1. Who is responsible for your data?
The controller of your personal data is:
Diana Szczepanik
running a business under the name Diana Szczepanik Consulting
Business address: ul. Angorska 21/15, 03-913 Warszawa, Poland
NIP: 1133194570
Email: contact@dianaszczepanik.com
For any questions regarding your personal data or this Privacy Policy, please contact us using the email address above.
2. What personal data do we collect and why?
We collect and process personal data only where necessary for operating this website, responding to enquiries, providing professional services and meeting legal obligations.
Website visits
When you access this website, certain technical information may be processed, including your IP address, browser and device information, pages requested, access times and technical connection data.
This information is used to deliver the website, maintain its security and resolve technical issues.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in operating a secure and functional website.
Contact enquiries
When you contact us by email or through a contact form, we may collect:
Your name and email address
Your company name and professional role
Information about your enquiry or project
Any additional information you voluntarily provide
We use this information to respond to your enquiry, discuss potential collaboration and prepare proposals where requested.
Messages sent through the contact form are transmitted and stored using Framer’s form service and forwarded to our business email account.
Legal basis: Article 6(1)(b) GDPR where processing is necessary to take steps towards a contract with you or Article 6(1)(f) GDPR where we communicate with representatives of business clients.
Service bookings and project delivery
When you book a service, such as a product research audit, we may process your name, contact details, company details, billing information, selected service, booking details and project-related correspondence.
This information is used to confirm your booking, deliver the agreed services, communicate with you and manage our contractual relationship.
Legal basis: Article 6(1)(b) GDPR where you are a contracting individual or Article 6(1)(f) GDPR when processing the contact details of individuals representing a business client.
Payments and invoicing
When you purchase a service, we process the information necessary to manage and document the transaction, including your name, billing details, applicable tax identification details, purchased service, transaction amount, payment status and payment reference.
We use this information to administer payments, issue invoices, maintain accounting records and meet applicable tax obligations.
Legal basis: Article 6(1)(b), Article 6(1)(c) and, where applicable, Article 6(1)(f) GDPR.
Call bookings, video calls and collaboration tools
Booking a call. If you book a call, the booking is handled by Calendly (Calendly LLC, USA). Calendly processes your name, email address, the selected time and any information you enter.
Video calls. Calls and review sessions take place via Google Meet or Zoom. Depending on the tool, Google Ireland Limited or Zoom Communications, Inc. (USA) process connection data, names and, if shared, screen content. Calls are not recorded without prior agreement.
Email and file sharing. Our business email and file storage run on Google Workspace (Google Ireland Limited). For project work, we may use Notion, Miro and Figma to share and review materials. These providers process the data you share with us as part of the project.
Legal basis: Article 6(1)(b) GDPR where these tools are needed to perform a contract or to take steps towards one and Article 6(1)(f) GDPR for communication with representatives of business clients.
3. Website hosting and analytics
This website is built and hosted using Framer, provided by Framer B.V., based in the Netherlands.
Framer processes technical information necessary to deliver the website and support its operation.
We also use Framer’s built-in analytics to understand overall website usage, including page views, visitor numbers and traffic sources.
According to Framer, its built-in analytics do not use cookies or persistent visitor identifiers. Analytics data is provided in aggregated, anonymised form and is not used by us to identify individual visitors.
This website uses fonts from Google Fonts, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). When you open a page, your browser loads the fonts directly from Google’s servers. Google receives technical data such as your IP address, browser details and the page you visited. Google may also process this data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of data protection. We use Google Fonts to show this website in a consistent and readable way. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a consistent presentation of this website. More information: policies.google.com/privacy
For further information, please refer to:
4. Payment processing through Stripe
Payments for services offered on this website are processed by Stripe Payments Europe, Limited (Ireland), a third-party payment service provider.
When you make a purchase, you may be redirected to a secure Stripe Checkout page to complete your payment.
Stripe may process information such as your name, email address, billing details, payment method information, transaction details, IP address and device information.
We receive the payment and transaction information necessary to administer your order and fulfil our legal and contractual obligations. We do not receive or store your complete payment card number or card security code.
Stripe may process personal data both on our behalf and as an independent data controller for certain purposes, including fraud prevention, payment security and compliance with financial regulations.
For more information about how Stripe processes personal data, please visit:
5. Cookies and similar technologies
This website uses Framer’s built-in analytics, which do not require analytics cookies or persistent tracking identifiers.
Certain technically necessary technologies may be used to provide website functionality, maintain security or enable payment processing.
When you proceed to Stripe Checkout, Stripe may use cookies or similar technologies in accordance with its own privacy and cookie policies.
If additional analytics, advertising or other non-essential tracking technologies are introduced, this Privacy Policy will be updated and consent will be requested where required by law.
6. Who may receive your data?
We may share personal data with trusted service providers and professional advisers where necessary for the purposes described in this Privacy Policy.
These recipients may include:
Framer B.V. (Netherlands), for website hosting and the contact form
Stripe Payments Europe, Limited (Ireland), for payment processing
Google Ireland Limited, for email, video calls, file storage and web fonts
Calendly LLC (USA), for booking calls
Zoom Communications, Inc. (USA), for video calls
Notion Labs, Inc., Miro and Figma, Inc., for project collaboration
Our tax adviser, for accounting and tax obligations
Competent public authorities, where disclosure is legally required
Where service providers process personal data on our behalf, we ensure that appropriate contractual and data protection arrangements are in place as required by applicable law.
We do not sell your personal data.
7. International data transfers
Some service providers or their authorised subprocessors may process personal data outside the European Economic Area (EEA), including in the United States.
This applies in particular to Calendly, Zoom, Notion, Miro and Figma, which are based in the United States or use subprocessors there.
Where personal data is transferred to a country outside the EEA, we rely on applicable safeguards under Chapter V of the GDPR.
These may include European Commission adequacy decisions, the EU–US Data Privacy Framework for certified organisations or the European Commission’s Standard Contractual Clauses, as applicable.
You may contact us to request further information about the safeguards applicable to your personal data.
8. How long do we retain your data?
We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal requirements.
In particular:
General enquiries: Where no contractual relationship follows, correspondence is normally retained for up to 12 months after the last relevant communication.
Client and project records: Information is retained during the contractual relationship and thereafter as necessary to handle outstanding obligations, disputes or potential legal claims.
Accounting and transaction records: Retained for five years from the end of the calendar year in which the tax payment deadline expired, as required by Polish tax and accounting law.
Technical and security data: Information is retained only for the period necessary for website operation, security or troubleshooting, taking account of our service providers’ applicable retention arrangements.
Personal data is deleted or anonymised when it is no longer required, unless continued retention is legally justified.
9. Your rights under the GDPR
Depending on the circumstances and applicable law, you have the right to:
Request access to your personal data
Request correction of inaccurate or incomplete data
Request deletion of your personal data
Request restriction of processing
Object to processing based on legitimate interests
Request data portability where applicable
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing
To exercise your rights, please contact us at contact@dianaszczepanik.com.
We will respond in accordance with the time limits and requirements set out in the GDPR.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
In Poland, the supervisory authority is:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO)
Website: https://uodo.gov.pl
You may also contact the competent supervisory authority in another EU Member State, particularly where you live or work.
Your right to object (Article 21 GDPR)
Where we process your data based on legitimate interests (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing your data unless there are compelling legitimate grounds or the processing is needed for legal claims.
A short email to contact@dianaszczepanik.com is enough.
10. Is providing personal data mandatory?
You are not generally required to provide personal data merely to browse this website.
However, certain information is necessary if you wish to contact us, book a service or enter into a contract.
If you do not provide the information required for these purposes, we may be unable to respond to your request, complete a booking or provide the requested service.
Some billing information must be collected to meet applicable legal and tax obligations.
11. Automated decision-making
We do not use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Our payment provider, Stripe, may use automated systems for payment security and fraud prevention under its own applicable data protection arrangements.
12. Research project participants
This Privacy Policy applies to personal data processed in connection with this website, business enquiries, bookings and customer relationships.
Where personal data is collected during user research projects, interviews, usability studies or other research activities, additional project-specific privacy information may apply.
Such information will be provided in connection with the relevant research activity, as appropriate.
13. Updates to this Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technologies or applicable legal requirements.
The current version will always be available on this website, together with its latest revision date.
14. Contact
If you have any questions about this Privacy Policy or how your personal data is handled, please contact:
Diana Szczepanik (Diana Szczepanik Consulting)
Email: contact@dianaszczepanik.com
Business address: ul. Angorska 21/15, 03-913 Warszawa, Poland
We take privacy-related enquiries seriously and will respond in accordance with applicable data protection law.