Gdańsk · Gdynia · SopotWedding & event decorations+48 732 071 998kontakt@wielkidzien.pl
Wielki Dzień
Decoration studio · Gdańsk, Gdynia, Sopot & Pomerania

Personal Data Privacy Policy (GDPR)

Effective from 14 October 2026.

§1

Identity of the data controller

  1. The controller of personal data provided when using the Website at www.wielkidzien.pl and in connection with the provision of services is Magdalena Raba, conducting business under the name RABA Magdalena Raba, ul. Konstantego Bergiela 4/10, 80-180 Gdańsk, tax identification number (NIP): 5833557278, who runs the “Wielki Dzień” decoration studio. The Controller’s email address is kontakt@wielkidzien.pl, and telephone number: +48 732 071 998.
  2. The Controller has not appointed a data protection officer. For all matters relating to personal data, you may contact the Controller at kontakt@wielkidzien.pl.
  3. The rules on cookies and similar technologies are described in the Cookie Policy, available at www.wielkidzien.pl/en/polityka-cookies.
  4. This Privacy Policy covers the processing of data relating to Website Users, people using the Controller’s services, and people who contact the Controller through Website forms, email, telephone, wedding portals or social media.
  5. Data are processed in accordance with applicable law: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”); the Polish Act of 10 May 2018 on the Protection of Personal Data; and the Polish Act of 12 July 2024 — Electronic Communications Law.

§2

Definitions

The following definitions apply in this Privacy Policy:

  1. Personal data controller (Controller) — the entity that determines the purposes and means of processing personal data, namely Magdalena Raba, conducting business under the name RABA Magdalena Raba, identified in §1.
  2. Personal data — any information relating to an identified or identifiable natural person, including their identification, address and contact details.
  3. Website — the website available at www.wielkidzien.pl and its subpages, through which the User may browse its content, contact the Controller and use the tools provided, such as the decoration calculator or wedding planner.
  4. User — a natural person whose data are processed, who uses the Website or the Controller’s services, including a person who contacts the Controller.

§3

Purposes and legal bases of data processing

The Controller processes Users’ personal data for the following purposes:

  1. Responding to enquiries submitted through a Website form (including the decoration calculator form), email, telephone, a wedding portal or social media; preparing a quotation and offer; and agreeing on decoration details, including through a details form shared via a personal link and an offer shared via a password-protected personal link — under Article 6(1)(b) GDPR, as processing is necessary to take steps at the data subject’s request before entering into a contract. Where the enquiry does not concern an order, the basis is Article 6(1)(f) GDPR: the Controller’s legitimate interest in handling correspondence.
  2. Entering into and performing a decoration contract, including agreeing on the date, location and scope of decorations, transport, installation and dismantling — under Article 6(1)(b) GDPR, as processing is necessary to enter into and perform a contract.
  3. Documenting the services provided, including issuing a bill or invoice, and keeping accounting records — under Article 6(1)(c) GDPR, to comply with the Controller’s legal obligations arising in particular from the Polish Act of 29 August 1997 — Tax Ordinance.
  4. Sending newsletters and other commercial information electronically — under Article 6(1)(a) GDPR in conjunction with Article 398(1) of the Polish Electronic Communications Law, based on the data subject’s consent. Details are available on the Newsletter and your data page.
  5. Conducting recruitment in which the data subject participates — under Article 6(1)(b) GDPR, as processing is necessary to take steps at that person’s request before entering into a contract; for an employment contract, this covers the data specified in Article 22¹ §1 of the Polish Act of 26 June 1974 — Labour Code. Other data supplied voluntarily, for example in a CV, are processed under Article 6(1)(a) GDPR (in conjunction with Article 22¹a of the Labour Code for an employment contract), based on consent expressed by submitting them, which may be withdrawn at any time. Applications should not contain health data or other special categories of personal data. The Controller does not run analytics or session recordings on recruitment pages.
  6. Ensuring the Website’s security and proper operation, including server logs and error reporting, and producing aggregate visitor statistics that do not use cookies (choosing “Essential only” in the cookie consent banner also disables these statistics) — under Article 6(1)(f) GDPR: the Controller’s legitimate interest in keeping the Website secure and improving it.
  7. Analysing use of the Website and recording sessions — solely with the User’s consent (Article 6(1)(a) GDPR), on the terms described in the Cookie Policy.
  8. Establishing, pursuing or defending legal claims — under Article 6(1)(f) GDPR: the Controller’s legitimate interest.

Arrangements from the details form and offer, and comments about them, are stored in the order management system. The team receives notifications of important events, such as an offer being opened or a new comment, through Slack. If comments on an offer are dictated, the User’s browser converts speech into text; some browsers, such as Chrome, send the recording to their provider for this purpose.

Calls to +48 732 071 998 are forwarded by the operator Twilio to the team’s telephone. Calls are not recorded. If a call is missed, the team receives a Slack notification containing the telephone number so that they can call back.

When responding to some messages, the Controller uses Anthropic’s Claude language model to prepare a draft reply. A person reads every draft, edits it if necessary and sends it. The Controller does not make decisions about Users based solely on automated processing, including profiling, that produce legal effects concerning them or similarly significantly affect them (Article 22 GDPR).

The details form is not intended for sharing guests’ health information. If a dessert table needs to accommodate allergies, for example, a description without personal data is sufficient, such as “nut-free desserts”.

Providing data is voluntary, but necessary to receive a reply (name and email address), prepare and perform a contract, issue a bill or invoice, and participate in recruitment (first and last name and email address). Not providing the required data prevents a reply, entering into or performing a contract, or participation in recruitment.

§4

Data retention periods

Users’ personal data are processed for as long as necessary for the purpose for which they were collected:

  1. Data from enquiries that did not result in a contract — for the duration of discussions, but no longer than the event date specified in the enquiry or 12 months after the last contact, whichever comes first.
  2. Data relating to entering into and performing a contract — for the duration of its performance and then until the limitation periods for claims expire.
  3. Data in accounting documents — until the limitation period for the tax liability expires (Article 86 §1 in conjunction with Article 70 §1 of the Tax Ordinance), generally for five years from the end of the calendar year in which the tax payment deadline fell. Structured invoices submitted to the Polish National e-Invoicing System (KSeF) are stored in that system for ten years from the end of the year in which they were issued.
  4. Recruitment data — until recruitment ends; unsolicited applications — for six months after submission. After that, the data are deleted. Applications are not used in later recruitment processes.
  5. Data processed on the basis of consent — until consent is withdrawn, but no longer than 12 months for PostHog analytics data and 90 days for session recordings. Newsletter data — until you unsubscribe.
  6. Data processed on the basis of the Controller’s legitimate interest — until an effective objection is made or that interest ceases to apply. Error reports are retained for no longer than 90 days, and server logs for a short period specified by the hosting provider.

§5

Recipients of data

  1. Users’ personal data may be entrusted to entities that process them on the Controller’s behalf, only to the extent necessary to provide their services, in particular for:
    • Website and database hosting — Vercel and Neon (servers in Frankfurt);
    • Email hosting and sending messages from forms — MXRoute and Resend;
    • Sending the newsletter — Brevo;
    • Operating the telephone number and team notifications — Twilio and Slack;
    • Preparing draft replies — Anthropic (the Claude language model);
    • Maintaining the server in Poland that runs statistics and error reporting tools — SkillHost; and routing traffic to some services on that server — Cloudflare;
    • Accounting and carrying out decoration services, such as transport.
  2. Data may be disclosed to public authorities where required by law.
  3. The Controller does not sell personal data.

§6

Processing data outside the European Economic Area

  1. Because the Controller uses IT tools and systems whose providers are established or have technical infrastructure outside the European Economic Area (Vercel, Neon, Resend, MXRoute, Slack, Twilio, Anthropic and Cloudflare), personal data may be transferred to the United States of America.
  2. Transfers are based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU–US Data Privacy Framework, for providers included on the list maintained by the US Department of Commerce. In other cases, they are based on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Article 46(2)(c) GDPR).
  3. A copy of the standard contractual clauses or information about a particular provider’s safeguards can be obtained by writing to kontakt@wielkidzien.pl.

§7

Social media, wedding portals and joint controllership

  1. The Controller maintains “Wielki Dzień” studio profiles on Facebook and Instagram. For the data of people visiting these profiles, including data used for profile statistics, the Controller is a joint controller with Meta Platforms Ireland Limited. The Controller uses messages sent through Messenger or Instagram to respond and prepare an offer (§3, point 1).
  2. For other processing, Meta Platforms Ireland Limited is the controller of these platforms’ users’ data, and processing is governed by their terms and privacy policies, including facebook.com/privacy/policy. Users’ data may be transferred to the United States of America under Commission Implementing Decision (EU) 2023/1795 (EU–US Data Privacy Framework) in relation to Meta Platforms, Inc.
  3. If a User contacts the Controller through a wedding portal, such as Wesele z klasą, that portal processes their data as a separate controller under its own privacy policy. The Controller uses the correspondence to respond and prepare an offer.

§8

Data subjects’ rights

  1. The data subject has the following rights:
    • To access their data and receive a copy;
    • To have their data rectified (corrected);
    • To have their data erased, unless the law requires the Controller to retain them;
    • To restrict processing;
    • To data portability, where processing is based on a contract or consent and is carried out by automated means;
    • To withdraw consent at any time where consent is the basis for processing; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal;
    • To lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl), or the supervisory authority in the EU country where they live, work or where the infringement occurred, if they believe that processing their data infringes the GDPR.
  2. Right to object. The data subject may object at any time to processing based on the Controller’s legitimate interest (Article 6(1)(f) GDPR) on grounds relating to their particular situation. They may object to processing for direct marketing without giving reasons (Article 21 GDPR).
  3. To exercise these rights, contact the Controller at kontakt@wielkidzien.pl. The Controller responds without undue delay and no later than one month after receiving the request.

§9

Final provisions

The Privacy Policy may be amended, in particular where required by the technical solutions used or changes in the law. The current version is always available on this page, together with its effective date.