Legal document

Privacy policy

Website https://mediasarbi.com · effective from November 1, 2026

1. Data controller and scope of the policy

The controller of your personal data is Maciej Sarbinowski, operating under the name MediaSarbi, ul. Klinkierowa 8/8, 02-237 Warsaw, Poland (the “Controller”).

Contact on personal data matters: e-mail maciej.sarbinowski@gmail.com, the contact form on the Contact page, or the WhatsApp and Signal messengers (number +48 791 425 409) and Messenger.

This policy applies to the website https://mediasarbi.com (the “Website”) and has been prepared in line with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Polish Act of 10 May 2018 on the Protection of Personal Data, the Polish Act of 12 July 2024 – Electronic Communications Law, and the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means.

The Website is a business card site: it does not run online sales, offer user accounts, a newsletter or online payments.

2. What data I process, for what purpose and on what basis

Handling inquiries and correspondence

Data: first and last name, e-mail address, phone number (optional), subject and content of the message sent through the form, by e-mail or by messenger; for messengers also the phone number or account identifier

Purpose: answering the inquiry, presenting an offer, conducting correspondence

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) or Art. 6(1)(f) GDPR (the Controller’s legitimate interest: conducting correspondence)

Period: until the correspondence ends, and if cooperation follows – in line with the rules below

Contract performance and settlements

Data: the client’s identification and contact data, invoice data, the content of arrangements

Purpose: performing the contract, issuing invoices, tax and accounting obligations

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal obligation)

Period: the duration of the contract, then 5 years from the end of the tax year in which the tax obligation arose

Orders for videos made from photos

Data: photos and materials sent to make the film (they may show people), the chosen music and texts, the customer’s contact details

Purpose: making the ordered film and handling corrections

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Period: until the film is delivered and corrections are finished, then up to 30 days, after which the photos are deleted (settlement data: as in the point above)

Note: by sending photos of other people, you confirm that you have the right to use them to make the film

Establishing, pursuing or defending claims

Purpose: the Controller’s legal protection

Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Period: until the claims expire under the statute of limitations

Security and operation of the Website

Data: server log data: IP address, date and time of the connection, address of the requested resource, information about the browser and system

Purpose: ensuring the security and stability of the Website, detecting abuse

Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Period: in line with the hosting provider’s settings, no longer than necessary for security purposes

Managing cookie consents

Data: information about your choice stored in a cookie file

Purpose: documenting and respecting your cookie choice

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR

Period: up to 12 months or until you change your choice

Social media profiles

Data: data that you publish or share when interacting with my profiles (for example comments, messages, reactions)

Purpose: communicating with users and promoting services

Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Period: until the content is deleted or an objection is raised

Note: the platform operators (Meta, Google) are separate controllers and act under their own privacy policies

3. Voluntary provision of data and no profiling

Providing data is voluntary, but necessary to answer an inquiry or to conclude and perform a contract. Without it I cannot contact you. The Controller makes no automated decisions about you and does not use profiling within the meaning of the GDPR.

4. Data recipients

Your data may be entrusted or disclosed only to entities necessary for the operation of the Website and for handling contact:

  • Hosting provider – the company on whose servers the Website runs (storing files, the database and logs),
  • Google – the provider of the Gmail e-mail service, which receives form messages and correspondence,
  • the e-mail delivery (SMTP) service provider, used to deliver form messages to the Controller,
  • messenger providers: WhatsApp and Messenger (Meta Platforms Ireland Limited) and Signal (Signal Messenger LLC) – when you start contact through that channel,
  • Kuula (kuula.co) – a 360° virtual tour service; its content loads only after you click “Start the tour”,
  • YouTube (Google) – the sample video on the “Video from photos” page loads only after you click “Watch the example” (youtube-nocookie.com mode),
  • the provider of the cookie consent management tool (the CookieYes plugin),
  • accounting and IT service providers – to the extent necessary for their services,
  • public authorities and other entities – where an obligation to disclose data results from law.

I do not sell personal data.

5. Transfers of data outside the European Economic Area

The Controller works remotely and is based in the United States (Arizona). Accessing data from there and using Google, Meta and Signal services may involve transferring data to the USA.

Such a transfer takes place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) for certified entities or standard contractual clauses (Art. 45 and 46 GDPR), and in other cases on the basis of Art. 49 GDPR. You can ask for information about the safeguards used by contacting the Controller.

6. Your rights

You have the right to:

  • access your data and obtain a copy of it (Art. 15 GDPR),
  • rectify your data (Art. 16),
  • erase your data (“the right to be forgotten”, Art. 17),
  • restrict processing (Art. 18),
  • data portability (Art. 20) – where I process it on the basis of a contract or consent by automated means,
  • object to processing based on a legitimate interest (Art. 21),
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3)).

To exercise your rights, write to the e-mail address, use the form, or contact me through a messenger. I will reply without undue delay and no later than within one month (Art. 12(3) GDPR).

You also have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the authority in your own country of residence.

7. Cookies

Cookies are small files stored on your device. Under the Polish Electronic Communications Law they require your consent, except for files necessary to provide the service.

  • cookieyes-consent – a first-party file that remembers your cookie choice (up to 12 months); it is necessary for the consent banner to work,
  • WordPress session files – used only by logged-in administrators of the Website, they do not concern visitors.

The Website currently does not use analytics or advertising cookies and does not use tools such as Google Analytics or Meta Pixel. If that changes, I will ask for your consent before enabling them and update this policy.

The Website’s fonts are hosted locally, so by visiting the page you do not send data to Google Fonts servers. The virtual tours on the “Virtual tours” page are embedded from Kuula and start only after you click; only then do your IP address and browser data reach Kuula, and that service may store its own cookies. The Website also contains links to external services (Facebook, Instagram, YouTube, WhatsApp, Signal, Messenger, Oferteo). After clicking, you leave the Website and those services’ rules apply.

You can change your cookie choice at any time using the consent settings icon in the lower left corner of the page or in your browser settings:

  • Google Chrome: chrome://settings/content/cookies
  • Mozilla Firefox: about:preferences#privacy
  • Safari (iOS/macOS): Settings > Safari > Privacy & Security
  • Microsoft Edge: Settings > Cookies and site permissions

Disabling necessary cookies may limit the operation of some features of the Website.

8. Data security

The Controller applies technical and organizational measures appropriate to the risk, in particular an encrypted HTTPS connection, regular software updates, backups and restricted access to the Website’s administration panel.

9. Changes to the policy

I may update the policy, for example when the law or the Website’s features change. The current version is always available on this page. Effective from: November 1, 2026.