Privacy Policy

Privacy Policy

Last updated: 12 October 2026

1. Who we are

This website is available at https://vanessawz.art and presents photography, artwork and related creative services.

The data controller responsible for processing personal data through this website is:

  • Name: vanessawz.art

  • Business name, if applicable:  vanessawz.art

  • Email: tess002@wp.pl

In this policy, “we” and “us” refer to the data controller identified above.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable national laws, including German or Polish law where relevant to our activities.

2. What personal data we collect and why

The information we process depends on how you use this website and which features are enabled.

2.1 Website visits and technical data

When you visit this website, technical information may be processed automatically by our hosting provider and website infrastructure, including:

  • IP address;

  • date and time of access;

  • requested page or file;

  • browser type and version;

  • operating system;

  • referring URL, where provided;

  • technical and security log information.

This information is used to deliver the website, maintain its functionality, troubleshoot errors and protect against spam, unauthorised access and other security threats.

Legal basis: Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests in operating and securing the website, or another applicable legal basis where required.

Retention: Technical logs are retained for the period necessary for their operational, security and troubleshooting purposes, subject to the hosting provider’s configuration and applicable legal requirements.

2.2 Contact forms and email enquiries

If you contact us by email or through a contact form, we may process your name, email address, message, attachments and related correspondence.

We use this information to respond to enquiries, discuss potential photography or artistic projects, provide requested information and manage any resulting professional relationship.

Legal basis:

  • Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract or to perform a contract;

  • Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests in handling other correspondence and enquiries;

  • Article 6(1)(c) GDPR, where processing is required by law.

We retain correspondence only for as long as necessary to handle the enquiry and any resulting project, dispute or legal obligation.

2.3 Comments

If comments are enabled and you leave a comment, WordPress may collect the information entered in the comment form, your IP address and your browser user-agent string to help detect spam and abusive activity.

If the Gravatar service is enabled, an anonymised string generated from your email address may be sent to Automattic to check whether you use Gravatar. If your comment is approved, your profile image may be publicly visible alongside your comment.

Gravatar’s privacy policy is available at https://automattic.com/privacy/.

Legal basis: Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests in moderating comments, preventing spam and maintaining website security.

Comments and associated metadata are retained while the comment remains published or for as long as reasonably necessary for moderation, security or legal purposes. They are not automatically retained indefinitely.

If comments or Gravatar are not enabled, this section does not apply to those features.

2.4 Images and media

Images displayed on this website may contain personal data where individuals can be identified.

We use photographs and artwork to present our creative work, portfolio and services. The legal basis for publishing identifiable individuals depends on the circumstances, the purpose of publication and the applicable privacy and image-rights laws.

Where required, we obtain appropriate consent, permission or another valid legal basis before publishing identifiable individuals. Being photographed does not automatically mean that a person has agreed to every subsequent publication or use of the image.

If you believe an image on this website infringes your privacy or image rights, contact us at [Contact email address] and provide the relevant page URL and sufficient information to identify the image. We will review the request in accordance with applicable law.

If you upload images to this website, avoid including embedded location information (such as GPS coordinates in EXIF metadata) unless you intend to make that information available. Visitors may be able to download images and inspect their metadata.

2.5 User accounts

If registration is enabled, WordPress may process the information you provide when creating an account and information associated with your user profile.

Users may be able to view or edit certain profile information. Website administrators may access information necessary to administer and secure the website.

Account information is retained while the account is active and for any additional period necessary for security, legal compliance or dispute resolution.

If user registration is disabled, this section does not apply.

3. Cookies and similar technologies

Cookies are small files stored on your device. This website may use cookies or similar technologies depending on the features enabled.

3.1 Essential cookies

WordPress may use cookies necessary for functions you request or for essential website administration. Depending on the configuration, these may include cookies used for:

  • authentication and login sessions;

  • remembering comment-form details, if enabled;

  • maintaining administrative sessions;

  • security and consent-management functions.

The cookies used and their duration depend on the website’s configuration.

3.2 Optional cookies and tracking

Analytics, advertising, social-media embeds and other optional technologies may collect information about your use of the website or interactions with third-party content.

Where consent is required by applicable law, optional cookies and similar technologies will not be activated until valid consent has been obtained. You may withdraw or change your consent through the website’s cookie settings, where available.

In Germany, Section 25 of the Telecommunications-Digital Services Data Protection Act (TDDDG) regulates the storage of information on, or access to information stored on, users’ devices. Consent is generally required unless a statutory exception applies. <Cite refs={[“turn194066search0”]}/>

Applicable Polish electronic communications and data-protection rules must also be observed where relevant.

3.3 Managing cookies

You can manage your preferences through the cookie settings provided on this website, if available. You can also configure your browser to block or delete cookies.

Blocking essential cookies may affect certain website functions.

The actual cookies, providers, purposes and durations should be disclosed in the cookie notice or consent tool where required.

4. Embedded content from other websites

Pages on this website may include embedded content, such as videos, images, social-media posts or other external material.

Embedded content may behave as though you had visited the external website directly. The provider may receive your IP address and other technical information, set cookies, collect data and monitor your interaction with the content.

These third-party services operate under their own privacy policies. Where prior consent is legally required for embedded content or associated tracking, the content will not be activated until valid consent has been obtained.

The actual third-party providers used on this website must be identified in this policy or the associated cookie information.

5. Analytics

If analytics or audience-measurement services are used, they may process technical information and information about how visitors use the website.

The analytics provider, data collected, purposes, legal basis, retention period and any international transfers must be identified according to the service actually installed.

Where consent is required, analytics will not be activated before valid consent is obtained.

If no analytics service is used, no analytics processing takes place through this website.

6. Who we share your data with

Depending on the services enabled, personal data may be disclosed to:

  • our website hosting and technical infrastructure providers;

  • website maintenance, security and spam-prevention providers;

  • email and contact-form service providers;

  • analytics providers, if enabled;

  • third-party platforms whose content you choose to load or interact with;

  • professional advisers or public authorities where disclosure is necessary or legally required.

We do not sell personal data.

Where a service provider processes personal data on our behalf, we put in place the contractual safeguards required by the GDPR.

The actual recipients depend on the providers and services used on this website.

7. International data transfers

Some service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will comply with Chapter V of the GDPR. Depending on the destination, this may involve an applicable European Commission adequacy decision or appropriate safeguards, such as Standard Contractual Clauses.

Information about relevant providers and applicable safeguards will be made available where required.

8. How long we retain personal data

We retain personal data only for as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law.

Retention depends on the type of information:

  • Contact enquiries: for the time necessary to respond and manage any resulting project or dispute.

  • Contractual and accounting records: for the periods required by applicable law.

  • Comments: while published or for as long as necessary for moderation, security or legal purposes.

  • User accounts: while active and for any necessary subsequent security or legal period.

  • Technical logs: according to the hosting and security configuration and the time necessary to investigate incidents.

  • Consent records: for the period necessary to demonstrate and manage consent and comply with applicable obligations.

When personal data is no longer needed, it will be deleted or anonymised where appropriate, subject to legal retention requirements.

9. How we protect your data

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

Depending on the website configuration, these measures may include access controls, software updates, secure connections, backups, security monitoring and restrictions on administrator access.

No method of internet transmission or electronic storage can be guaranteed to be completely secure.

10. Personal data breaches

If a personal data breach occurs, we will assess the incident and take appropriate steps to contain it, investigate its effects and prevent recurrence.

Where required by the GDPR, we will notify the competent supervisory authority within the applicable deadline and inform affected individuals if the breach is likely to result in a high risk to their rights and freedoms.

11. Your rights under the GDPR

Subject to the conditions and exceptions provided by law, you may have the right to:

  • request access to your personal data;

  • request correction of inaccurate or incomplete data;

  • request erasure of your personal data;

  • request restriction of processing;

  • receive certain personal data in a portable format;

  • object to processing based on legitimate interests, on grounds relating to your particular situation;

  • withdraw consent at any time where processing is based on consent;

  • not be subject to certain decisions based solely on automated processing, including profiling, where the GDPR provides this right.

These rights are not absolute and may be subject to legal conditions or exceptions. For example, certain information may need to be retained to comply with legal obligations or establish, exercise or defend legal claims.

To exercise your rights, contact [Contact email address].

We may request information reasonably necessary to verify your identity. We will generally respond within one month of receiving your request. Where permitted by law, this period may be extended by up to two further months due to the complexity or number of requests. We will inform you of any extension within the initial month.

12. Right to lodge a complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

Depending on the circumstances, the competent authority may include:

  • Germany: the data protection authority of the relevant German federal state.

  • Poland: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO). Official website: https://uodo.gov.pl/.

You may also be able to lodge a complaint with the supervisory authority in the EU Member State where you habitually reside, work or where the alleged infringement occurred, in accordance with the GDPR.

13. Third-party sources

We generally obtain personal data directly from you or automatically through your use of the website.

If a third-party service provides personal data to us, the information and purposes depend on the service concerned. Where personal data has not been obtained directly from you, we will provide the information required by Article 14 GDPR where applicable.

14. Automated decision-making and profiling

We do not make decisions about website visitors based solely on automated processing, including profiling, that produce legal or similarly significant effects.

If this changes, we will update this policy to explain the processing, its legal basis and the applicable safeguards.

Third-party providers may independently use automated systems under their own privacy policies when you interact with their services.

15. Whether you must provide personal data

You are generally not required to provide personal data simply to view the public portfolio.

If you contact us, certain information, such as a reply email address, may be necessary for us to respond. If you do not provide it, we may be unable to respond to your enquiry.

Technical information may be processed automatically when you access the website, as described above.

16. Changes to this policy

We may update this policy to reflect changes to the website, the services we use or applicable law.

The latest version will be published on this page with the updated date.

17. Contact

For privacy questions or requests concerning your personal data, contact:

Data controller: vanessawz.art
Email: tess002@wp.pl

Please include enough information for us to understand your request and identify the relevant data, without sending unnecessary sensitive information.