Privacy and cookies policy

1. Controller and scope

The data controller is XperiBase sp. z o.o., 4 Przemysłowa Street, 14-100 Samborowo, Poland, KRS 0001214570, NIP 7412175161, REGON 543600515, e-mail: kontakt@tealdot.pl, telephone: +48 575 040 865.

This Policy applies to website users, customers, people submitting forms and reference materials, and people depicted in commissioned portraits. Data protection contact: kontakt@tealdot.pl.

2. Purposes, data and legal bases

• Enquiries and forms — pre-contractual steps: Article 6(1)(b) GDPR; other correspondence: legitimate interest in handling it, Article 6(1)(f) GDPR.
• Orders, payments and delivery — conclusion and performance of a contract, Article 6(1)(b) GDPR.
• Accounting and sales records — legal obligation, Article 6(1)(c) GDPR.
• Complaints — legal obligation, Article 6(1)(c) GDPR; legal claims — Article 6(1)(f) GDPR.
• Portfolio, likeness, name, story and reference photographs — separate voluntary consent, Article 6(1)(a) GDPR, where appropriate.
• Certificate verification page — confirming authenticity and preventing misuse as a legitimate interest, Article 6(1)(f) GDPR. The public page does not identify the work’s owner.

3. Reference photographs and indirectly obtained data

Customers may provide only materials they are entitled to use. Photographs are used to create the work, are not used for biometric identification and are not published without separate consent. A child’s likeness requires the consent of a legal representative.

Where data about a depicted person is supplied by the Customer, the source is the Customer. Data may include likeness, name and brief information. The legal basis is Article 6(1)(b) GDPR for a contracting party or, following assessment, Article 6(1)(f) GDPR for another person.

A person whose data was obtained indirectly receives the information required by Article 14 GDPR concerning the source, categories, purposes, legal bases, recipients, retention and rights unless a statutory exception applies.

4. Data recipients

Data may be shared with providers necessary to run the service and fulfil orders: Hostinger, the e-mail provider, accounting and invoicing services, Poczta Polska and international carriers, and insurers — only to the extent actually used.

Required processing agreements are concluded. Transfers outside the EEA take place on an appropriate legal basis and with required safeguards.

5. Retention periods

• Enquiries not resulting in a contract: 12 months after correspondence ends, unless longer retention is needed to protect claims.
• Contract and complaint data: for performance of the contract and then until claims expire.
• Tax and accounting records: for the period required by law.
• Reference photographs: until acceptance and for 90 days afterwards; in the event of a complaint or dispute, until the matter is closed. Working files are then deleted unless separate consent covers further use.
• Portfolio materials: until consent is withdrawn or the publication purpose ends.

6. Portfolio consent

Consents are separate and optional for: a photograph of the finished work, the reference photograph, a person’s likeness, the Customer’s name and the story description. Refusal does not affect price, acceptance, performance or approval of the commission. Consent may be withdrawn for the future.

7. Data subject rights

Depending on the legal basis and circumstances, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and a complaint to the President of the Polish Personal Data Protection Office.

Data required for the contract, payment and delivery is necessary to fulfil the order. Optional data is voluntary.

8. Cookies and browser storage

The website does not run analytics or advertising tools, tracking pixels or embedded third-party players. Images, recordings and the music player are served from the same domain. We do not display a consent banner for tools we do not use.

Language is determined by the page address: Polish uses the main address and English uses /en/. Language selection does not require localStorage or cookies.

Session storage: tealdot-home-music; provider: TEALDOT; purpose: remembering whether you switched music on or off; value: on or off; lifetime: the browser tab session. This value is stored after you use the player control and is not used for tracking. You can stop music using the same control and remove the stored setting by closing the tab or clearing this website’s browser data.

If we introduce optional analytics, advertising or third-party embeds that require consent, we will update this information and provide the appropriate consent controls before activating them.