Privacy Policy
Last updated: 20 October 2026
This policy explains how personal data is handled when you visit mlstudio.pro, contact ML Studio or use the Photo and Design sections. It applies regardless of the language of the site or the device you use.
1. General information
This website presents the design and photography work of ML Studio Michał Laskowski. The data involved depends on whether you browse the site, send a message or choose to enable optional analytics.
You do not need an account or Google Analytics consent to view the portfolio. Rejecting analytics does not restrict access to the site’s content.
2. Controller and contact details
The data controller is Michał Laskowski, a sole trader operating as ML Studio Michał Laskowski, ul. Ulanowskiego 2/4/3, 53-144 Wrocław, Poland, Polish Tax Identification Number (NIP): 8993030771.
For privacy enquiries or to exercise your data rights, email kontakt@mlstudio.pro or write to the postal address above.
3. Data that may be processed
Correspondence: your email address, name, message and any other details you voluntarily provide about your enquiry, such as a telephone number, company name or information about a planned assignment. Please avoid sending information that is not needed to explain your request.
Website operation: connection-related technical information, such as an IP address, request time, page address, device type, browser and error information. If you allow Google Analytics, this also includes cookie identifiers, traffic-source information and interactions with the website.
4. Purposes and legal bases
Replying to messages and discussing work: Article 6(1)(f) GDPR — the legitimate interest in handling enquiries and correspondence. Where you request steps towards a contract with you, Article 6(1)(b) GDPR may also apply to those pre-contractual steps.
Maintaining and protecting the site, and establishing, pursuing or defending claims: Article 6(1)(f) GDPR. Legal obligations connected with a contract or billing: Article 6(1)(c) GDPR, to the extent required by applicable law.
Optional Google Analytics: Article 6(1)(a) GDPR — consent. Optional analytics cookies are stored and accessed only with prior consent under the Polish Electronic Communications Law.
5. Providing data is voluntary
You provide correspondence details voluntarily. Without a reply address or the information needed to understand a request, it may not be possible to handle it. Data needed for a particular contract is established separately.
Analytics consent is optional, is not a condition of contact or cooperation, and can be withdrawn without giving a reason.
6. Retention periods
Correspondence is kept for the time needed to handle the matter and conclude the discussion. If this leads to work together, further retention depends on performance of the contract, documentation obligations and applicable limitation periods for claims. Information no longer needed for these purposes should be deleted.
Technical information and logs are kept for as long as required to operate and protect the infrastructure, in accordance with hosting-provider policies. Your browser’s consent choice expires after 180 days. Analytics cookies are configured to last no longer than 180 days without renewing their expiry on each visit.
Cookie expiry is not the same as retention on Google’s servers. In GA4, event-level and user-level data retention is set to 14 months. Reset on new user activity is enabled: each new event from a user restarts the retention period for their identifier. This mechanism applies to user-level data; it does not renew the retention period for all historical events. Standard aggregated reports are not subject to these retention settings and may be kept longer.
7. Data recipients
Data may be available to providers needed for the website and communications: Framer B.V., which supplies the website platform and hosting, the email provider, and IT and security service providers. Where necessary, recipients may also include authorised advisers or public authorities acting under the law.
If you accept analytics, recipients also include the Google Analytics provider, Google Ireland Limited, and entities involved in delivering that service. Providers’ processing is governed by the relevant agreements and data-protection terms.
8. Transfers outside the EEA
Technology providers may use infrastructure and subprocessors outside the European Economic Area, including in the United States. Safeguards may include European Commission adequacy decisions or Standard Contractual Clauses, depending on the provider and transfer.
You can contact the controller for information about safeguards and how to obtain a copy. Google explains its own transfer arrangements in the information linked below.
9. Server logs and Framer statistics
Viewing the site requires requests to the hosting infrastructure. Connection information may be used to deliver content, diagnose failures and protect against misuse.
Separately from Google Analytics, the platform provides aggregated Framer Analytics statistics which, according to Framer, do not use cookies to measure visits. This site’s consent panel controls the optional Google Analytics tag, not the hosting infrastructure.
10. Cookies, local storage and Google Analytics
Your analytics choice and decision date are stored in localStorage as mlstudio-consent-v1 for 180 days. The choice is shared across Photo, Design, Polish and English in the same browser and domain. If local storage is blocked, the choice may last only until the document reloads. The light or dark theme preference may be saved as ml-photo-theme until you change it or clear browser storage.
Google Analytics 4, measurement ID G-RCVGTRSE0J, starts only when you select “Accept” or have a valid earlier consent. Basic consent mode is used: the Google tag is not loaded before consent or after rejection. Google signals and advertising personalisation are disabled.
After consent, the service may set _ga and _ga_RCVGTRSE0J cookies to distinguish visits and measure use of the site. They are configured to expire within 180 days of creation, without renewal on each visit. Your browser may shorten that period.
Select “Reject” in the panel, or reopen it with the cookie button in the bottom-left corner. Withdrawal blocks further measurement and removes accessible Analytics cookies on this site’s domain. It does not automatically erase previously collected data or affect the lawfulness of earlier processing. You can also manage cookies and local storage in your browser.
11. Your rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure or restriction of processing and, where applicable, portability. You may object to processing based on legitimate interests and withdraw consent at any time.
Send requests to kontakt@mlstudio.pro. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
12. Automated decisions
The website tools described here are not used to make decisions about visitors based solely on automated processing that have legal or similarly significant effects. The Google Analytics configuration does not include advertising personalisation.
13. Security
Protecting data requires measures appropriate to the information and risk, including access controls and secure communications. Do not send identity documents, passwords or other sensitive information in ordinary email unless necessary and a secure method of transfer has been agreed.
14. External websites
Links, including those to Instagram, LinkedIn or project websites, take you to external services. Their operators’ policies apply when you visit them. This policy covers mlstudio.pro and does not replace information provided by other services.
15. Policy updates
This text may be updated when the site, its tools or legal requirements change. The current version is available at this address and through the privacy panel. The date at the top shows the latest update. The Polish and English versions describe the same practices.