Privacy Policy
Last updated: September 9, 2026
This Privacy Policy explains how Júlia Štefková – Milk and Silk Studio, a sole proprietorship (“jednoosobowa działalność gospodarcza” / JDG) registered in Poland (“we”, “us”, “our”), collects, uses, and protects personal data of visitors to www.milkandsilk.studio (the “Website”).
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Polish law.
1. Data Controller
The data controller responsible for your personal data is:
- Júlia Štefková – Milk and Silk Studio
- Júlia Štefková
- Kazimierza Morawskiego 5/127, 30-102, Krakow, Poland
- NIP: 6762721132
- REGON: 544891644
- Email: campaigns@milkandsilk.studio
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.
2. What Personal Data We Collect
Depending on how you interact with the Website, we may collect:
| Source | Data collected |
|---|---|
| Contact form | Name, email address, and any information you choose to include in your message |
| Newsletter subscription | Email address, subscription date, and (if provided) first name |
| Website analytics (Google Analytics) | IP address (truncated/anonymized where possible), device and browser type, pages visited, time on site, referral source, approximate location (country/city level) |
| Email marketing platform (Brevo) | Email address, engagement data (opens, clicks), subscription/unsubscription status |
We do not operate any e-commerce functionality, and no user accounts, payments, or purchases can be made on the Website.
3. Purposes and Legal Basis for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to inquiries submitted via the contact form | Art. 6(1)(b) — pre-contractual steps taken at your request, and/or Art. 6(1)(f) — our legitimate interest in responding to business inquiries |
| Sending the newsletter | Art. 6(1)(a) — your consent, given at the time of subscription |
| Website traffic analysis (Google Analytics) | Art. 6(1)(a) — your consent, given via the cookie consent banner (see our Cookie Policy) |
| Managing our mailing list via Brevo | Art. 6(1)(a) — your consent |
| Complying with legal obligations (e.g. accounting, tax) | Art. 6(1)(c) — legal obligation |
4. Recipients of Personal Data
We use the following third-party service providers (“processors”) to operate the Website. These providers only process personal data on our documented instructions, under data processing agreements (DPAs):
– Google Ireland Limited — Google Analytics (website traffic analysis) and Google Search Console (search performance monitoring; typically does not process personal data of visitors, only aggregated search data)
– Brevo (Sendinblue SAS), a company established in France — email marketing platform used to manage the newsletter and, where applicable, contact form notifications
– Websupport s.r.o. — website hosting
We do not sell personal data to third parties, and we do not share personal data for third-party advertising purposes.
5. International Data Transfers
Some of our service providers may transfer personal data outside the European Economic Area (EEA):
– Google self-certifies under the EU–US Data Privacy Framework (DPF) and/or relies on Standard Contractual Clauses (SCCs) for transfers to the United States.
– Brevo is established in the EU (France) and primarily processes data within the EEA; where sub-processors outside the EEA are used, Brevo relies on SCCs.
You can request further information about the safeguards applied to these transfers by contacting us.
6. Data Retention
We retain personal data only for as long as necessary for the purposes described above:
– Contact form inquiries: up to 20 months after the last contact, unless a longer period is required for legal or accounting reasons, or a business relationship develops.
– Newsletter data: for as long as you remain subscribed, and deleted or anonymized within 12 months of unsubscribing.
– Analytics data: retained by Google Analytics according to the retention settings we configure (14 months), after which it is automatically deleted or aggregated.
7. Your Rights
Under the GDPR, you have the right to:
– Access the personal data we hold about you
– Rectify inaccurate or incomplete data
– Erase your data (“right to be forgotten”), where applicable
– Restrict processing in certain circumstances
– Object to processing based on legitimate interest, including direct marketing
– Data portability — receive your data in a structured, machine-readable format
– Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (e.g. by clicking “unsubscribe” in any newsletter email)
– Lodge a complaint with the Polish supervisory authority:
- Urząd Ochrony Danych Osobowych (UODO)
- ul. Stawki 2, 00-193 Warszawa, Poland
- [https://uodo.gov.pl](https://uodo.gov.pl)
or with the supervisory authority in your own EU member state.
To exercise any of these rights, please contact us at campaigns@milkandsilk.studio.
8. Providing Your Data is Voluntary
Providing personal data through the contact form or newsletter subscription is entirely voluntary. However, without your name and email address, we will not be able to respond to your inquiry or send you the newsletter.
9. Automated Decision-Making
We do not use your personal data for any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
10. Cookies
The Website uses cookies and similar technologies. Details on which cookies we use, their purpose, and how to manage your preferences are set out in our separate Cookie Policy.
11. Security
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including secure hosting, access controls, and use of reputable service providers bound by data processing agreements.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.
