Privacy Policy.

I am an independent freelance 2D illustrator operating as a sole trader. I am the data controller for any personal data collected through this website and during project work. Contact: szalka.p@inbox.eu.

I collect only the information needed to respond to enquiries and deliver projects: your name, email address, company name (if any), and the content of any brief, reference material or correspondence you send me. When you pay an invoice, my payment processor collects billing details on my behalf; I never store full card numbers.

Your information is used solely to: (a) respond to your enquiry, (b) prepare a quote, (c) deliver the agreed project, (d) issue invoices and meet my accounting obligations, and (e) keep you informed about your active project. I do not sell, rent or trade your information to third parties.

I process your data under the legal bases of (a) contract performance (to deliver work you have requested), (b) legitimate business interest (responding to enquiries, keeping records of completed work), and (c) legal obligation (tax and accounting records).

I rely on a small number of trusted service providers: an email provider (to receive your messages), a payment processor (to issue invoices), and an accountant (for tax reporting). Each is bound by their own privacy and security obligations.

Enquiry emails that do not lead to a booking are deleted within 12 months. Records relating to invoiced projects are kept for the period required by applicable tax law (typically 7 years). Reference files supplied for a project are deleted within 6 months of final delivery unless you request otherwise.

You have the right to access, correct, export or request deletion of the personal data I hold about you, and to object to or restrict its processing. To exercise any of these rights, email szalka.p@inbox.eu. You also have the right to lodge a complaint with your local data protection authority.

I use reputable email, storage and payment providers with industry-standard security. Files are kept on encrypted devices and shared via password-protected links where appropriate.

Some service providers are based outside the European Economic Area. Where this is the case, they operate under standard contractual clauses or equivalent safeguards.

I may update this policy from time to time. The current version always lives at this URL with a “Last updated” date at the top.