Privacy Policy

Last updated: 21 April 2026

1. General information

This Privacy Policy sets out the rules for processing the personal data of users of the website available at https://sophie-foodstories.com (the “Website”), operated under the Sophie Foodstories brand — a photography studio specialising in food and product photography, with operational base in Wrocław, Poland.

Use of the Website means acceptance of the principles described in this document. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

2. Data controller

The controller of your personal data within the meaning of Article 4(7) of the GDPR is:

Fundacja Rozwoju Przedsiębiorczości „Twój StartUp” (Foundation for Entrepreneurship Development “Your StartUp”) ul. Żurawia 6/12 lok. 766 00-503 Warszawa, Poland Polish VAT ID: PL5213641211 KRS: 0000442857

This policy applies to services provided within an organisationally separated part of the Foundation’s enterprise under the Sophie Foodstories brand, operated by a beneficiary of the Foundation.

Contact for data protection matters

For questions regarding personal data protection, to exercise the rights described in section 9 of this Policy, or in any case concerning the processing of your data, please contact us:

• Foundation contact (Controller): rodo@twojstartup.pl
• Beneficiary contact (Sophie Foodstories): sophie.foodstories@gmail.com

3. Categories of data collected

The following categories of personal data are processed when you use the Website:

3.1. Data voluntarily provided via the contact form:

• first name and surname,
• email address,
• phone number (optional),
• content of the message and any information contained therein,
• type of service the inquiry concerns (e.g. food photography, product photography, interior photography),
• company or brand name (optional, for business inquiries).

3.2. Data collected automatically while you use the Website:

• IP address,
• browser type and version,
• operating system of your device,
• screen resolution,
• device type (desktop, tablet, smartphone),
• referring page (referrer),
• pages of the Website visited and time spent on each,
• browser language,
• approximate geographic location based on IP address (country/city level).

3.3. Data on interactions with marketing content:

• link clicks, form submissions, acquisition source (e.g. organic Google results, Pinterest, Instagram, Google Ads campaigns).

4. Purposes and legal bases of processing

Your personal data is processed for the following purposes:

4.1. Responding to inquiries submitted via the contact form

• Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (legitimate interest of the Controller in handling correspondence directed to the Website).

4.2. Conclusion and performance of a photography services contract

• Legal basis: Article 6(1)(b) GDPR.

4.3. Issuing invoices and keeping accounting records

• Legal basis: Article 6(1)(c) GDPR in connection with the Polish Accounting Act of 29 September 1994 and the VAT Act of 11 March 2004.

4.4. Website statistics and user behaviour analysis

• Legal basis: Article 6(1)(a) GDPR (consent given via the cookie banner).

4.5. Direct marketing and remarketing

• Legal basis: Article 6(1)(a) GDPR (user consent given via the cookie banner).

4.6. Publication of images of persons and objects captured in portfolio photographs, social media, and promotional materials of the Website

• Legal basis: Article 6(1)(a) GDPR (consent of the person whose image is used) or Article 81(2) of the Polish Act of 4 February 1994 on Copyright and Related Rights (consent is not required for persons appearing merely as a detail of a larger whole, such as a venue interior, event scene, landscape, or public gathering), or a contract transferring image rights concluded with the client commissioning the photo session.

4.7. Establishing, pursuing, or defending legal claims

• Legal basis: Article 6(1)(f) GDPR (legitimate interest of the Controller).

5. Retention periods

Your personal data is retained for the following periods:

• Contact form data without subsequent contractual relationship: up to 12 months from the date of the last message.
• Data of clients with whom a service contract has been concluded: for the duration of the contract and for 6 years from the end of the calendar year in which the contract was performed (limitation period for claims and the statutory obligation to retain accounting documentation under the Polish Accounting Act).
• Data from analytical and marketing cookies: in accordance with the retention periods set by the tool providers (Google Analytics 4 — default 14 months; Meta Pixel — up to 90 days for behavioural data, up to 180 days for conversion data, unless the user withdraws consent earlier).
• Photographs containing the image of clients or third parties published in the Website portfolio: for the duration of Sophie Foodstories’ business activity or until the person whose image is used withdraws consent, subject to section 4.6 of this Policy.

6. Recipients of data

Your data may be shared with the following categories of recipients:

• Fundacja Rozwoju Przedsiębiorczości „Twój StartUp” — to the extent necessary for invoicing, accounting, and fulfilling legal obligations.
• Hosting and technical infrastructure providers — the Website server and database.
• Analytics and marketing service providers:
• Google Ireland Limited (Google Analytics 4, Google Ads, Google Search Console),
• Meta Platforms Ireland Limited (Meta Pixel, Facebook, Instagram),
• Pinterest Europe Ltd.
• Accounting offices and tax advisors servicing the Foundation.
• Public authorities — upon a legally binding request.
• Law firms — if necessary to pursue or defend legal claims.

Some recipients (Google, Meta, Pinterest) may process data outside the European Economic Area, in particular in the United States. Such transfers are carried out on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate protection of personal data under the EU–US Data Privacy Framework, or on the basis of Standard Contractual Clauses (SCC) approved by the European Commission.

7. Cookies and analytical tools

The Website uses cookies — small text files stored on the user’s end device. Cookies are divided into:

7.1. Necessary cookies (technical) — enable the proper functioning of the Website, including language handling (PL/EN via the Polylang plugin), remembering consent preferences, and user session management. They do not require user consent.

7.2. Analytical cookies — used to collect statistics on Website visits and analyse user behaviour. The Website uses:

• Google Analytics 4 (provider: Google Ireland Limited) — measures number of visits, traffic sources, popularity of subpages, and conversion paths.

7.3. Marketing cookies — used to display tailored advertisements to users in advertising networks. The Website uses:

• Meta Pixel (provider: Meta Platforms Ireland Limited) — enables remarketing on Facebook and Instagram, and measurement of conversions from Meta ads.
• Google Ads (provider: Google Ireland Limited) — enables remarketing on the Google Display Network and measurement of campaign conversions.
• Pinterest Tag (provider: Pinterest Europe Ltd.) — measures conversions from Pinterest-originated traffic.

Analytical and marketing cookies are loaded only after the user has given consent via the cookie banner displayed on the first visit to the Website. The user may change or withdraw cookie preferences at any time via the “Cookie settings” link available in the Website footer.

The user may also manage cookies directly in the settings of their web browser. Detailed instructions are available in the documentation of each browser (Chrome, Firefox, Safari, Edge).

8. Data security

The Controller applies technical and organisational measures ensuring the protection of processed personal data appropriate to the threats and categories of data concerned, in particular:

• encryption of data transmission using the HTTPS protocol (SSL certificate),
• regular updates of server software, plugins, and the content management system (WordPress),
• restriction of access to the administrative panel through strong passwords and multi-factor authentication where possible,
• regular data backups,
• cooperation with hosting providers applying adequate security standards.

9. Rights of data subjects

In connection with the processing of personal data, you have the following rights:

• Right of access (Article 15 GDPR) — to obtain confirmation as to whether your data is being processed and to obtain a copy of the processed data.
• Right to rectification (Article 16 GDPR) — to request the correction of inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR) — the “right to be forgotten”, if the data is no longer necessary for the purposes for which it was collected or if you withdraw consent and there is no other legal basis for processing.
• Right to restriction of processing (Article 18 GDPR).
• Right to data portability (Article 20 GDPR) — to the extent the data is processed on the basis of consent or a contract.
• Right to object (Article 21 GDPR) — to the processing of data based on the legitimate interest of the Controller.
• Right to withdraw consent at any time (Article 7(3) GDPR) — without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint with a supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl.

Rights may be exercised by contacting the Controller at rodo@twojstartup.pl or the beneficiary at sophie.foodstories@gmail.com.

10. Automated decision-making and profiling

Your personal data is not subject to automated decision-making that produces legal effects concerning you or similarly significantly affects you. Data used in marketing tools (Meta Pixel, Google Ads, Pinterest Tag) may be used for profiling for advertising purposes — in this respect, the user has the right to object.

11. Portfolio, image rights, and copyright in photographs

Sophie Foodstories maintains a publicly accessible photography portfolio on the Website and on social media (Instagram, Pinterest). Photographs in the portfolio may depict persons, products, interiors, and brands of Sophie Foodstories’ clients.

Publication of photographs is carried out on one of the following grounds:

• written or documented consent of the person whose image has been captured, given before or during the photo session,
• provisions of the photography services contract concluded with the client commissioning the session, governing mutual rights to the use of the material,
• Article 81(2) of the Polish Act on Copyright and Related Rights, if the person appears merely as a detail of a larger whole (e.g. a venue interior, event scene).

A person whose image has been published on the Website may at any time request the removal of a specific photograph by contacting sophie.foodstories@gmail.com. The request will be handled in accordance with applicable law and the terms of any binding contract with the client who commissioned the session.

All photographs published on the Website are subject to the copyright of their author. Copying, reproduction, distribution, or commercial use of the photographs without the written consent of the author is prohibited.

12. Links to external services

The Website contains links to external websites, including social media profiles (Instagram, Pinterest, Facebook) and the websites of clients for whom photo sessions have been produced. The Controller is not responsible for the privacy policies in force on those external websites. We recommend that you familiarise yourself with the personal data protection rules of every service you use.

13. Changes to this Privacy Policy

This Privacy Policy may be amended in connection with changes in legislation, developments in the technologies used on the Website, or changes to the services provided. The current version of the Policy is always available at https://sophie-foodstories.com/en/privacy-policy/. The date of the last update is displayed at the top of the document.

14. Final provisions

In matters not regulated by this Privacy Policy, generally applicable legal provisions shall apply, in particular the GDPR, the Polish Personal Data Protection Act, the Polish Act on the Provision of Services by Electronic Means, and the Polish Telecommunications Law.