over a reel loads the video from Instagram servers (Meta Platforms), which then see the visitor’s IP address. Clicking a post or the profile link takes you to Instagram, where Meta’s privacy policy applies.

8. Shop

Digital packs are sold through Payhip (an external sales platform). The buy button takes you to Payhip, where ordering, payment and download take place.

Payhip processes buyers’ data as a separate controller, under its own privacy policy. [TO BE CONFIRMED] The gnx.vision site never sees payment details.

9. Statistics

The site uses Cloudflare Web Analytics. The statistics script loads from Cloudflare servers, sets no cookies and does not identify individuals — it only shows aggregate visit counts, such as which pages are viewed most.

10. Cookies

The site does not use cookies for tracking or advertising. Turnstile on the quote page may store technical data in your browser that is needed to protect the form. [TO BE CONFIRMED]

11. Transfers outside the EEA

Some providers (Cloudflare, Resend, Sanity, Meta, Payhip) may process data outside the European Economic Area. [LEGAL BASIS TO BE CONFIRMED BY A LAWYER]

12. Your rights

You have the right to access your data, have it corrected or erased, restrict its processing, object to processing and receive it in a portable format.

[IF THE BASIS IS CONSENT] You can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise these rights, write to gnx.vision@icloud.com.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).