Privacy notice

Who is responsible

MONCOL is an independent image-making practice led by Tomek Mąkolski. Tomek Mąkolski, based in Warsaw, Poland, is the controller of personal data processed for this website. For privacy questions or requests, contact tomek@makolski.com.

Visiting the website

The public site does not require an account and has no enquiry forms or online checkout. Cloudflare provides hosting, media delivery and security. Serving and protecting the site involves processing technical request information, which may include an IP address, browser information, requested address and time of access.

Where this information is personal data, processing for delivery, security and troubleshooting relies on our legitimate interest in running a reliable, secure website (Article 6(1)(f) GDPR). Operational records are kept only as needed for these purposes and applicable service retention periods, or longer if needed to investigate a specific incident or meet a legal obligation.

Aggregate analytics

We use Cloudflare Web Analytics to understand visits and page performance. Its measurement script does not use cookies or localStorage and does not fingerprint visitors. Reports show aggregate page views, visits, referring sites, countries and device categories, not a list of identifiable visitors.

Our purpose is to assess and improve the website, not advertising or cross-site profiling. To the extent personal data is processed for this purpose, our GDPR basis is the legitimate interest in understanding the use and performance of the site. This does not remove any separate consent requirement that may apply under communications or device-access rules.

Cloudflare documents seven days of unsampled beacon data, followed by sampled data, with reporting available for the previous six months. See its analytics documentation. We do not maintain a separate visitor-level analytics database.

Cookies and administration

We do not add advertising or remarketing cookies. Cloudflare may use necessary security cookies. The restricted administration area uses Cloudflare Access to authenticate the owner and maintain an authorised session; these cookies are not used for visitor advertising.

Links to Instagram, representation and other external websites take you to services governed by their own privacy notices.

Contacting us

If you contact us by email or telephone, we use the details you provide to respond. This relies on legitimate interests in handling correspondence (Article 6(1)(f) GDPR), or steps at your request before entering a contract (Article 6(1)(b)) where applicable. Providing contact details is voluntary, but we need a way to reply. Correspondence is retained for the enquiry or professional relationship and, where necessary, applicable legal or claims periods. Email and communication providers process the information required to deliver these messages.

Service providers and international processing

Cloudflare and its service providers may process information outside the European Economic Area, including in the United States. Cloudflare sets out its transfer safeguards, including Standard Contractual Clauses and applicable adequacy arrangements, in its Data Processing Addendum. You can contact us for information about safeguards relevant to your data.

Your rights

Where applicable, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to the President of the Personal Data Protection Office in Poland (UODO) or your local supervisory authority.

We do not use visitor data for automated decisions producing legal or similarly significant effects. This notice will be updated when the website or its processing changes.