Protection of your
personal data.

1. Data Controller

The data controller for personal data collected through www.fantasmatic.eu is Fantasmatic, based in Warsaw (Al. Solidarności, Warsaw, Poland), e-mail: foto@fantasmatic.pl, phone: +48 605 590 450.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).

2. Data Protection Contact

For any questions regarding the processing of your personal data, please contact the Controller:

• E-mail: foto@fantasmatic.pl
• Phone: +48 605 590 450
• Postal address: Fantasmatic, Al. Solidarności, Warsaw, Poland

3. Categories of Data Collected

Depending on how you use the website, we may process the following data:

• Contact form — name, e-mail address, phone number, company name, message content.
• Technical data — IP address, browser type, operating system, visit time, pages visited (collected automatically by the server and analytics tools).
• Cookies — information stored locally in your browser (see section 8 for details).

4. Purpose and Legal Basis for Processing

Personal data is processed for the following purposes:

• Handling enquiries — responding to messages sent via the contact form or e-mail (legal basis: Art. 6(1)(b) GDPR — performance of a contract or pre-contractual steps).
• Direct marketing — sending information about Fantasmatic's offer, where you have given your consent (legal basis: Art. 6(1)(a) GDPR — consent).
• Traffic analysis and website optimisation — usage statistics (legal basis: Art. 6(1)(f) GDPR — legitimate interest of the Controller).
• Legal obligations — retaining data required by law (legal basis: Art. 6(1)(c) GDPR).

5. Data Retention

• Contact form data — for as long as necessary to handle your enquiry, no longer than 3 years from the last contact.
• Marketing data — until consent is withdrawn or for a maximum of 3 years from the date consent was given.
• Data required by law — for the periods prescribed by applicable law (e.g. 5 years for accounting records).
• Analytics data (cookies) — in accordance with the settings of individual tools, no longer than 26 months.

6. Website Hosting

www.fantasmatic.eu is hosted on the infrastructure of Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). Netlify applies advanced physical and technical security measures, including:

• TLS/SSL encryption (Let's Encrypt certificate),
• DDoS protection and malicious traffic filtering,
• redundant infrastructure with automatic failover,
• regular backups of website data,
• a CDN (Content Delivery Network) with servers located in Europe, among other regions.

Data transfers to the USA are carried out in accordance with appropriate GDPR safeguards, including Standard Contractual Clauses (SCC). Full details are available at: www.netlify.com/privacy.

7. Recipients of Personal Data

Personal data may be shared with the following categories of recipients:

• Netlify, Inc. — hosting and contact form provider.
• Google LLC — analytics (Google Analytics) and marketing tools (Google Ads, remarketing). Data may be transferred to the USA under appropriate safeguards.
• Meta Platforms, Inc. — marketing tools (Facebook Pixel), if active. Data may be transferred to the USA under appropriate safeguards.
• Providers of legal, accounting or IT services engaged by the Controller, strictly to the extent necessary.

The Controller does not sell users' personal data to third parties.

8. Cookies

www.fantasmatic.eu uses cookies — small text files stored on your device.

Types of cookies:

• Essential — necessary for the basic functioning of the website; no consent required.
• Analytical — collect anonymous data about how the website is used (Google Analytics); require your consent.
• Marketing — enable retargeted advertising (Google Ads, Facebook Pixel); require your consent.

Managing cookies:

You may change your cookie settings in your browser or withdraw previously given consent at any time. Disabling analytical and marketing cookies does not affect the functioning of the website.

Cookie management instructions for popular browsers:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

9. Your Rights

Under GDPR, every person whose data we process has the following rights:

• Right of access — to obtain information about the data processed and a copy of that data.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion of your data ("right to be forgotten") where there is no legal basis for continued processing.
• Right to restriction of processing — to limit operations on your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on the Controller's legitimate interests.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact the Controller at foto@fantasmatic.pl. We will respond within 30 days.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland, the relevant authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also contact the supervisory authority in your country of residence.

11. Data Security

The Controller applies appropriate technical and organisational measures to protect data, including:

• TLS/SSL encryption of data transmission,
• access to data restricted to authorised persons only,
• regular updates of website software,
• periodic data backups.

12. Changes to This Policy

The Controller reserves the right to amend this Privacy Policy. Users will be informed of any material changes by the publication of an updated version at www.fantasmatic.eu/en/privacy-policy. The date of the last update is shown at the top of this document.