Effective date: 01.10.2025

1. Data Controller

The data controller is Krzysztof Koch, an artist and author of photographic publications sold through the website www.krzysztofkoch.com.
Contact: info@krzysztofkoch.com

2. Scope of Data Processing

Personal data are processed for the following purposes:

  • order fulfilment and shipment,

  • payment processing,

  • communication with customers,

  • website analytics and performance (cookies).

Data may be shared only with service providers essential to complete an order (courier services, payment processors, Squarespace Inc. as the website host).

3. Legal Basis for Processing

Data are processed in accordance with Article 6(1)(b), (c) and (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR):

  • (b) processing necessary for the performance of a contract,

  • (c) processing necessary for compliance with a legal obligation,

  • (f) processing necessary for the purposes of the legitimate interests pursued by the controller (communication, record-keeping, copyright protection).

4. Cookies and Analytics

This site uses cookies provided by Squarespace.
Details of cookies used can be found in the official Squarespace document:
👉 The cookies Squarespace uses

Cookies are used for:

  • proper technical functioning of the website,

  • visitor analytics (Squarespace Analytics),

  • saving user preferences (e.g. cart contents).

Users can manage or disable cookies through their browser settings.

5. Data Retention

Personal data are stored for the period necessary to:

  • fulfil and settle the transaction (including tax obligations – up to 5 years), or

  • until the data subject withdraws consent, if processing is based on consent.

6. Rights of the Data Subject

Under Articles 15–22 GDPR, every data subject has the right to:

  • access their data (Art. 15),

  • rectify inaccurate data (Art. 16),

  • erase data (“right to be forgotten”, Art. 17),

  • restrict processing (Art. 18),

  • data portability (Art. 20),

  • object to processing (Art. 21),

  • lodge a complaint with a supervisory authority (Art. 77 GDPR; in Poland – the President of the Personal Data Protection Office).

7. Changes to this Policy

The controller reserves the right to update this Privacy Policy in line with future legal or technical developments.

© 2025 Krzysztof Koch – All rights reserved.