Privacy Policy
Last updated: 12 February 2026
1. Data Controller
The controller of your personal data is Orpheus Studio, located at ul. Mazowiecka 24/3, 30-036 Kraków, Poland.
For any privacy-related inquiries, please contact us at hello@orpheusdigital.studio.
2. Data We Collect
Contact Form
When you submit our contact form, we collect:
- Your name
- Email address
- Company name (optional)
- Your message
Newsletter
When you subscribe to our newsletter, we collect:
- Email address
- Subscription source (which page you signed up from)
- Confirmation timestamp
We use a double opt-in process: after signing up, you'll receive a confirmation email. Your email is added to our mailing list only after you click the confirmation link.
Performance Analytics
We use Vercel SpeedInsights to collect anonymous performance metrics (page load times, web vitals). This service does not use cookies, does not track individual users, and does not collect personal data.
Web Analytics
We use Vercel Web Analytics to understand how visitors interact with our website. This service collects anonymous, aggregated data including:
- Pages visited and navigation paths
- Referrer URLs (where you came from)
- Country and region (from IP, not stored)
- Device type, browser, and operating system
- Custom interaction events (e.g., which buttons are clicked)
This service is cookie-free — it does not use cookies, local storage, or any form of persistent tracking. Visitor sessions are identified using a non-reversible hash that expires after 24 hours. No personal data is collected or stored.
Google Analytics 4 (Cookieless)
We use Google Analytics 4 in cookieless mode via Google Consent Mode v2. This means:
- No analytics cookies are set on your device
- Only anonymous, aggregated data is collected (cookieless pings)
- Google uses behavioral modeling to fill in data gaps
- No personally identifiable information (PII) is collected or transmitted
All data storage consents (analytics_storage, ad_storage) are set to denied by default, preventing any tracking cookies from being set.
Cookies
This website does not use tracking cookies or advertising cookies. Only essential technical cookies may be used for site functionality.
3. Purpose & Legal Basis
| Purpose | Legal Basis (GDPR) | Retention |
|---|---|---|
| Responding to your inquiry | Legitimate interest (Art. 6(1)(f)) | 3 years |
| Executing a contract | Contract performance (Art. 6(1)(b)) | Duration of contract + 5 years |
| Invoicing & tax obligations | Legal obligation (Art. 6(1)(c)) | 10 years (Polish tax law) |
| Newsletter | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
| Site performance & usage analytics | Legitimate interest (Art. 6(1)(f)) | Aggregated / anonymous |
4. Data Recipients
Your data may be shared with:
- Vercel Inc. (USA) — website hosting and performance analytics, operating under the EU–US Data Privacy Framework
- Google Workspace — email communication, operating under Standard Contractual Clauses
- Resend Inc. (USA) — transactional email delivery for contact form and newsletter management
- Google LLC (USA) — cookieless web analytics (Google Analytics 4 with Consent Mode v2), operating under the EU–US Data Privacy Framework
We do not sell, rent, or share your personal data with any third parties for marketing purposes.
5. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA). Where personal data is transferred to countries without an adequacy decision, we ensure appropriate safeguards through Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework.
6. Your Rights
Under the GDPR, you have the right to:
- Access — request a copy of your personal data (Art. 15)
- Rectification — correct inaccurate data (Art. 16)
- Erasure — request deletion of your data (Art. 17)
- Restriction — limit how we process your data (Art. 18)
- Portability — receive your data in a structured format (Art. 20)
- Object — object to processing based on legitimate interest (Art. 21)
- Withdraw consent — at any time, without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at hello@orpheusdigital.studio. We will respond within 30 days.
7. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Polish Data Protection Authority:
Prezes Urzędu Ochrony Danych Osobowych (PUODO)ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl
8. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.