Last updated: 6 October 2026
1. Controller and contact
This policy explains how personal data is processed when you visit https://aiyavision.com or contact AiYa Vision.
The controller is Yanina Balan, operating under the business name AiYa Vision in Poland.
Business correspondence address: ul. Bronowicka 61, Kraków, Poland. NIP: 6772503224.
Privacy contact: studio@aiyavision.com.
2. Information we process
Contact enquiries: the name or company name, email address, service type and message you submit, together with any other information you voluntarily provide in subsequent correspondence. Please avoid providing sensitive information or unnecessary information about other people.
Website operation: technical information processed by our infrastructure, such as IP addresses, requested pages, timestamps and browser/device information, to the extent recorded by the service configuration.
Web fonts: our pages load fonts from Google Fonts (Google). When fonts load, your browser connects to Google servers, which receive your IP address and browser information.
Consent choices: the preference information needed to remember your decision (category choices, policy version and time of choice).
We do not currently use analytics or advertising tracking tools on this website.
3. Purposes and legal bases
We respond to general enquiries based on our legitimate interest in communicating with people interested in our services (Article 6(1)(f) GDPR).
Where you ask us to take steps towards a contract with you, we process necessary information under Article 6(1)(b) GDPR. When you represent a company, we rely on our legitimate interest in managing business relationships for your professional contact information (Article 6(1)(f) GDPR).
Website operation, troubleshooting and proportionate security measures are based on our legitimate interest in maintaining a functioning, secure website (Article 6(1)(f) GDPR).
Any future optional analytics or advertising processing will be based on your consent (Article 6(1)(a) GDPR), with consent for access to or storage on your device obtained where required by Polish electronic communications law.
We process minimal consent evidence to meet our accountability obligations, and information necessary to handle rights requests to comply with applicable legal obligations (Article 6(1)(c) GDPR). Necessary processing to establish, exercise or defend legal claims is based on our legitimate interest in protecting our rights (Article 6(1)(f) GDPR).
Sending an enquiry does not subscribe you to a newsletter or authorise unrelated promotional emails.
4. Voluntary provision
Providing contact information is voluntary. We need the required fields and a means of contacting you to handle your enquiry; without them we may be unable to respond. Optional cookies are not required to browse the site or use the contact form.
5. Cookies and choices
We use only technologies necessary for essential functionality and for remembering your preferences. These are used without consent because they are needed to provide the service you request.
Optional Analytics and Advertising categories are off by default and are currently not in use. You can accept, reject or customise categories through our banner and change or withdraw your choice at any time via . Withdrawal does not affect the lawfulness of processing before withdrawal.
| Name | Type / provider | Category | Purpose | Duration |
|---|---|---|---|---|
| aiya_consent | localStorage · AiYa Vision (first party) | Strictly necessary | Remembers your cookie choice, policy version and the time of the choice. | 180 days, then you are asked again |
| aiya-locale | localStorage · AiYa Vision (first party) | Strictly necessary | Remembers the language you selected (EN / PL). | Until you clear browser storage |
6. Recipients
Authorised personnel and providers receive information only where needed for the purposes described above. Recipient categories include website hosting, form storage and email delivery services, and web font delivery.
Our main provider is Lovable (Lovable Cloud), which operates the website hosting, the secure database that stores form submissions, and the delivery of notification emails. Google Fonts is used for web fonts. Providers processing data on our behalf are subject to applicable data-processing arrangements.
Information may also be disclosed to competent authorities where required by law and to professional advisers where necessary for legal advice or claims.
7. Transfers outside the EEA
Based on our current setup, we do not transfer personal data to countries outside the EEA: the website, the database that stores form submissions and email delivery run on Lovable Cloud infrastructure in the European Union.
Google Fonts connects your browser to Google's font servers; Google's own infrastructure and safeguards are described in Google's privacy policy. If we ever add a provider that processes data outside the EEA, we will update this section and apply appropriate safeguards such as an adequacy decision or Standard Contractual Clauses. You can contact us for information about the applicable safeguards.
8. Retention
Contact enquiries: up to 12 months from your last message, unless the enquiry leads to a client relationship.
Correspondence leading to a client relationship: as necessary for that relationship and thereafter for applicable legal obligations and claims within the relevant limitation periods.
Technical and security logs: up to 6 months.
Consent preferences: stored in your browser for up to 180 days, or until you change them or clear browser storage.
Backups: automatic deletion within 30 days, consistent with the hosting platform's backup practices.
We delete or anonymise information once it is no longer necessary for the relevant purpose.
9. Your rights
Subject to applicable GDPR conditions, you can request access and a copy, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing, including related profiling.
You can withdraw consent at any time without affecting processing lawfully carried out before withdrawal.
Contact studio@aiyavision.com to exercise your rights. We normally respond within one month. If permitted because of complexity or the number of requests, we may extend this by up to two further months and will explain the extension within the initial month. We may request proportionate information to verify identity where necessary.
You can complain to the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), https://uodo.gov.pl, or the competent supervisory authority in the EU country of your habitual residence, workplace or the alleged infringement.
10. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.
11. Updates
We update this policy when relevant practices change. Material changes to processing are explained before they take effect where required, and fresh consent is obtained where necessary. The publication date identifies the latest version.