Privacy Policy

1. General provisions

This Privacy Policy (the "Policy") is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation", "GDPR").

The Policy sets out how personal data is processed and protected by the data controller (the "Controller", "Company", "we") in respect of data that a user (the "User", "data subject") provides through the website at studio.daxbax.com and its localised versions (the "Site"), in particular through the contact form.

Consent to processing for the purpose of responding to an enquiry is given by ticking the checkbox in the contact form; this Policy provides the information that the Controller must give under Art. 13 GDPR. If the User does not agree with the terms of this Policy, they should refrain from submitting their data through the Site.

Contact for data protection matters: info@daxbax.com

2. Definitions

• Personal data — any information relating to an identified or identifiable natural person (a "data subject").
• Processing — any operation or set of operations performed on personal data, including collection, recording, storage, alteration, use, disclosure and erasure.
• Controller — the entity that alone or jointly with others determines the purposes and means of the processing of personal data.
• Data subject — a natural person who has submitted their data through the Site's contact form.
• Transfer outside the EEA — a transfer of personal data to a recipient located outside the European Economic Area.

3. Principles of processing

In accordance with Art. 5 GDPR, the Controller processes personal data lawfully, fairly and transparently; collects it for specified, explicit and legitimate purposes; limits the data to what is necessary for those purposes; keeps it accurate and up to date; retains it for no longer than necessary; ensures its integrity and confidentiality; and remains accountable for compliance with these principles.

4. Purposes of processing

Personal data is processed for the following purposes:

• responding to enquiries submitted through the Site's contact form;
• providing information about the Company's services and preparing commercial proposals;
• entering into and performing a service agreement, should the User become a client of the Company;
• keeping the Site secure and preventing misuse;
• recording the fact, date, time and content of consent to processing as evidence that consent was obtained;
• any other purpose explicitly stated by the User in their message.

The Company does not carry out automated decision-making, including profiling, that produces legal effects concerning the User (Art. 22 GDPR).

5. Categories of personal data processed

When the User fills in and submits the contact form on the Site, the Controller processes:

• name;
• email address;
• subject of the enquiry;
• phone number — where voluntarily provided by the User;
• message text;
• IP address, date and time of submission, the version of this Policy and the wording of the consent, and the fact that the consent checkbox was ticked — retained as evidence that consent was obtained;
• the Site page URL and interface language from which the enquiry was sent — technical metadata of the enquiry;
• technical server logs (IP address, date and time, requested URL, user agent) kept by the hosting provider for the operation and security of the Site and retained for a limited period.

The Controller does not request or process special categories of personal data within the meaning of Art. 9 GDPR (data revealing racial or ethnic origin, political opinions, religious beliefs, health data, data concerning sex life, etc.). Please do not include such information in your message.

6. Legal basis for processing

• responding to enquiries and providing information about services — the data subject's consent, given by ticking the checkbox in the contact form (Art. 6(1)(a) GDPR) and, where the enquiry aims at entering into a contract, steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR);
• entering into and performing a service agreement — Art. 6(1)(b) GDPR;
• keeping the Site secure, preventing spam and misuse (IP address, server logs) — the Controller's legitimate interest (Art. 6(1)(f) GDPR);
• recording consent and retaining data to establish, exercise or defend legal claims — the Controller's legitimate interest (Art. 6(1)(f) GDPR) and the duty to demonstrate consent (Art. 7(1) GDPR).

Providing the name, email address, subject and message text is voluntary, but without them the Controller cannot respond to the enquiry (Art. 13(2)(e) GDPR).

Consent may be withdrawn by the User at any time using the contact details in section 9 of this Policy, without affecting the lawfulness of processing carried out before withdrawal.

7. Data sharing, processors and international transfers

Personal data is collected directly from the User when the contact form is submitted. The enquiry is delivered to the Controller's company mailbox, whose mail server is located in the European Economic Area, and is stored only there. The hosting provider and the email service provider act as data processors under an agreement pursuant to Art. 28 GDPR.

The contact form does not transfer personal data outside the European Economic Area.

The Controller does not sell and does not disclose Users' personal data to third parties for purposes other than those set out in this Policy, except where required by applicable law (for example, in response to a lawful request from a competent authority).

8. Data retention period

In accordance with the storage limitation principle (Art. 5(1)(e) GDPR), personal data collected through the contact form is retained for the period necessary to handle the enquiry and provide a response, and in any case for no longer than 3 (three) years from the User's last contact, unless a longer period is required to establish, exercise or defend legal claims, or is required by applicable law.

Upon expiry of this period, personal data is deleted or anonymised. The User may request early deletion of their personal data at any time, as described in section 9.

9. Data subject rights

Under the GDPR, the User (data subject) has the right to:

• access their personal data and obtain a copy of it (Art. 15);
• rectify inaccurate or incomplete data (Art. 16);
• erasure of data / "the right to be forgotten" (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent to processing at any time (Art. 7(3));
• lodge a complaint with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement (Art. 77).

To exercise these rights, the User may send a request to info@daxbax.com. The Controller responds to such requests without undue delay and, as a rule, within one month of receipt.

10. Security measures

In accordance with Art. 32 GDPR, the Controller implements appropriate technical and organisational measures to protect personal data against unauthorised or accidental access, loss, alteration or disclosure, including: use of an encrypted connection (HTTPS/TLS) when data is submitted through the contact form; and restricting access to personal data to those who need it to perform their duties.

11. Cookies and similar technologies

As of the date of publication of this Policy, the Site does not use cookies for analytics, advertising tracking or profiling of Users, and does not set third-party tracking pixels.

12. Changes to this Policy

The Controller may amend this Policy from time to time. The updated version takes effect once published on the Site, unless stated otherwise. The current version of this Policy is always available at studio.daxbax.com/privacy-policy.