top of page

​

This Policy is effective from 20 July 2026 and is continuously available on the Website.

This is the first version of the Policy published by the Website. In the event of any amendments, the current version and links to archived versions will be made available here.

Do not copy this Policy. It has been prepared specifically for the Website and is protected by copyright.

Privacy and Cookies Policy for the lemonspark.art website

This Policy provides information about the rules governing the use of the Website, the processing of your personal data and the use of cookies and other technologies connected with the operation of the Website. I take care to protect your data and process it in accordance with applicable law.

1) General information

  1. This Policy applies to the website available at: lemonspark.art.

  2. The operator of the Website and the controller of personal data is Ilona Zając, conducting business under the name Lemon Spark Art, based in Warsaw, Tax Identification Number (NIP): 1251254365.

  3. You may contact the Controller by email at: izajac@lemonspark.art. When contacting the Controller in this way, you provide personal data such as your email address, first name and surname.

  4. The operator of the Website is the controller of your personal data in relation to the data voluntarily provided through the Website and takes all necessary measures to ensure the security of that data.

  5. The Website collects your personal data for the following purposes:

a. responding to your enquiry;
b. enabling you to contact the Controller;
c. presenting an offer and providing information about the services offered;
d. entering into and performing an agreement for the provision of services offered through the Website;
e. carrying out marketing activities relating to the Controller’s business;
f. establishing, pursuing or defending legal claims;
g. complying with obligations arising under applicable law.

  1. The Website obtains information about its users and the way in which they use the Website in the following ways:

a. through data voluntarily entered into forms available on the Website and subsequently entered into the Controller’s systems;
b. through cookies stored on users’ devices and through other technologies used in accordance with applicable law.

  1. Providing personal data is voluntary. However, in some cases it may be necessary in order to respond to your enquiry, enter into or perform an agreement, or use certain other functions of the Website.

  2. By providing personal data, you confirm that the data is accurate and belongs to you. If you provide another person’s personal data, you undertake to ensure that you are authorised to provide it to the Controller in accordance with applicable law.

2) Data protection measures

  1. Login areas and forms used to provide personal data are secured using an encrypted SSL/TLS connection. This ensures that data transmitted between the user’s device and the Website is appropriately protected.

  2. The Controller applies appropriate technical and organisational measures to ensure the security of the personal data being processed, taking into account the nature, scope and purposes of the processing, as well as the risk of infringement of the rights and freedoms of the persons concerned.

  3. The Controller ensures the ongoing maintenance and security of the IT systems used, including installing updates and creating backups where necessary to ensure the continuity of the Website’s operation.

3) Entities processing personal data

  1. In connection with the operation of the Website, the Controller may use the services of external entities to which the processing of personal data may be entrusted. Data is transferred only to the extent necessary to achieve specific processing purposes, ensure the correct operation of the Website or comply with the Controller’s legal obligations.

  2. The recipients of your personal data may include, in particular:

a. hosting service providers and entities providing the technical infrastructure necessary for the operation of the Website;

c. entities providing technical support for the Website, which may gain access to personal data while carrying out technical work;

d. authorised employees and contractors of the Controller who use the data to the extent necessary to fulfil the purposes connected with the operation of the Website, provided that the Controller authorises such persons;

e. entities providing accounting and bookkeeping services to the Controller;

f. providers of analytical and marketing tools used on the Website, which may process information concerning users’ activity on the Website;

g. entities providing legal or advisory services to the Controller, where access to the data is necessary to ensure the Controller’s legal protection.

  1. The Controller uses only the services of entities which, in accordance with their declarations and the agreements concluded with them, provide an appropriate level of personal data protection.

  2. Where necessary, your personal data may be disclosed to a qualified lawyer bound by professional secrecy, if this is required to obtain legal assistance or protect the Controller’s rights.

  3. Your personal data may also be disclosed to competent public authorities, including tax authorities, where such an obligation arises under applicable law.

  4. In connection with the Controller’s use of analytical and marketing tools, personal data may be transferred to third countries, in particular the United States of America, where the providers of such tools use infrastructure located outside the European Economic Area. Such transfers are carried out in accordance with the requirements of personal data protection laws, in particular by using appropriate mechanisms ensuring the required level of data protection.

  5. Analytical and marketing tools used on the Website may collect information about the way in which the Website is used, including information about visited pages, the source from which the user accessed the Website, the user’s activity and events performed on the Website. The scope of the processing of this information depends on the settings of the relevant tools and the consent provided by the user through the cookie management mechanism.

4) Information concerning data processing

  1. I process your personal data for no longer than is necessary to fulfil the purposes for which it was collected, unless applicable law requires it to be retained for a longer period or further processing is necessary for the purposes of the Controller’s legitimate interests, in particular to establish, pursue or defend legal claims.

  2. Providing personal data is voluntary. However, in some cases it may be necessary in order to use certain functions of the Website, make contact, enter into or perform an agreement, or have an enquiry or request considered.

  3. The purposes and legal bases of processing are as follows:

1) Handling correspondence and contact by email

Legal basis: Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in conducting correspondence, responding to messages, presenting offers and taking steps aimed at entering into and performing an agreement.

Where the contact directly leads to the conclusion of an agreement, the processing is also based on Article 6(1)(b) of the GDPR.

When contacting the Controller by email or telephone, you provide the personal data contained in your message or disclosed during the conversation, including, in particular, your email address, first name and surname, telephone number and any other information provided voluntarily.

The data is processed for the purposes of responding to your enquiry, conducting correspondence, presenting an offer and taking steps aimed at entering into or performing an agreement.

After the contact has ended, the data may be retained for the period necessary to keep correspondence records and for archival and evidentiary purposes, in particular to establish, pursue or defend legal claims.

2) Entering into and performing an agreement for the provision of services

Legal basis: Article 6(1)(b) of the GDPR — taking steps prior to entering into an agreement and performing the agreement — and Article 6(1)(c) of the GDPR — compliance with legal obligations relating to accounting records.

Where an agreement for the provision of services is concluded, the Controller processes the data necessary to enter into and perform the agreement, including, in particular, identification data, contact details and information provided in connection with the performance of the service.

The data will be processed for the duration of the agreement and subsequently for the period necessary for the expiry of the applicable limitation periods for legal claims, as well as for the period required by law, particularly tax and accounting regulations.

3) Issuing and retaining accounting documents

Legal basis: Article 6(1)(c) of the GDPR — compliance with the Controller’s legal obligations.

Data included in invoices and other accounting documents is processed in order to comply with obligations arising under tax and accounting regulations.

4) Evidentiary purposes and protection against legal claims

Legal basis: Article 6(1)(f) of the GDPR — the Controller’s legitimate interests.

The Controller may process personal data in order to preserve information that may be required to demonstrate certain circumstances or to establish, pursue or defend legal claims.

5) Maintaining documentation relating to personal data protection

Legal basis: Article 6(1)(c) of the GDPR — compliance with the Controller’s legal obligations.

Data may be processed to the extent necessary to maintain documentation required under personal data protection laws.

6) Use of cookies and analytical and marketing tools

Legal basis: Article 6(1)(a) of the GDPR — the user’s consent provided through the cookie management mechanism.

The Controller may use cookies and analytical and marketing tools to ensure the correct operation of the Website, analyse the way in which the Website is used and carry out marketing activities. The scope and purpose of the use of these tools depend on the user’s settings and the consent provided.

7) Managing the Controller’s social media profiles

Legal basis: Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in communicating with users and promoting the Controller’s business.

In connection with the management of the Controller’s social media profiles, the personal data of individuals who contact the Controller through these platforms may be processed. This may include, in particular, their first name and surname, username, profile picture and information contained in messages or comments.

Each social media platform has its own rules concerning the processing of personal data, as specified in its terms and conditions and privacy policy.

5) Your data

  1. Depending on the purpose of the processing, the following information about you may be processed:

  1. first name and surname;

  2. residential address or business address, if you provide it to us;

  3. Tax Identification Number (NIP);

  4. email address;

  5. telephone number;

  6. information contained in email correspondence;

  7. bank account number;

  8. IP address;

  9. approximate location;

  10. the content of enquiries submitted through the contact form.

  1. I collect the above data when you contact me by email or through social media, follow the Website’s social media profiles or interact with content published by the Website on social media.

  2. We may also use specialised tools that collect additional information about you in connection with your use of the Website. This may include information concerning:

  1. your operating system and web browser;

  2. the Website pages you visit;

  3. the amount of time you spend on the Website;

  4. your movement between individual pages of the Website;

  5. clicks on individual links;

  6. the source from which you accessed the Website;

  7. your age range;

  8. your gender;

  9. your approximate location, no more precisely than the town or city in which you are located;

  10. your interests and online activity.

  1. As a general rule, this information does not allow the Controller to identify a user directly. However, in certain circumstances, particularly when combined with other data, it may constitute personal data within the meaning of the GDPR.

In practice, this information remains anonymous for the purposes of the Website because we do not intend to identify users on its basis, and the Controller does not use this information to identify users.

Processing this information makes it possible to present you with a tailored offer, conduct analytics and prepare statistics for marketing purposes, improve services, measure the effectiveness of advertising, personalise content and protect against fraud and abuse.

  1. Some information about you may also be collected automatically by the tools we use:

  1. the Website’s system records your IP address.

6) What rights do you have in connection with the processing of your personal data?

  1. You have a number of rights in connection with the processing of your personal data:

1) Right to information

You have the right to receive information. We fulfil our information obligations, among other things, by making this Policy available to you.

2) Right of access to your personal data

You have the right to request access to your personal data. If you submit such a request, we will provide access to the data within one month.

If circumstances prevent us from doing so within that period, we may extend the deadline once where justified. Before doing so, we will inform you whether we process your data and when you can expect to receive our response.

3) Right to data portability

You may request that your data be transferred to another specified controller.

4) Right to rectification of personal data

You may request that your data be corrected if you believe that the data we process is inaccurate.

5) Right to restriction of processing

You may request that the processing of your data be restricted.

6) Right to erasure of personal data

You have the right to be forgotten. This means that you may request the erasure of all or part of the personal data relating to you.

We will then inform you whether the data can be erased and explain the legal grounds and reasons for any continued processing.

7) Right to withdraw consent

Where personal data is processed on the basis of your consent, you have the right to withdraw that consent at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

8) Right to object to the processing of personal data

You may object if you do not want your personal data to continue to be processed.

Please note that where further processing is necessary to establish, pursue or defend legal claims, we may be unable to uphold your objection.

9) Right to lodge a complaint with the President of the Personal Data Protection Office

You may lodge a complaint with the President of the Personal Data Protection Office at:

ul. Stawki 2
00-193 Warsaw
Poland

7) Controller’s server logs

  1. Information concerning users’ activity on the Website may be recorded in server logs. This data is used to administer the Website.

What does this mean?

When you use the Website, it sends requests to the server on which it is hosted. Each such request is recorded in the server logs.

  1. Data recorded in server logs may include, in particular, the IP address, the date and time of the request, information about the web browser and operating system, and other technical data connected with the use of the Website.

This data is used to ensure the security of the Website, diagnose errors and administer the IT infrastructure.

  1. Data recorded in the server logs is not used by the Controller to identify users unless this is necessary to ensure the security of the Website or pursue legal claims.

8) Information about cookies and similar technologies

  1. The Website uses cookies.

  2. Cookies are electronic data, particularly text files, stored on your device and intended for use in connection with websites. Cookies usually contain the name of the website from which they originate, the period for which they are stored on the device and a unique identification number.

  3. The operator of the Website places cookies on your device and accesses them.

  4. We use cookies on the basis of your consent and where cookies are necessary for the proper provision of electronic services to you.

  5. Cookies that are not necessary for the proper provision of electronic services will be blocked until you consent to their use.

When you visit the Website for the first time, you will see a message requesting your consent and providing you with the option to manage your cookie preferences.

  1. Essential cookies enable the Website to operate correctly, remember selected user settings and provide access to its basic functions.

You may change or withdraw your consent at any time through the settings available in the cookie management panel.

  1. The Website uses two main types of cookies: session cookies and persistent cookies.

Session cookies are temporary files stored on your device until you log out, leave the Website or close the software used to access it, such as your web browser.

Persistent cookies are stored on your device for the period specified in the cookie settings or until you delete them.

  1. Web browsers usually allow cookies to be stored on a device by default. You may change these settings.

Your web browser allows you to delete cookies. It is also possible to block cookies automatically. Detailed information can be found in your browser’s help section or documentation.

  1. Restricting the use of cookies may affect some of the functions available on the Website.

  2. Web browsers also offer an incognito or private browsing mode.

You may use this mode if you do not want information about visited websites and downloaded files to be saved in your browsing and download history.

Cookies created while using incognito or private browsing mode are deleted when all windows operating in that mode are closed.

11) Analytical and marketing tools used on the Website

Cookies stored on your device may also be used by third parties whose services are used by the Controller.

Analytical and marketing tools are used only after you provide your consent through the cookie management mechanism, except for cookies that are necessary for the proper operation of the Website.

bottom of page