KIKOPrivacy policy
This policy describes what personal data we process in connection with the Kiko Studio website, for what purpose, and on what legal basis, in accordance with the GDPR (EU 2016/679).
Data controller
The data controller is Marta Kikosicka, trading as Kiko Studio, al. Ks. Kardynała Stefana Wyszyńskiego 49 lok. 41, 94-042 Łódź, Poland, NIP (Tax ID): 7272902401, REGON: 545178032. Contact for data protection matters: martak1998.mk@gmail.com.
What data we process and why
Contact form: full name, phone number, email address, and message content — to respond to your inquiry (Art. 6(1)(b) GDPR — steps taken prior to entering into a contract).
Client account: email address and password (stored hashed, never in plain text) — to create and operate the client panel account (Art. 6(1)(b) GDPR).
Orders: the customer's details and shipping information, entered manually by the administrator based on a placed order — to fulfill the service and let the client view their order status (Art. 6(1)(b) GDPR).
Who we share data with
We use trusted service providers who process data on our behalf under data processing agreements: Brevo (transactional email delivery), Vercel (application hosting and file storage), and Neon (database). Data is never sold or shared with other parties for marketing purposes.
Data retention
Contact form data is kept until the inquiry has been answered and the correspondence is closed. Client account and order data is kept for the duration of the working relationship and for the period required by applicable law (e.g. tax and accounting regulations).
Cookies
The site uses only an essential session cookie required for logging into the client and admin panels. We do not use analytics, statistics, or marketing cookies.
Your rights
You have the right to access, rectify, erase, and restrict the processing of your data, as well as the right to data portability and to object to processing. You may withdraw consent at any time where processing is based on it. You also have the right to lodge a complaint with the Polish data protection authority (UODO).
Providing your data is voluntary
Providing your data is voluntary, but necessary to respond to your inquiry, create a client account, or fulfill an order.
No profiling
Personal data is not used for automated decision-making or profiling.