Privacy Policy

Last updated 14 October 2026

This website is the personal portfolio of Kapi Michalska. This policy explains what data is collected when you visit, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

Who is responsible

The data controller is Tioli Piotr Michalski, ul. Łucznicza 7b/2, 71-472 Szczecin, Poland (NIP 8571360032, REGON 810957662), which operates this website — the online portfolio of the artist Kapi Michalska — and sells prints of her work. For any privacy request you can reach us at hello@kapimichalska.com.

What we collect

• Aggregate analytics. We use Vercel Web Analytics to understand traffic (page views, country, device type, referrer). It does not use cookies, does not track you across other websites, and does not identify you personally — data is anonymised and reported only in aggregate.
• Correspondence. If you email the studio, we process your email address and message solely to reply to you.
• Error monitoring. When something goes wrong, our monitoring tool may record limited technical details (such as your IP address, browser and the error itself) so we can diagnose and fix it. It is not used to identify or track you.
• Print waitlist. When the print waitlist launches, joining it is voluntary and your email will be used only to notify you about prints. You will be able to unsubscribe at any time, and consent will be recorded at the moment you sign up.
• Print registration. If you register a print with the code on its certificate, we keep your name, email, the print and its number in the edition register, so the studio can confirm your print if you ask later. Emails about new editions are a separate choice: the box is unticked, and if you tick it, the exact wording and the time are recorded.
• Language. If you switch the site between English and Polish, the choice is kept in a small cookie named lang for one year, only so the site opens in that language next time.

We do not sell your data, and we do not use it for profiling or automated decision-making.

Orders from the shop

This part covers orders for prints and originals placed through the cart at panel.xpertlab.pl/sklep/magda-michalska. The data controller is Tioli Piotr Michalski, ul. Łucznicza 7b/2, 71-472 Szczecin, Poland, NIP 8571360032, REGON 810957662, the same as for the rest of this website. Contact for data matters: hello@kapimichalska.com, phone +48 606 611 222. Orders are shipped to addresses in Poland only, and the binding Terms are the Polish ones.

1. What we collect when you order

1. Buyer details: first and last name, email address.

2. Shipping details: recipient's name, street and number, postcode, town, phone number for the courier.

3. Order and payment details: the prints and originals ordered, formats, edition numbers, prices, shipping cost, date, order ID and payment status. We never receive your bank login or card details; only the payment operator processes them.

4. Invoice details, if you ask for an invoice: company name, tax ID, address.

5. Correspondence about your order, a return or a complaint.

The data comes from you. We receive the payment status from PayPro S.A. (Przelewy24).

2. Why, and on what legal basis

1. Concluding and performing the sales contract: accepting the order, assigning edition numbers, issuing the certificate, packing and shipping the print, contacting you about delivery. Basis: Art. 6(1)(b) GDPR.

2. Accounting and tax: sales records, invoices, keeping accounting documents. Basis: Art. 6(1)(c) GDPR.

3. Returns and complaints: handling withdrawals from the contract and complaints. Basis: Art. 6(1)(c) GDPR (obligations under Polish consumer law), and Art. 6(1)(b) GDPR where we help you with performance of the contract.

4. Edition register: a record of which edition number was sold in which order, so that the edition of 50 is genuine and a print's authenticity can be confirmed. Basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping a limited edition honest.

5. Establishing, pursuing or defending legal claims. Basis: Art. 6(1)(f) GDPR.

We do not collect marketing consent with your order unless you tick the separate, optional box to receive emails. In that case the basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

3. Do you have to provide the data

Your name, email address and shipping details are needed to conclude and perform the contract. Without them we cannot accept the order or ship the print. Invoice details are needed only if you want an invoice.

4. How long we keep the data

1. Data needed to perform the contract: until it is performed, and then for the periods in points 2 and 3 of this list.

2. Accounting data: until the tax liability becomes time-barred, as a rule 5 years from the end of the calendar year in which the tax payment was due.

3. Data related to a complaint, return or dispute: until the matter is closed, and then until the related claims become time-barred.

4. The edition register entry (edition number linked to the order): for as long as the register is kept. If you register your print with the code on its certificate, the rules described above under print registration apply.

5. Who receives the data

1. On our behalf, under data processing agreements (Art. 28 GDPR):

   1. Vercel Inc. (USA): servers running the cart and order application,

   2. Supabase Pte. Ltd. (Singapore): the order database, stored in a data centre in Frankfurt (Germany),

   3. Vercom S.A. (Poland), operator of EmailLabs: sending the order confirmation email,

   4. the artist Kapi Michalska, who packs and ships orders on our behalf: the recipient's name, delivery address, phone and edition numbers. We send her these details through the Telegram messenger (point 2.3 of this list),

   5. our accountant: as needed for bookkeeping.

2. As separate controllers:

   1. PayPro S.A. (Poland, Przelewy24): payment processing, under its own privacy policy,

   2. the carrier we use to send the parcel (for example InPost sp. z o.o., Poczta Polska S.A. or another courier company operating in Poland): delivering the parcel (recipient's name, address, phone, and email address if the carrier sends notifications). Only the carrier chosen for a given parcel receives the data,

   3. Telegram FZ-LLC (United Arab Emirates), provider of the Telegram messenger: passing on to the artist the details needed to ship the order (recipient's name, delivery address, phone, items ordered), under Telegram's privacy policy.

3. We may disclose data to public authorities where the law requires it.

6. Transfers outside the European Economic Area

Vercel Inc. (USA) and Supabase Pte. Ltd. (Singapore) may access data from outside the EEA. Transfers are based on the European Commission's standard contractual clauses included in the processing agreements. Storing the database in Frankfurt does not rule out access by the provider and its sub-processors from outside the EEA. You can request a copy of these safeguards at hello@kapimichalska.com.

Telegram FZ-LLC is based in the United Arab Emirates, for which the European Commission has not issued an adequacy decision. We send shipping details through Telegram because this is necessary to perform our contract with you, that is, to ship your order (Art. 49(1)(b) GDPR). We send only the details needed to dispatch the parcel.

7. Your rights

You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict its processing, to data portability (for data processed under a contract or consent), to object to processing based on our legitimate interest, and to withdraw consent at any time without affecting earlier processing. You can lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, www.uodo.gov.pl). Write to hello@kapimichalska.com and we will respond, as a rule, within one month. Data we must keep under tax law cannot be erased before the period in point 4 ends.

8. Cookies in the cart

The cart and order form (panel.xpertlab.pl) do not set analytics or marketing cookies. The cart contents are stored only in your browser. We do not take decisions about buyers based solely on automated processing and we do not profile them.

Legal basis

Analytics and error monitoring are processed on the basis of our legitimate interest in understanding, securing and improving the site (Art. 6(1)(f) GDPR). Correspondence and the waitlist are processed on the basis of your consent and to take steps at your request (Art. 6(1)(a) and (b) GDPR). Print registration is processed at your request, to keep the record of your print (Art. 6(1)(b) GDPR); emails about new editions only with your consent (Art. 6(1)(a) GDPR).

Hosting & processors

The site is hosted on Vercel and its content is stored with Supabase (EU region). We use Sentry for error monitoring, which may process limited technical data (such as IP address and browser information) when an error occurs, so we can keep the site reliable and secure. These providers act as processors and may store data on our behalf. Vercel Web Analytics processes the aggregate, cookieless metrics described above.

Retention

Analytics are retained only in aggregate for a limited period by Vercel. Emails are kept for as long as needed to handle your request or, for the waitlist, until you unsubscribe. Print registrations are kept for as long as the edition register is kept, or until you ask us to delete yours.

Your rights

Under the GDPR you have the right to access, rectify or erase your data, to restrict or object to its processing, and to data portability. You may withdraw consent at any time and lodge a complaint with your supervisory authority (in Poland, the UODO). To exercise any of these, email hello@kapimichalska.com.