PRIVACY AND COOKIES POLICY

Alternative Photographic Supplies Online Store
www.alternativephotographicsupplies.com

Effective from 20 September 2026

§ 1. General information

1. This Privacy and Cookies Policy explains how personal data is processed in connection with the use of the Alternative Photographic Supplies online store available at www.alternativephotographicsupplies.com, hereinafter referred to as the “Store”.
2. This Policy applies in particular to personal data processed in connection with:
   • using the Store website,
   • placing and fulfilling Orders,
   • maintaining a Customer Account,
   • payments and delivery,
   • purchasing Digital Content and places at Workshops,
   • complaints, returns and withdrawal from contracts,
   • contacting the Controller,
   • submitting and verifying product reviews,
   • the use of statistical and analytical tools.
3. This Policy is provided for information purposes and does not limit any rights granted under applicable law.

§ 2. Data Controller

1. The Controller of personal data is:

TSF – Trójmiejskie Studio Fotografii Radosław Brzozowski / Szlachetna Fotografia
ul. Akacjowa 1
83-034 Trąbki Wielkie
Poland

Tax Identification Number (NIP): 958 003 31 03
REGON: 220552806

E-mail: kontakt@szlachetnafotografia.com
Phone: +48 793 015 354

hereinafter referred to as the “Controller”.

2. The Controller may be contacted regarding any matter concerning the processing of personal data or the exercise of rights under the GDPR.
3. The Controller has not appointed a Data Protection Officer.

§ 3. Categories of personal data processed

1. Depending on how the Store is used, the Controller may process in particular:
   • first name and surname,
   • business name,
   • residential or registered business address,
   • delivery address,
   • e-mail address,
   • telephone number,
   • Tax Identification Number,
   • Order details,
   • information concerning the selected payment and delivery method,
   • information required to issue an invoice,
   • correspondence,
   • information concerning complaints, returns and withdrawal from contracts,
   • information connected with product reviews.
2. When the Store website is used, technical information may also be processed, including:
   • IP address,
   • device and browser information,
   • operating system,
   • cookie or session identifiers,
   • date and time of a visit,
   • pages visited,
   • source of the visit,
   • information concerning interactions with the Store.
3. The Controller does not intend to collect special categories of personal data referred to in Article 9 GDPR. Users should not provide such information unless it is necessary for resolving a specific matter.

§ 4. Purposes and legal bases for processing

1. Personal data connected with placing and fulfilling Orders, purchasing Digital Content and booking places at Workshops is processed for the purpose of entering into and performing a contract pursuant to Article 6(1)(b) GDPR.
2. Data connected with maintaining a Customer Account is processed pursuant to Article 6(1)(b) GDPR.
3. Data concerning payments and delivery is processed for the performance of a contract pursuant to Article 6(1)(b) GDPR.
4. Data contained in invoices and accounting documentation is processed in order to comply with tax and accounting obligations pursuant to Article 6(1)(c) GDPR.
5. Data connected with complaints, returns and withdrawal from contracts is processed for the performance of a contract and compliance with legal obligations pursuant to Article 6(1)(b) and (c) GDPR.
6. Data submitted in enquiries concerning the Store’s offer or a potential contract may be processed pursuant to Article 6(1)(b) GDPR. Other correspondence may be processed pursuant to Article 6(1)(f) GDPR, based on the Controller’s legitimate interest in handling correspondence and enquiries.
7. Data connected with submitting and verifying product reviews may be processed pursuant to Article 6(1)(f) GDPR, based on the Controller’s legitimate interest in maintaining a reliable review system.
8. Personal data may be processed for the purpose of protecting the Store, preventing abuse, and establishing, pursuing or defending legal claims pursuant to Article 6(1)(f) GDPR.
9. The storage and reading of Google Analytics statistical cookies and full statistical measurement after consent has been given are based on Article 6(1)(a) GDPR and on consent where required under applicable data protection and electronic communications laws, including the Polish Electronic Communications Law where applicable.
10. The Store uses Google Consent Mode v2. If consent to statistical cookies is not given, Google Analytics does not write or read Analytics cookies. However, limited cookieless signals may still be transmitted to Google as described in § 10.

§ 5. Providing personal data

1. Providing personal data is voluntary. However, information marked as required is necessary in order to enter into and perform a contract.
2. Failure to provide information necessary to fulfil an Order may prevent the purchase from being completed.
3. Creating a Customer Account is voluntary. Customers may place Orders without creating an Account.
4. Submitting a product review is voluntary.
5. Consent to statistical cookies is voluntary and is not required in order to make a purchase.

§ 6. Payments

1. Depending on the payment method selected by the Customer, information necessary to process the transaction may be disclosed to a bank or an external payment service provider.
2. The English-language Store currently offers in particular:
   • bank transfer,
   • PayPal.
3. If PayPal is selected, the information necessary to process the transaction is transmitted to PayPal.
4. Payment service providers may act as independent controllers of personal data to the extent that they independently determine the purposes and means of their processing, in accordance with their own privacy policies.
5. Where card payment is processed directly by an external payment provider, the Controller does not receive the Customer’s full payment card details.

§ 7. Delivery

1. Where delivery is required, personal data necessary to perform the delivery may be disclosed to the relevant courier company, postal operator, collection-point operator or parcel-locker operator.
2. Only information necessary to perform the selected delivery service is disclosed.

§ 8. Customer Accounts and Order-related messages

1. Creating a Customer Account is voluntary.
2. The Store may send messages directly connected with an Order already placed, including Order status information and reminders concerning an Order that has been placed but has not yet been paid.
3. Such messages relate to the handling of a specific transaction and do not constitute a newsletter.
4. The Store does not currently operate a newsletter.

§ 9. Product reviews

1. The Store may allow Customers who have made a purchase to submit reviews concerning purchased products.
2. Information connected with a review may be processed for the purposes of:
   • publishing the review,
   • linking the review to a purchase,
   • verifying its authenticity,
   • preventing fictitious, duplicate or irrelevant reviews.
3. Information used solely for internal verification of the author does not have to be displayed publicly.
4. The information publicly displayed with a review depends on the information provided by the author and the operation of the Store’s review system.

§ 10. Google Analytics 4

1. The Store uses Google Analytics 4 (GA4) to statistically analyse how visitors use the Store.
2. For users in the European Economic Area, the relevant Google entity is, where applicable, Google Ireland Limited.
3. Google Analytics may process information concerning, in particular:
   • the device and browser,
   • sessions and page views,
   • the source from which the visitor reached the Store,
   • approximate location,
   • pages visited,
   • interactions with the Store,
   • the purchasing journey.
4. The integration between Google Analytics 4 and the Sky-Shop platform enables e-commerce events connected with use of the Store and the purchasing process to be transmitted to Google Analytics.
5. The Store uses Google Consent Mode v2 as implemented through the Sky-Shop platform.
6. After consent to statistical cookies has been given, Google Analytics may write and read Analytics cookies and perform fuller statistical measurement.
7. If a user does not consent to statistical cookies, Google Analytics does not write or read its Analytics cookies. Under the Consent Mode configuration used by the Store, limited cookieless signals may nevertheless be transmitted to Google and used, among other things, for aggregated measurement and modelling.
8. Such cookieless signals may technically include information concerning consent status, event time, browser or device and other information transmitted as part of standard internet communication. When Analytics storage is denied, Google Analytics does not write or read Analytics cookies.
9. Google Analytics may use, in particular:
   • _ga – used to distinguish users,
   • _ga_<identifier> – used, among other purposes, to maintain information relating to a session.
10. Analytics cookies are used in accordance with the user’s choice concerning the statistical cookies category.
11. The user may change or withdraw consent at any time using the cookie settings available in the Store.
12. Refusing statistical cookies does not prevent the user from making a purchase.
13. The Controller does not currently use Meta Pixel or Google Ads remarketing.

Cross-domain measurement

14. The Store forms part of the same Sky-Shop installation as the Polish-language store operated at:

www.szlachetnafotografia.com

15. Google Analytics is configured for cross-domain measurement between:

www.alternativephotographicsupplies.com

and

www.szlachetnafotografia.com

16. This configuration is intended to prevent a visitor moving between the two Store domains from being incorrectly counted as a new user or a new session.
17. Both domains use the same Google Analytics measurement configuration.

§ 11. Cookies

1. The Store uses cookies and similar technologies.
2. The Store uses the following categories of cookies:

Required cookies

Required cookies are necessary for the proper operation of the Store, including the shopping cart, session management, login, Order processing, security and remembering the user’s cookie choices.

Where they are strictly necessary for the transmission of a communication or for providing a service explicitly requested by the user, they may be used without separate consent.

Statistical cookies

Statistical cookies are used to analyse how visitors use the Store, primarily by means of Google Analytics 4.

Writing and reading statistical cookies requires the user’s consent.

Marketing cookies

Marketing cookies may be used for advertising and marketing purposes.

The Controller does not currently use Meta Pixel or Google Ads remarketing.

3. Users may accept or reject optional categories of cookies and may subsequently change their choice.
4. Required cookies may remain active to the extent necessary to provide a service requested by the user.
5. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
6. Users may also manage cookies through their browser settings. Restricting certain required cookies may result in some Store functions not operating correctly.

§ 12. Recipients of personal data

1. The Store’s technical platform is provided by SIEF-IT Sp. z o.o. – Sky-Shop. In relation to Customer data entered into the Sky-Shop system, SIEF-IT processes personal data on behalf of the Controller under the applicable data-processing arrangements.
2. Depending on the particular purpose, personal data may also be disclosed to:
   • IT and technical infrastructure providers,
   • banks and payment service providers,
   • PayPal,
   • courier and postal operators,
   • collection-point and parcel-locker operators,
   • the Controller’s accounting service provider,
   • Google in connection with Google Analytics 4,
   • legal or professional advisers where necessary,
   • public authorities entitled to obtain personal data under applicable law.
3. Not every recipient listed above receives the personal data of every user. The recipient and scope of disclosure depend on the way in which the Store is used and the payment or delivery method selected.

§ 13. Transfers outside the European Economic Area

1. The use of services provided by global providers, in particular Google and PayPal, may involve personal data being processed or transferred outside the European Economic Area.
2. Where this occurs, mechanisms permitted by the GDPR are used as appropriate to the particular transfer, including:
   • European Commission adequacy decisions,
   • the EU–US Data Privacy Framework, where applicable,
   • Standard Contractual Clauses,
   • other safeguards permitted under the GDPR.
3. Further information concerning international transfers carried out by external service providers can be found in their respective privacy and international data-transfer documentation.

§ 14. Retention periods

1. Personal data connected with an Order is retained for the period necessary to perform the contract and subsequently for the period during which legal claims may arise or be pursued.
2. Tax and accounting documentation is retained for the period required by applicable law.
3. Information relating to complaints, returns and withdrawal from contracts is retained for the period necessary to handle the matter and subsequently for the period justified by the possibility of pursuing or defending legal claims.
4. Information relating to a Customer Account is processed for as long as the Account is maintained, except for information that must continue to be retained because of previous transactions or legal obligations.
5. Correspondence is retained for as long as necessary to deal with the relevant matter and, where justified, for a period connected with possible legal claims.
6. Information relating to reviews may be retained for the period during which the review is published and to the extent necessary to protect the integrity of the review system and deal with potential claims.
7. Data processed on the basis of consent is processed until consent is withdrawn or the purpose of processing ceases to exist, unless another legal basis permits further retention.
8. The retention period for data in Google Analytics also depends on the retention settings configured in GA4 and Google’s applicable rules.

§ 15. Data subject rights

1. Subject to the conditions set out in the GDPR, a data subject has, as applicable, the right to:
   • access personal data,
   • obtain a copy of personal data,
   • rectify personal data,
   • request erasure,
   • restrict processing,
   • data portability,
   • object to processing based on Article 6(1)(f) GDPR,
   • withdraw consent at any time where processing is based on consent.
2. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
3. The right to erasure is not absolute. The Controller may continue to retain personal data where required by law or where necessary for the establishment, exercise or defence of legal claims.
4. Requests concerning personal data may be sent to:

kontakt@szlachetnafotografia.com

§ 16. Right to lodge a complaint

1. A person who believes that their personal data is being processed in breach of data-protection law has the right to lodge a complaint with a competent supervisory authority.
2. In Poland, the supervisory authority is:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych).

3. Where provided for by applicable data-protection law, a complaint may also be submitted to another competent supervisory authority.

§ 17. Automated decision-making

1. The Controller does not make decisions concerning Customers based solely on automated processing that produce legal effects or similarly significantly affect the individual within the meaning of Article 22 GDPR.
2. External payment service providers may independently use automated transaction-security, fraud-prevention or risk-assessment systems in accordance with their own privacy policies.

§ 18. Data security

1. The Controller applies technical and organisational measures appropriate to the nature and risk of the processing of personal data.
2. Connections to the Store are protected using encrypted HTTPS connections.
3. Access to personal data is limited to persons and entities for whom access is necessary to perform their duties.

§ 19. Links to external websites

1. The Store may contain links to external websites.
2. After a user follows a link to an external website, the processing of personal data and use of cookies on that website are governed by the privacy rules of its operator.

§ 20. Changes to this Policy

1. This Policy may be amended in particular if:
   • applicable law changes,
   • the way the Store operates changes,
   • new tools or services are introduced,
   • service providers change,
   • the scope of personal data processing changes.
2. The current version of the Policy is published in the Store.
3. Where a new form of processing requires the user’s consent, consent will be obtained before such processing begins.
4. This version of the Policy is effective from 20 September 2026.