Privacy policy
2026-10-08 · v1.6
Platform operator and data controller
The operator’s identification details have not been completed. The catalogue can be viewed; commercial readiness has not been confirmed.
Controller and purposes
Account data supports login, email verification and communication. Order data, delivery addresses, agreements, payments and refunds support contract performance, reports and tax, accounting and DAC7 obligations. Legal bases are contract performance, legal obligations, legitimate interests in security and claims, and consent for optional marketing.
Access and recipients
Participants see their own conversations and transactions. Sellers receive the details needed to fulfill orders; buyers see seller bank details only in their own order. Only the owner’s superadmin may read conversations and private photos for a report; access is audited. Hosting and email providers process data to provide services. Stripe processes payment data for Stripe transactions; promotional transfers are handled by the parties’ banks.
Bank accounts, photos and documents
Bank details are encrypted. Changes require login and confirmation using an emailed link; previous order instructions remain unchanged. Invoices, corrections and PDF certificates are private and accessible only to authorised order parties, their owner or an administrator; administrator access is audited. Agreement and confirmation photos are stored in a private volume included in backups; endpoints check participant access. EXIF and GPS metadata are removed. Do not upload identity documents, full statements or unrelated third-party information.
Retention and rights
Data is retained for account service, contract performance, claims and legally required periods. Transaction records may remain after account closure where required by law or protection of claims. You may request access, correction, deletion, restriction and portability, object to processing or withdraw consent. Contact the gallery to exercise these rights. You may lodge a complaint with the Polish data protection authority (UODO).
Cookies and communication
Essential cookies support sessions, language and carts. The lgs_portal cookie remembers the real gallery or DEMO choice for up to 30 days; a new portal configuration invalidates that choice. It contains no account or transaction data. Optional analytics and marketing require consent through cookie settings. Order, bank-account and report emails provide the service; newsletters require separate confirmation. Private conversation content and bank details are excluded from notification emails and public catalog data.