Privacy policy

1. Data controller

The controller of your personal data is Yan Volianskyi, running a sole proprietorship under the business name Yan Volianskyi JanWolanski.com, ul. św. Antoniego 40/16, 50-073 Wrocław, Poland, NIP (tax identification number) 8971980011, REGON 545859329. On fotograf.nieruchomosci.pl I appear as Jan Wolański — Fotografia Architektury i Nieruchomości.

For any matters concerning personal data, write to janwolanski.com@gmail.com or call +48 883 597 798.

2. What data I process and why

The website does not require registration. Your data reaches me when you send a message through the contact form or contact me on your own initiative — by email or by phone. In the form you provide your name, email address, the type of service and the content of your message, and optionally your company name, phone number and preferred date. When you contact me by email or phone, this usually includes your name, email address, phone number, company name and the content of your message.

I process it in order to:

• reply to your message and conduct correspondence — on the basis of my legitimate interest (Art. 6(1)(f) GDPR);
• prepare an offer, and conclude and perform a contract — at your request (Art. 6(1)(b) GDPR);
• fulfil accounting and tax obligations (Art. 6(1)(c) GDPR);
• establish, pursue or defend claims (Art. 6(1)(f) GDPR).

Providing your data is voluntary, but without it I cannot reply. I do not make automated decisions about you and do not profile you.

Private client galleries. I deliver photographs to clients I have a contract with in a private gallery on the website (at fotograf.nieruchomosci.pl/galeria/…). The gallery contains the client's name, the title of the shoot, the photographs from the shoot and, where applicable, a message from me. I process this data in order to perform the contract and deliver the photographs (Art. 6(1)(b) GDPR).

• The photographs open only after entering a 6-digit PIN given to the client. I do not store the PIN in plain form — only its cryptographic hash.
• The photographs and gallery data are kept in closed Cloudflare R2 storage on servers in the European Union. They are not publicly accessible: each photograph opens through a temporary link valid for a few minutes, issued only after the PIN has been entered.
• The photographs can be downloaded for 30 days from the creation of the gallery and viewed for up to 90 days.
• On day 90 the photographs and the PIN are deleted automatically.
• I keep the record of the gallery (the client's name, the title of the shoot and the dates) for 3 years — the limitation period for claims (Art. 118 of the Polish Civil Code).

3. How long I keep data

Correspondence that did not lead to a commission — up to 12 months from the last message. Contract-related data — for the duration of the contract and then until the limitation period for claims expires. Accounting documents — for the period required by tax law (as a rule, 5 years from the end of the year in which the tax payment deadline fell).

4. Who I share data with

Only with the service providers I use to run my business:

• Vercel Inc. (USA) — website hosting, including the galleries, and statistics;
• Cloudflare, Inc. (USA) — R2 storage for gallery photographs and data, stored in the European Union;
• Upstash, Inc. (USA) — counter of PIN entry attempts (stores the IP address), server in Frankfurt;
• Plus Five Five, Inc. (USA), provider of the Resend service — sending messages from the contact form;
• Google Ireland Limited (Ireland) — email;
• GitHub, Inc. (USA) — storing the website's files;
• the accounting firm Finance Expert Sp. z o.o., which keeps my books.

5. Transfers outside the EEA

Vercel Inc., Cloudflare, Inc., Upstash, Inc., Plus Five Five, Inc. (Resend) and GitHub, Inc. are based in the United States, and Google Ireland Limited may also process data in the United States. Gallery photographs and data (Cloudflare R2) and the PIN attempt counter (Upstash) are stored on servers in the European Union. These transfers take place on the basis of the European Commission's decision on the EU-US Data Privacy Framework or standard contractual clauses approved by the Commission.

6. Your rights

You have the right to access your data, to have it rectified, erased, restricted or transferred, and the right to object to processing based on legitimate interest. Simply write to janwolanski.com@gmail.com. You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

7. Cookies and statistics

The website does not use cookies for tracking or advertising. It stores only technical cookies: NEXT_LOCALE, which remembers the language version you have chosen, and — in a private gallery, after the correct PIN has been entered — a cookie confirming access to that one gallery. The latter is valid for at most 7 days and never longer than the gallery itself.

To make the PIN harder to guess, I count entry attempts: after 5 attempts from one IP address within 15 minutes, further attempts from that address are temporarily blocked, and a single gallery accepts at most 30 attempts per hour. The counter with the IP address is deleted automatically after about 30 minutes. I measure visits with Vercel Web Analytics — the tool does not store cookies and does not identify individual people. It collects general data: the page visited, the referral source, the browser and device type, and the country. As the hosting provider, Vercel also processes IP addresses in order to deliver the website and protect it from attacks.

8. Changes to this policy

I update this policy whenever the way I process data changes. The current version is always available on this page.