Protection of your
personal data.

1. Data Controller

The data controller for personal data collected through www.fantasmatic.eu is FANTASMATIC SP. Z O.O., with its registered office at Al. Solidarności 113 lok. 21A, 00-140 Warszawa, Poland, entered in the National Court Register (KRS) under number 0000876396, NIP (tax ID) 5252848100, REGON 387878100, e-mail: foto@fantasmatic.pl, phone: +48 605 590 450.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).

2. Data Protection Contact

For any questions regarding the processing of your personal data, please contact the Controller:

• E-mail: foto@fantasmatic.pl
• Phone: +48 605 590 450
• Postal address: FANTASMATIC SP. Z O.O., Al. Solidarności 113 lok. 21A, 00-140 Warszawa, Poland

3. Categories of Data Collected

Depending on how you use the website, we may process the following data:

• Contact form — name, e-mail address, phone number, company name, message content.
• Bookings and orders — name, e-mail address, phone number, selected package and session date, and, if you need a VAT invoice, company name, tax ID (NIP) and address.
• Payments — payment status, amount and transaction ID. Card, BLIK or Przelewy24 details are provided directly to the payment operator (Stripe) — the Controller has no access to them.
• Session materials — your image captured in photos or recordings made as part of the ordered service.
• Technical data — IP address, browser type, operating system, visit time, pages visited (collected automatically by the server and analytics tools).
• Cookies — information stored locally in your browser (see section 8 for details).

4. Purpose and Legal Basis for Processing

Personal data is processed for the following purposes:

• Handling enquiries — responding to messages sent via the contact form or e-mail (legal basis: Art. 6(1)(b) GDPR — performance of a contract or pre-contractual steps).
• Concluding and performing the contract — handling bookings and orders, accepting payments, carrying out the session, delivering and archiving materials, contacting you about the service (legal basis: Art. 6(1)(b) GDPR).
• Accounting and tax — issuing invoices and retaining accounting records (legal basis: Art. 6(1)(c) GDPR).
• Complaints and claims — handling complaints, establishing, pursuing or defending claims (legal basis: Art. 6(1)(f) GDPR — legitimate interest of the Controller).
• Direct marketing — sending information about Fantasmatic's offer, where you have given your consent (legal basis: Art. 6(1)(a) GDPR — consent).
• Traffic analysis and website optimisation — usage statistics (legal basis: Art. 6(1)(f) GDPR — legitimate interest of the Controller).
• Legal obligations — retaining data required by law (legal basis: Art. 6(1)(c) GDPR).

5. Data Retention

• Contact form data — for as long as necessary to handle your enquiry, no longer than 3 years from the last contact.
• Booking and order data — for the duration of the contract and then until the limitation period for related claims expires.
• Final session materials — for 3 months from delivery to the Client (as set out in the Terms of Service), unless the Client agrees to longer storage.
• Marketing data — until consent is withdrawn or for a maximum of 3 years from the date consent was given.
• Data required by law — for the periods prescribed by applicable law (e.g. 5 years from the end of the calendar year for accounting records).
• Analytics data (cookies) — in accordance with the settings of individual tools, no longer than 26 months.

6. Website Hosting

www.fantasmatic.eu is hosted on the infrastructure of Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). Netlify applies advanced physical and technical security measures, including:

• TLS/SSL encryption (Let's Encrypt certificate),
• DDoS protection and malicious traffic filtering,
• redundant infrastructure with automatic failover,
• regular backups of website data,
• a CDN (Content Delivery Network) with servers located in Europe, among other regions.

Data transfers to the USA are carried out in accordance with appropriate GDPR safeguards, including Standard Contractual Clauses (SCC). Full details are available at: www.netlify.com/privacy.

7. Recipients of Personal Data

Personal data may be shared with the following categories of recipients:

• Netlify, Inc. — hosting, contact form and booking data storage provider.
• Stripe Payments Europe, Ltd. (Ireland) — electronic payment operator (card, BLIK, Przelewy24). Stripe also processes payment data as an independent controller; data may be transferred to Stripe group companies in the USA under appropriate safeguards. Details: stripe.com/privacy.
• The Controller’s bank (mBank S.A.) — for payments by bank transfer.
• E-mail service provider — for sending booking confirmations and correspondence.
• Google LLC — analytics (Google Analytics) and marketing tools (Google Ads, remarketing). Data may be transferred to the USA under appropriate safeguards.
• Meta Platforms, Inc. — marketing tools (Facebook Pixel), if active. Data may be transferred to the USA under appropriate safeguards.
• Providers of legal, accounting or IT services engaged by the Controller, strictly to the extent necessary.

The Controller does not sell users' personal data to third parties.

8. Cookies

www.fantasmatic.eu uses cookies — small text files stored on your device.

Types of cookies:

• Essential — necessary for the basic functioning of the website; no consent required.
• Analytical — collect anonymous data about how the website is used (Google Analytics); require your consent.
• Marketing — enable retargeted advertising (Google Ads, Facebook Pixel); require your consent.

Managing cookies:

You may change your cookie settings in your browser or withdraw previously given consent at any time. Disabling analytical and marketing cookies does not affect the functioning of the website.

Cookie management instructions for popular browsers:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

9. Your Rights

Under GDPR, every person whose data we process has the following rights:

• Right of access — to obtain information about the data processed and a copy of that data.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion of your data ("right to be forgotten") where there is no legal basis for continued processing.
• Right to restriction of processing — to limit operations on your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on the Controller's legitimate interests.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact the Controller at foto@fantasmatic.pl. We will respond within 30 days.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland, the relevant authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also contact the supervisory authority in your country of residence.

11. Data Security

The Controller applies appropriate technical and organisational measures to protect data, including:

• TLS/SSL encryption of data transmission,
• access to data restricted to authorised persons only,
• regular updates of website software,
• periodic data backups.

12. Changes to This Policy

The Controller reserves the right to amend this Privacy Policy. Users will be informed of any material changes by the publication of an updated version at www.fantasmatic.eu/en/privacy-policy. The date of the last update is shown at the top of this document.