Privacy policy

Effective 6 October 2026

Who is responsible

Boris Polsek is responsible for personal data processed through borispolsek.com. He operates Studio Boris Polsek as a sole proprietor, registered with KvK as Polsek. Address: Monitorweg 40, 1322 BJ Almere, Netherlands. KvK 68326238. VAT NL002337838B92. For privacy questions or requests, email studio@borispolsek.com.

Website visits

The site's images, styles and font are served from our hosting. We do not use analytics, advertising trackers, a newsletter, customer accounts or non-essential cookies on these pages. Hosting and security systems may process technical data such as IP addresses, request times and error information to serve the site and protect it. The legal basis is our legitimate interest in a reliable, secure website.

The inquiry form keeps an anonymous submission key in your browser's session storage so a retry does not create another inquiry. It is not used for tracking. An empty hidden field helps reject automated spam. The gateway also limits repeated requests using IP addresses temporarily in memory.

Business inquiries

The Trade form asks for your name, company, email, country, approximate quantity and message. These fields are required to submit the form. If you prefer not to use it, you may email us instead. Please do not include payment-card details, identity documents or sensitive personal information in your message.

We store accepted inquiries and their submission and notification status in our website database. A copy is emailed to studio@borispolsek.com through Hostinger Email. A private Telegram announcement tells the owner that an inquiry was stored and gives its reference and email-notification status; it does not include your name, email address or message. The form's success message means that your inquiry has been stored, not that every notification has already arrived.

We use inquiries to reply, prepare quotations and discuss your project. The legal basis is taking steps at your request before a contract when you act personally, or our legitimate interest in responding to a business representative and maintaining business correspondence. We do not add form submissions to a marketing list or sell them.

Stripe checkout and orders

Selecting Purchase takes you to Stripe's hosted checkout. Stripe collects information needed for payment, billing, shipping, tax calculation and fraud prevention, such as your email, address, payment details and, where relevant, tax identification. Stripe may process checkout information even if you do not finish the purchase. Stripe's checkout has its own cookies, storage and privacy settings; see https://stripe.com/privacy.

We receive the information needed to fulfil and support your order, including customer contact and delivery details, purchased items, payment status and transaction references. Paid orders and notification status are stored in our website database. Order details are emailed to studio@borispolsek.com. A private Telegram announcement contains only the order reference and email-notification status, not customer contact details or the shipping address. We do not receive or store your full payment-card number or security code on this website. The legal bases are performing the contract, complying with tax and accounting obligations, and our legitimate interest in preventing fraud and resolving disputes.

Necessary delivery information is shared with the carrier and, where required, customs authorities. Order and payment records may also be shared with an accountant, professional adviser or public authority when necessary.

Service providers and international processing

Our email provider is Hostinger. The website and its database run on our existing hosting server. Stripe handles checkout and payment. Telegram carries the owner's private inquiry and order announcements. These providers process data under their own applicable terms and privacy notices as well as any relevant service agreements. We limit access to business purposes; data is not used by us for advertising or sold to third parties.

Provider operations can involve processing outside the European Economic Area. Where EU data-protection law requires it, international transfers must rely on an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. You can contact us for information about the safeguards applicable to your data. Provider privacy information is available at https://www.hostinger.com/legal/privacy-policy, https://stripe.com/privacy and https://telegram.org/privacy. We do not claim that Telegram announcements are end-to-end encrypted.

Retention

We retain ordinary inquiries and related correspondence while the discussion is active and, as our retention policy, for up to 2 years after the last substantive contact. Records that become part of an order, an ongoing agreement or a dispute may need to be kept longer. Tax and accounting records are generally retained for 7 years where Dutch law requires this.

Technical and notification records are kept only as needed for security, troubleshooting, delivery reconciliation and legal obligations. Retention is reviewed manually; deletion is not immediate or automated. Protected backups may retain a copy until they are replaced or removed, and are used for recovery rather than ordinary correspondence. If a backup is restored, applicable deletion requests must be reapplied.

Your rights

Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction of processing, and a portable copy where that right applies. You may object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. We do not use the form or checkout for automated decisions with legal or similarly significant effects made by us.

Email studio@borispolsek.com to exercise your rights. We may need proportionate information to verify your identity. We normally respond within one month; if the law permits an extension, we will explain it. You may complain to the Dutch Autoriteit Persoonsgegevens at https://autoriteitpersoonsgegevens.nl or to another competent supervisory authority.

Changes

We may update this policy when the website or our processing changes. The effective date above identifies this version.