Privacy policy
Personal data, service providers and your privacy choices. Updated 23 September 2026.
Who is responsible for your data
Maja Gogulska is responsible for personal data processed through this website. Contact: contact@majagogulska.com. This policy covers browsing event galleries, collections, correspondence and, when available, photo purchases and email notifications.
What we process and why
We process technical request data to deliver pages and keep the website secure, and contact details and message content to answer enquiries. These activities rely on our legitimate interests in operating the website, preventing abuse and handling correspondence (Article 6(1)(f) GDPR). Data needed to fulfil a requested service or an order is processed to perform a contract (Article 6(1)(b)); accounting records and legally required responses are processed to meet legal obligations (Article 6(1)(c)). Optional collection-history storage and requested gallery notifications rely on consent (Article 6(1)(a)).
Photographs of people
Event photographs may show identifiable people. Access to a gallery or purchase of a photograph does not give anyone unrestricted rights to another person’s image. To ask about publication, object to processing or request removal, send the photograph or event link to the contact address. We assess each request against the applicable data-protection and image-rights rules.
Cookies and browser storage
Essential storage remembers your privacy decision, language and cart. The MAJKA_LOCALE cookie keeps your language choice for up to one year. Cart photo and resolution identifiers and a checkout retry identifier are kept in this tab’s session storage. If you enable Remember collections in Cookie settings, My collections keeps up to 50 opened or created collection links, photo counts and creation dates in local storage until you remove them, withdraw that choice or clear browser data. Without that permission, history is kept only in the open page and is lost when you reload or close it. Search and filters are included in the URL, so sharing that address also shares those choices. You can clear browser storage at any time; doing so resets the corresponding preferences and history.
Your privacy choices
Remembering collections is optional and off by default. You can allow it, reject it or change your decision through Cookie settings in the footer. Rejecting it does not prevent you from using the galleries or cart. The c15t consent manager stores your decision under maja-consent on this device for up to 180 days. We do not load browser analytics scripts. Withdrawing consent stops further optional storage and removes saved collection history from this device; it does not make earlier consent-based processing unlawful.
Shared collections
A shared collection stores photo identifiers, selected resolutions and its creation date on the server. Anyone with the link can see the selection, so treat the link as shareable rather than private. Opening it also adds it to My collections for the open page; it is saved across visits only if you allow Remember collections. Removing a link from your browser history or withdrawing that permission does not delete the server copy. Collections have no automatic expiry at present; send us the link to request deletion.
When gallery notifications are available, we use the email address and event you select to send the requested availability notification, not to subscribe you to general marketing. Submitting the notification form signs you up for the selected event. You can withdraw it using the cancellation link in that email or by contacting us. When email delivery is enabled, Resend processes recipient addresses, message content and delivery information on our behalf. Order and service messages are separate from optional notifications and are sent when needed to fulfil your request or purchase.
Payments
When online checkout is available, Stripe processes payment details and transaction information. We receive the information needed to identify the order, confirm payment, provide the files and handle refunds or complaints. Payment-card details are entered into Stripe’s payment interface rather than stored by this website. Stripe may also process data for its own fraud-prevention, regulatory and payment-service purposes under its privacy policy. Payment and invoice data is required to complete the relevant purchase or meet accounting obligations.
Hosting, content and security
Cloudflare provides hosting, private file storage, database storage, image processing and bot protection. Sanity provides content management and public image delivery. Upstash Redis stores short-lived request counters identified by a keyed hash of the request address to enforce rate limits; we do not enable its rate-limit analytics. These providers process the technical information needed to serve and secure requests, including IP addresses, stored content and relevant browser signals. Security checks may restrict suspicious requests; contact us if a check prevents legitimate access. External Instagram and Threads links open services with their own privacy policies.
Recipients and international transfers
We share data with service providers only as needed for the functions described above, and with authorities where required by law. Providers may process data outside the European Economic Area. Any such transfer must use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses. Contact us for information about the safeguards relevant to your data. A provider acting as an independent controller is also responsible for its own processing.
How long information is kept
Browser storage and collections follow the periods described above. Correspondence is kept while the enquiry is being handled and, where necessary, until related claims expire. Once notification delivery is enabled, notification addresses are kept until the requested message is sent or consent is withdrawn, except for records needed to demonstrate compliance. Order records are retained for the applicable accounting and tax periods and, where needed, until related claims expire. Technical security records are retained only for the operational or incident-handling period needed for their purpose.
Your rights
Subject to the conditions in the GDPR, you can request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent. Providing optional information is voluntary; without an email address we cannot reply or send a requested notification, and without required order details we cannot fulfil a purchase. We do not use your data for decisions producing legal or similarly significant effects based solely on automated processing. You can complain to the President of the Polish Personal Data Protection Office (UODO), or another competent supervisory authority. To exercise your rights, write to contact@majagogulska.com.