LEGAL INFORMATION

PRIVACY & COOKIES
POLICY

Last updated: 7 July 2026

1. General information

This Privacy & Cookies Policy explains how personal data is processed in connection with the website available at:

The Website is a professional portfolio presenting photo retouching services.

Flow Retouch is a portfolio and brand name used by Justyna Malecka and is not a separate legal entity.

The Website does not currently provide a contact form, user accounts, online payments, newsletter registration or direct online ordering. Visitors may contact the Website owner by email.

2. Data Controller

The controller of personal data processed in connection with the Website is:

Justyna Malecka
Flow Retouch
Wrocław, Poland
Email: [email protected]

Questions concerning privacy or the processing of personal data may be sent to the email address above.

3. What personal data may be processed

3.1. Data provided by email

When you contact Flow Retouch by email, the following data may be processed:

your name and surname;
your email address;
your company name or professional details;
the content of your correspondence;
information about your project, deadline and budget;
images, documents and other files attached to your message;
technical metadata associated with your email or attachments;
any other information you voluntarily provide.

Please provide only the information necessary to respond to your inquiry or carry out the requested project.

3.2. Data concerning people shown in photographs

Files sent for quotation or retouching may contain images and other personal data relating to third parties, including models, employees, clients or other photographed persons.

The sender is responsible for ensuring that they are authorised to provide these files and that they have an appropriate legal basis for processing and sharing the images.

Depending on the circumstances and the terms agreed with the client, personal data contained in client-provided images may be processed by Flow Retouch on the client’s instructions and on the client’s behalf.

3.3. Technical data and server logs

When you visit the Website, technical data may be processed automatically by the Website’s infrastructure and service providers. This may include:

IP address;
date and time of the request;
requested page or file;
browser type and version;
operating system and device type;
referring website;
HTTP status code;
information concerning errors, security incidents or attempted abuse.

This information is used primarily to display the Website, maintain its security, diagnose technical problems and prevent abuse.

4. Purposes and legal bases for processing

Personal data may be processed for the following purposes:

4.1. Responding to inquiries

Data provided by email is processed to read and respond to your message, answer questions, discuss a potential project or prepare a quotation.

The legal basis is:

Article 6(1)(b) GDPR where the correspondence concerns steps taken at your request before entering into a contract; or
Article 6(1)(f) GDPR where processing is necessary for the legitimate interest of conducting ordinary correspondence and responding to general inquiries.

4.2. Providing retouching services

Where an agreement is concluded, personal data may be processed to perform the agreement, communicate with the client, receive and deliver files, manage revisions and settle the project.

The legal basis is Article 6(1)(b) GDPR.

4.3. Operating and protecting the Website

Technical data and server logs may be processed to:

make the Website available;
maintain its security and stability;
detect errors;
prevent spam, attacks and other misuse;
establish aggregate technical and traffic statistics.

The legal basis is Article 6(1)(f) GDPR, namely the legitimate interest in maintaining a secure, functional and reliable Website.

4.4. Compliance with legal obligations

Where required, data may be processed to comply with legal, tax, accounting or regulatory obligations.

The legal basis is Article 6(1)(c) GDPR.

4.5. Establishing and defending legal claims

Correspondence, project records and transaction-related information may be retained where necessary to establish, pursue or defend legal claims.

The legal basis is Article 6(1)(f) GDPR.

5. Is providing personal data mandatory?

Providing personal data by email is voluntary.

However, providing at least an email address and sufficient information about your inquiry is necessary to receive a response. Failure to provide the necessary information may make it impossible to answer your message, prepare a quotation or carry out the requested service.

6. Recipients of personal data

Personal data may be disclosed or entrusted to service providers supporting the operation of the Website and email communication, including:

Cloudflare, Inc. and its affiliates, which provide website hosting, content delivery, DNS, network security and related technical services;
SEOHOST Sp. z o.o., which provides email hosting and related server services;
IT service providers and technical support providers;
legal, tax or accounting advisers, where their assistance is necessary;
public authorities, courts or law enforcement bodies where disclosure is required by applicable law.

These entities receive access to personal data only to the extent necessary to provide their services or fulfil legal obligations.

Personal data is not sold to third parties and is not shared with third parties for their independent advertising purposes.

7. Transfers of data outside the European Economic Area

Some services provided by Cloudflare or its subprocessors may involve the processing of data outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, appropriate legal safeguards are used where required, such as:

an adequacy decision issued by the European Commission;
Standard Contractual Clauses approved by the European Commission;
other safeguards permitted under the GDPR.

Further information about safeguards used for international transfers may be requested by contacting the Data Controller.

8. Data retention

Personal data is retained only for as long as necessary for the purpose for which it was collected.

In particular:

correspondence that does not result in a project may be retained for up to 12 months after the last contact;
correspondence relating to a completed project may be retained for the duration of the cooperation and afterwards until the expiry of applicable limitation periods;
documents required by tax, accounting or other laws may be retained for the period required by those laws;
data necessary to establish, pursue or defend claims may be retained until those claims become time-barred or the relevant proceedings are completed;
technical logs are retained in accordance with the configuration and retention periods applied by the relevant hosting and security providers and no longer than necessary for security and technical purposes;
spam, unsolicited marketing and messages that do not require a response may be deleted earlier.

The retention period may be extended where this is necessary due to an ongoing dispute, legal proceeding, investigation or legal obligation.

9. Your rights

Subject to the conditions set out in the GDPR, you may have the right to:

obtain confirmation as to whether your personal data is being processed;
access your personal data;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
receive personal data in a structured, commonly used and machine-readable format;
request the transfer of data to another controller where technically feasible;
object to processing based on a legitimate interest;
lodge a complaint with a data protection supervisory authority.

In Poland, the competent supervisory authority is the President of the Personal Data Protection Office — Prezes Urzędu Ochrony Danych Osobowych (UODO).

Requests concerning personal data may be submitted to:

[email protected]

Before responding to a request, the Data Controller may ask for additional information necessary to verify the identity of the person making the request.

10. Automated decision-making and profiling

Personal data is not used for automated decision-making that produces legal effects or similarly significantly affects Website visitors.

The Website does not use personal data to create advertising or behavioural profiles.

11. Cookies and similar technologies

11.1. Non-essential cookies

At the date of this Policy, the Website does not intentionally use:

advertising cookies;
behavioural profiling cookies;
Meta Pixel;
Google Ads tracking;
Google Analytics;
heatmaps or session-recording tools;
cross-site tracking technologies.

For this reason, the Website does not display a consent banner for advertising or analytics cookies.

11.2. Necessary technical technologies

The Website’s infrastructure providers may use cookies or similar technical mechanisms where strictly necessary to:

provide website content;
protect the Website against attacks and abuse;
maintain network security;
balance network traffic;
detect automated or malicious requests;
ensure the proper operation of the Website.

These technologies are not used by Flow Retouch to display targeted advertising or track visitors across unrelated websites.

Cloudflare may also generate aggregate traffic, performance and security statistics based on traffic passing through its infrastructure. Flow Retouch does not use these statistics to identify individual visitors.

11.3. Browser settings

Most web browsers allow users to review, block or delete cookies through their settings.

Blocking strictly necessary cookies or technical storage may, in some circumstances, affect the proper operation or security of a website.

If advertising, profiling or other non-essential technologies are introduced in the future, this Policy will be updated and an appropriate consent mechanism will be implemented before such technologies are activated.

12. External websites and social media

The Website may contain links to external websites and social media profiles, including Instagram, Behance and LinkedIn.

Clicking an external link takes you to a website operated by another entity. Those entities process personal data in accordance with their own privacy policies and terms.

Flow Retouch is not responsible for the privacy practices, content or security of third-party websites.

The Website currently provides ordinary links to social media profiles and does not intentionally embed social media feeds or tracking widgets.

13. Data security

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

The Website uses encrypted HTTPS communication. Access to email correspondence and project files is limited to authorised persons and service providers where access is necessary.

However, no method of communication or data storage is completely secure. Visitors should avoid sending unnecessary confidential or sensitive information by ordinary email.

Where a project requires the transfer of large, confidential or sensitive files, a separate secure transfer method may be agreed with the client.

14. Changes to this Policy

This Privacy & Cookies Policy may be updated where:

the Website’s functionality changes;
new service providers or technologies are introduced;
the scope of personal data processing changes;
applicable law or regulatory guidance changes.

The current version will always be published on the Website together with its last-updated date.

15. Contact

Questions concerning this Privacy & Cookies Policy or the processing of personal data may be sent to: