Privacy and cookies policy

Controller and contact

Mira Martyna Feter operates Mira Atelier as a sole trader registered in Poland’s CEIDG business register. Tax ID (NIP): 5542889248; REGON: 543351561. Address: ul. Ignacego Prądzyńskiego 48 lok. LU. 48, 61-523 Poznań, Poland. Contact: mira@mira-atelier.com, +48 725 230 868.

Mira Martyna Feter is the controller of personal data processed in connection with https://mira-atelier.com. For privacy matters and rights requests, contact mira@mira-atelier.com or the business address above.

Data we process

For orders, we process your name, e-mail, any telephone number you provide, billing and delivery addresses, company and tax details for invoices, and order, value, payment, delivery, return and complaint information. Workshops also involve participant names, reservations, passes and attendance confirmations. We do not require participants’ dates of birth.

Newsletter records contain the e-mail address, language, subscription status and evidence of consent: time, terms version, IP address and browser information. Photo submissions contain the file and its metadata, the submitter’s name and e-mail, and declarations about the licence, people shown, guardian authority and any social-media publication.

Correspondence contains the information you include in your message. Website use involves technical data such as the IP address, browser information, requested page and session. Orders also record accepted document versions and evidence of acceptance. We receive data from you; a purchaser may provide a workshop participant’s details, and payment status comes from the payment provider.

Purposes and legal grounds

Entering into and performing a contract, taking steps at your request before a contract, and handling orders, payment, delivery, bookings and passes: Article 6(1)(b) GDPR. Keeping legally required records, including tax and accounting records, and fulfilling consumer protection obligations: Article 6(1)(c) GDPR.

Website security, fraud prevention, correspondence not related to entering into a contract, evidence of consent and acceptance, and the establishment, exercise or defence of claims: Article 6(1)(f) GDPR. The legitimate interests are operating the studio and website securely, responding to enquiries and protecting the parties’ rights.

Newsletters and optional consent to image or social-media publication: Article 6(1)(a) GDPR. Receiving and moderating photographs under the accepted licence rules: Article 6(1)(b) GDPR; this does not replace any required permission from a person shown. Consent may be withdrawn without affecting the lawfulness of earlier processing.

Information marked as required is necessary for an order or the selected service; without it we cannot provide that service. Other information and marketing consent are optional. We do not make decisions with legal effects solely by automated means or use profiling for such decisions.

Recipients and external services

We use OVH hosting and Proton Mail, provided by Proton AG in Switzerland. These providers process data needed to store and operate the website and deliver messages. Necessary data may also be received by delivery, accounting, technical and legal service providers and authorised public bodies, depending on the order and legal obligation.

If you choose online payment, Autopay S.A. receives the data needed for the transaction, such as your e-mail, order identifier, amount and currency. You enter card details with the payment provider. Mira Atelier does not store card numbers or security codes.

Maps use OpenStreetMap and the Nominatim address lookup service. On a page containing a map, its elements may load automatically. The provider then receives technical information including your IP address and browser details; location queries concern the studio or workshop address. Order data are not sent for this purpose. Displaying maps serves our legitimate interest in explaining where to visit. See the OpenStreetMap Foundation policy: https://osmfoundation.org/wiki/Privacy_Policy.

Directions, social-media and external video links open separate services. Once you activate them, the relevant provider processes data under its own rules. Merely displaying our link neither subscribes you to the newsletter nor gives marketing consent.

Google Analytics 4 and the OpenAI integration are not currently active on the website. We do not send customer data to OpenAI. Optional analytics require prior consent; refusing them does not prevent purchases.

Processing outside the European Economic Area

Proton Mail involves a provider in Switzerland, and OpenStreetMap maps involve the OpenStreetMap Foundation in the United Kingdom. The European Commission recognises an adequate level of data protection in both countries; transfers covered by these decisions rely on Article 45 GDPR.

OpenStreetMap states that map tiles are delivered through a global server network, so the location serving a particular request depends on that network. Its privacy policy explains the provider’s arrangements. Contact us for information about applicable safeguards or how to obtain a copy.

Retention

Completed, cancelled and expired orders are subject to a 6-year retention period. Anonymisation takes account of closure and later payment, refund, shipping or attendance activity. Records are kept for the periods required by tax and accounting law; data needed for claims are kept until the relevant limitation periods or proceedings end.

Active newsletter data are used until you unsubscribe. Afterwards, we retain the opt-out status and necessary evidence of consent or withdrawal to respect your choice and protect against claims. This does not mean continued marketing. A footer newsletter request awaiting confirmation does not start newsletter delivery.

Photos awaiting moderation remain private until reviewed. Rejected files are removed 30 days after rejection. Approved images are published under the licence granted; a removal request stops publication immediately and removes the file from the active library within 24 hours. Necessary evidence of consent, a licence or a submission may remain for claims without further publication of the image.

Correspondence and technical logs are retained as needed to handle the matter, maintain security and resolve potential claims. The website does not apply one automatic deletion deadline to every log and message. Continued retention depends on these purposes and obligations, not indefinite marketing use.

Backups allow recovery after a failure. Rotation retains up to 14 daily, 8 weekly and 5 pre-deployment copies; subsequent copies replace older ones of each kind. Deleted data may remain in a protected backup until replacement and are not used from it for routine operations or publication.

Cookies and browser storage

Essential cookies maintain the session, protect forms and remember the cart. The session cookie name depends on the deployment: mira_prod_session on the main website and mira_staging_session in the testing environment. The session and XSRF-TOKEN have a 120-minute lifetime, renewed during use. XSRF-TOKEN protects against unauthorised form submissions. mira_cart keeps the cart for 7 days.

mira-consent in localStorage records your consent choice and settings version; it has no fixed expiry and remains until storage is cleared or the choice is changed. mira-catalog-revision in localStorage allows the catalogue to refresh after an offer changes and also has no fixed expiry. These entries are not advertising profiles.

sessionStorage entries mira-ssr-catalog:v1:* and mira-listing:v1:* preserve listing and filter state; mira-map:* caches map location results. They disappear when the browser tab’s session ends; cached listings are reused for no more than one hour. “Remember me” applies to administrator login: its optional remember_web_* cookie can last up to 400 days.

You can change consent using the website’s cookie settings and clear cookies, localStorage and sessionStorage in your browser. Blocking essential cookies may prevent the cart, forms or login from working. Optional analytics are activated only after consent; Google Analytics is not currently active.

Your rights

Subject to the GDPR, you can access and obtain a copy of your data, rectify them, request erasure or restriction, and receive portable data processed automatically under consent or a contract. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

You may object, on grounds relating to your situation, to processing based on legitimate interests. You may object to direct marketing at any time. Send requests to mira@mira-atelier.com. We may ask for identity confirmation where necessary to protect your data.

You may complain to Poland’s President of the Personal Data Protection Office (https://uodo.gov.pl/) or another competent supervisory authority. Some rights have statutory limits, for example where records remain necessary for a legal obligation or legal claims.