PRIVACY POLICY

ALEXLAB HOLDING MANAGEMENT

Effective date: 28.02.2026

1. General provisions

1. This Privacy Policy describes the rules for processing personal data of users of the website available at: www.ALEX-L-STUDIO.com (the “Website”) and Customers using the Company’s services.

2. This Policy is for information purposes and serves to fulfil the Controller’s obligations arising from data protection laws, including the GDPR (RODO).

3. The Website may be available globally; however, the data controller is the entity indicated below.

 
2. Data controller and contact

1. The data controller is ALEXLAB HOLDING MANAGEMENT (the “Controller”).

2. Contact for privacy and personal data matters: studio@alex-l-studio.com.

3. The Controller has not appointed a Data Protection Officer.

 
3. What data we process

1. Depending on how you use the Website, we may process the following data: a) e-mail address – provided when placing an order (required), b) phone number – provided voluntarily (optional), used solely to contact you regarding your order, c) message content and information entered in the “Additional information” field – provided voluntarily (optional), d) payment-related data – processed by payment operators; the Controller receives information necessary to confirm and settle the transaction (e.g., payment status, transaction identifier), e) technical data related to the use of the Website (e.g., IP address, browser/device data, event logs) – to the extent necessary for the Website to operate, to ensure security, and to prevent abuse.

2. Please do not provide sensitive data or information not necessary to fulfil your order in the “Additional information” field.

3. Providing an e-mail address is necessary to place an order and to contact you regarding its fulfilment.

 
4. Purposes and legal bases for processing

1. We process personal data for the following purposes and on the following legal bases: a) fulfilling an order and performing a contract (including contact regarding fulfilment) – Article 6(1)(b) GDPR, b) handling enquiries and communicating prior to entering into a contract (e.g., messages, arrangements) – Article 6(1)(b) GDPR, c) settlements and legal obligations (e.g., accounting documentation, settlements) – Article 6(1)(c) GDPR, d) ensuring the Website’s security and preventing abuse (e.g., technical logs) – Article 6(1)(f) GDPR, e) establishing, pursuing, or defending claims (including in connection with complaints and chargebacks) – Article 6(1)(f) GDPR, f) analytics and marketing (if used) – only on the basis of your consent (Article 6(1)(a) GDPR), granted and managed in the consent panel.

2. Providing a phone number is voluntary. If provided, we use it solely to contact you regarding your order.

3. Where processing is based on Article 6(1)(f) GDPR, the Controller’s legitimate interests include, in particular: ensuring the Website’s security, preventing abuse, and establishing, pursuing, or defending claims.

 
5. Recipients of data

1. Personal data may be shared with entities supporting the operation of the Website and the provision of services, in particular: a) the Website platform and hosting provider (e.g., Wix), b) payment operators and institutions handling transactions (e.g., Stripe/PayPal – if available on the Website), c) e-mail and communication tool providers, d) IT service providers necessary to maintain the Website and its security (e.g., anti-spam systems, monitoring, backups), e) accounting service providers – only to the extent necessary to fulfil legal obligations (if applicable), f) entities authorised under applicable law (e.g., public authorities) – only in cases provided for by law.

2. To the extent that the entities referred to above process data on behalf of the Controller, they act as processors under relevant data processing agreements.

3. Payment operators may also process data related to the transaction as independent controllers, in accordance with their own privacy policies.

6. Transfers outside the EEA/EOG

1. The Controller may use service providers (e.g., hosting, payment tools, IT tools) whose infrastructure or subcontractors may be located outside the European Economic Area (EEA/EOG).

2. Where personal data is transferred outside the EEA/EOG, such transfer is based on legal grounds and safeguards provided for by law (e.g., adequacy decisions or standard contractual clauses).

3. Information about the safeguards applied can be obtained by contacting the Controller.

7. Data retention periods

1. We retain personal data for as long as necessary to achieve the purposes for which it was collected, including to perform the contract, and then – if needed – until the limitation periods for claims expire.

2. Materials provided to perform the service (e.g., audio files) are stored for up to 14 days from the delivery of the final files, unless further retention is necessary to establish, pursue, or defend claims.

3. Settlement/accounting data (if applicable) is retained for the period required by law.

4. Technical data and logs may be retained for as long as necessary to ensure the Website’s security and prevent abuse.

8. Rights of data subjects

1. Data subjects have the following rights (to the extent provided by law): a) the right of access to data, b) the right to rectification, c) the right to erasure (“right to be forgotten”), d) the right to restriction of processing, e) the right to data portability, f) the right to object to processing (where processing is based on Article 6(1)(f) GDPR), g) the right to withdraw consent at any time (where processing is based on consent) – without affecting the lawfulness of processing carried out before withdrawal.

2. Requests regarding the exercise of rights may be sent to: studio@alex-l-studio.com.

3. If you believe that the processing of your data violates the law, you have the right to lodge a complaint with the President of the Polish Data Protection Authority (UODO) or with the competent supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement.

9. Cookies and similar technologies

1. The Website uses cookies and similar technologies to ensure proper operation, security, and basic functionality.

2. Cookies other than strictly necessary (e.g., analytics or marketing cookies – if used) are used only after obtaining the user’s consent.

3. You may change or withdraw your consent for non-essential cookies at any time via the consent management panel available on the “Privacy Policy” page (Privacy Trigger).

4. Independently, you may also manage cookies in your web browser settings.

10. Security

1. The Controller applies technical and organisational measures appropriate to the risk to protect personal data against loss, unauthorised access, disclosure, or modification.

2. Access to data is granted only to authorised persons and processors operating under relevant agreements, to the extent necessary to achieve the processing purposes.

11. Changes to this Privacy Policy

1. The Controller may update this Privacy Policy, in particular in the event of technological, organisational, or legal changes.

2. The current version of the Privacy Policy is published on the Website, and the effective date is indicated at the beginning of the document.

12. Final provisions

1. This Privacy Policy is for information purposes only and applies solely to the Website and services provided by the Controller.

2. If you have any questions regarding the processing of personal data, please contact us at: studio@alex-l-studio.com.

3. If the Controller provides this Privacy Policy in more than one language version, in case of discrepancies the Polish version shall prevail.