Privacy policy
What data we collect, why, and who we entrust it to.
Last updated: 24 August 2026
This is a translation for convenience. In case of any discrepancy, the Polish version of this policy prevails.
- 01
Data controller
The controller of personal data is Andrii Hrymaliuk, trading as Layerup Studio, 05-091 Ząbki, Poland. The full correspondence address is provided on request.
For any matter concerning personal data, write to layerupteam@gmail.com.
- 02
What we collect
From the forms on this site: your name, email address or phone number, the service selected, the content of your message, the deadline and quantity you state, and any files you attach — photographs and 3D models.
If you contact us through WhatsApp, Instagram or Telegram, we receive the data visible in your profile on that platform along with the content of the conversation.
Automatically: IP address, browser and device information, and data about how the site is used, collected by Google Analytics.
- 03
Purposes and legal bases
Preparing a quote and fulfilling an order — Article 6(1)(b) GDPR, steps taken at your request before entering into a contract and the performance of that contract.
Replying to an enquiry that does not become an order — Article 6(1)(f) GDPR, our legitimate interest in answering you.
Handling complaints and defending against claims — Article 6(1)(f) GDPR.
Visit statistics and improving the site — Article 6(1)(a) GDPR, on the basis of your consent given when using analytics tools.
- 04
Who we entrust data to
Supabase — database hosting and storage of files submitted through the forms.
Google — the spreadsheet in which we keep the order register, and Google Analytics.
The provider of the server the site runs on, and the carriers and parcel locker operators delivering the order.
We do not sell data and do not pass it to third parties for marketing purposes.
- 05
Transfers outside the EEA
Some of the providers listed above process data outside the European Economic Area. Such transfers rely on standard contractual clauses approved by the European Commission or on an adequacy decision.
- 06
How long we keep data
Order data and submitted files — for the duration of fulfilment and then for the limitation period for claims under applicable law.
Enquiries that do not become orders — up to 12 months from the last contact.
Analytics data — in line with the Google Analytics retention settings.
You may ask us to delete your submitted files earlier at any time.
- 07
Your rights
You have the right to access your data, to rectify, erase or restrict its processing, to data portability, and to object to processing based on legitimate interest.
You may withdraw consent to analytics at any time, without affecting the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
- 08
Cookies and analytics
The site uses Google Analytics 4, which stores a session identifier and a user identifier in order to count visits and see which pages lead to contact. Google's script only runs once you have given consent — before that it is not downloaded and no data reaches Google. The legal basis is your consent (Art. 6(1)(a) GDPR).
We do not send form content to analytics: your name, contact details and message never leave the site that way. We record only the fact that a form was sent, the service chosen and the number of files attached.
Without consent, only the strictly necessary parts run: remembering your language (the NEXT_LOCALE cookie), your theme, and the consent decision itself. They are not used for tracking and are not shared.
You can withdraw consent at any time — the “Cookie settings” link in the footer reopens the choice. On withdrawal we delete Google Analytics cookies from your browser. You can also restrict cookies in your browser settings.
- 09
Changes to this policy
If we change how we process data, we will update this page and change the date shown at the top.