Privacy Policy

How can I

contact you

about

personal data?

If you would like to contact us about the processing of your personal data, you can do so:

1. by email: This email address is being protected from spambots. You need JavaScript enabled to view it.

2. in writing – by post to:

Anna Lipiak – Pianist, Pod Kasztanem 84B, 43-344 Bielsko-Biała, Poland

We process your personal data:

• when you place an order and when we fulfill it,

• in connection with providing digital products, electronic materials, training, webinars or other online content,

• when delivering goods (physical products),

• when handling payments, complaints, returns or order-related requests,

• when you contact the Controller via a contact form, email, phone or social media,

• when you sign up for the newsletter or give marketing consents,

• in connection with participation in contests, promotions, partner programs or events organized by the Controller,

• when you publish reviews or comments on products or services,

• when you book or attend online meetings or consultations (e.g. the Piano Playing Audit) held via Zoom or Google Meet,

• in connection with your use of the website and its functions, including through cookies and similar technologies,

• for analytical, statistical and marketing purposes and to improve the quality of our services,

• to ensure website security, prevent abuse, detect unauthorized activity and protect against breaches of the terms or attempts to circumvent the protection of digital products,

• to establish, pursue or defend claims,

• to comply with legal obligations, in particular tax, accounting and consumer protection obligations.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

We may also process personal data to market our own products and services, including on social media platforms, through targeted advertising on social media, the newsletter, remarketing, marketing automation, audience segmentation and matching advertising content to the user's interests — only to the extent permitted by applicable law and on the basis of consent.

Providing personal data is voluntary, but in some cases it may be necessary in order to use certain services or functions offered by the Controller.

Providing data is not mandatory; however, failure to provide the required data may result in:

• the inability to conclude or perform a contract,

• the inability to fulfill an order,

• no access to a digital product, training or user account,

• the inability to receive the newsletter or marketing information,

• the inability to reply to your inquiry or handle your request.

When placing an order or concluding a contract, providing the data marked as mandatory is necessary to perform the contract and to comply with legal obligations, in particular tax and accounting obligations.

Providing data for marketing purposes, including to receive the newsletter, educational materials, commercial offers or information about promotions, is voluntary and based on the user's consent.

The user may withdraw consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

What data

do you process?

The scope of personal data processed depends on the purpose of processing and on the type of service, function or user activity.

Fulfilling orders and providing services

To conclude and perform the contract, fulfill the order, provide digital products, deliver physical products, handle payments, issue accounting documents and contact the user, the Controller processes:

• first and last name,

• email address,

• phone number,

• home or correspondence address,

• invoicing data, including company name, tax ID and business address,

• information about orders, payments and purchase history,

• data on the use of the digital product, physical product or service, including assigned access rights, login history, download history and information about the user's activity on the platform.

Contact and handling of requests

When you contact the Controller, the Controller may process:

• first and last name,

• email address,

• phone number,

• data contained in the message, form or request,

• information about previous communication,

• data related to a complaint, return or technical request.

Online meetings and consultations

When you book or attend an online meeting, lesson or consultation (e.g. the Piano Playing Audit), the Controller may process: first and last name, email address, the date and time of the meeting, information provided when booking, your image and voice during the video call and – if you choose to share them – recordings of your playing or sheet music. Meetings are not recorded without prior notice and, where required, without the participants' consent.

Newsletter and marketing

For marketing purposes, including targeted advertising on social media, sending the newsletter, educational materials, commercial information or content tailored to the user's interests, the Controller may process:

• first name,

• email address,

• phone number,

• information about marketing activity, including email opens, link clicks, user preferences, sign-up history and consents given,

• data on the source of the contact or interest in particular content,

• information on marketing segmentation and campaign effectiveness.

Contests, promotions and events

When you take part in contests, webinars, training, online events or promotions, the Controller may process:

• first and last name,

• email address,

• phone number,

• data needed to organize the event or hand over a prize,

• information on participation, activity or registration,

• data related to issuing a certificate, attendance list or settling the event.

Reviews, comments and content published by the user, and handling of content reports

When you publish reviews, comments or other content, the Controller processes:

• first name or pseudonym,

• email address,

• the content of the review, comment or message,

• information on the date of publication and the user's activity,

• image or company name — if the user voluntarily shares such data.

Partner programs and affiliate cooperation

When you participate in partner or affiliate programs, the Controller processes:

• identification and contact data,

• settlement data,

• bank account number,

• information on referrals, commissions, affiliate activity and the effectiveness of partner activities.

Social media

When you contact the Controller via social media or follow the Controller's profiles, the following are processed:

• username,

• first and last name,

• image,

• content of messages, comments or reactions,

• information publicly available in the user's profile.

Use of the website, cookies and analytics

In connection with your use of the website, the Controller processes:

• IP address,

• device identifiers,

• browser type and operating system,

• approximate location,

• referral source,

• user activity on the website,

• time spent on the website,

• information about clicks and how the website's functions are used,

• information stored in cookies or similar technologies.

These data may be used to ensure that the website works properly, compile statistics, analyze traffic, conduct marketing and remarketing, and improve the security of services.

Security and abuse prevention

To ensure the security of the website, digital products and systems, the Controller processes:

• IP address,

• information about the user's devices and sessions,

• data on activity that may indicate a breach of the terms, an attempt to circumvent security or unauthorized access,

• technical information related to detecting abuse and protecting the IT infrastructure.

Complaints, withdrawal from the contract, claims and legal obligations

To handle complaints, establish, pursue or defend claims and comply with legal obligations, the Controller processes:

• identification and contact data,

• order and payment data,

• communication history,

• information related to the request, complaint, withdrawal or dispute,

• data required by tax, accounting or consumer protection law.

Invoicing and tax obligations

To issue invoices, including structured invoices, keep accounting records and comply with tax and accounting law, the Controller processes:

• first and last name,

• company name,

• tax ID (NIP),

• business address or home address,

• order and payment data,

• bank account number,

• data required by accounting, tax and e-invoicing regulations.

Contact via Instagram, Facebook, MailerLite and ManyChat

When you contact the Controller via Instagram, Facebook or MailerLite, or through automated messages sent using ManyChat, the Controller processes:

• username,

• first and last name,

• profile picture or publicly available image,

• message content,

• information on the user's activity in the conversation,

• data on sign-ups to marketing campaigns, newsletters or educational materials.

Archiving and evidence

To secure information that may serve to demonstrate facts, pursue claims or defend against claims, the Controller processes:

• identification data,

• contact data,

• order and payment history,

• communication history,

• the content of contracts, requests, complaints and the user's statements,

• data related to the user's activity on the website or platform.

Compliance with data protection obligations

To comply with obligations under data protection law, the Controller processes:

• identification and contact data,

• information on consents given,

• history of information obligations fulfilled,

• data related to the exercise of data subjects' rights,

• information required to keep registers, records and GDPR documentation and to demonstrate compliance with the law.

For what purpose and on what legal basis

do you process my

data?

The Controller processes personal data only where there is an appropriate legal basis under the GDPR.

Concluding and performing a contract

Your data may be processed to:

• fulfill an order,

• provide a digital product or service,

• maintain a user account,

• ensure access to purchased content,

• handle payments,

• contact you in matters related to the performance of the contract.

The legal basis for processing is Article 6(1)(b) GDPR, i.e. processing necessary to conclude and perform a contract or to take steps prior to entering into it.

Invoicing and compliance with legal obligations

Your data may be processed to:

• issue invoices and structured invoices,

• keep accounting records,

• comply with tax and accounting obligations,

• comply with obligations under consumer protection law and data protection law.

The legal basis for processing is Article 6(1)(c) GDPR, i.e. processing necessary to comply with a legal obligation of the Controller.

If you buy as a business, the data needed to issue an invoice may be submitted to the Polish National e-Invoicing System (KSeF) in accordance with tax law. If you buy as a consumer (private person), invoice-related data are processed in our internal accounting records and in the systems used to handle sales. If the accounting or invoicing tools we use provide for integration with KSeF, the data may also be technically submitted to that system when sales documents are issued. In every case, personal data are processed only to the extent necessary to comply with legal obligations and keep accounts, and are protected in accordance with applicable law.

Contact and handling of requests

Your data may be processed to:

• reply to your message,

• handle the contact form,

• communicate with you,

• handle complaints, returns or technical requests.

The legal basis for processing is:

• Article 6(1)(b) GDPR — where the contact concerns the conclusion or performance of a contract,

• Article 6(1)(a) GDPR — in other cases, when you initiate contact with us.

Newsletter and marketing of our own services

Your data may be processed to:

• send the newsletter,

• send commercial information,

• conduct marketing activities,

• send educational materials,

• inform you about promotions, events or new products.

The legal basis for processing is:

• Article 6(1)(a) GDPR — the user's consent.

Marketing, remarketing and profiling

Your data may be processed to:

• personalize content,

• tailor advertising,

• segment audiences,

• analyze the effectiveness of marketing campaigns,

• conduct remarketing,

• target advertising on social media,

• automate marketing communication.

The legal basis for processing is:

• Article 6(1)(a) GDPR — the user's consent.

Contact via social media and ManyChat

Your data may be processed to:

• communicate via Instagram, Facebook and MailerLite,

• handle private messages,

• automate replies and communication using ManyChat.

The legal basis for processing is:

• Article 6(1)(a) GDPR — the user's consent.

Webinars, training, events and contests

Your data may be processed to:

• organize webinars, training or online events,

• handle registrations,

• contact you about organizational matters,

• issue certificates,

• organize contests and promotions.

The legal basis for processing is:

• Article 6(1)(b) GDPR — performance of a contract or steps prior to entering into it,

• Article 6(1)(a) GDPR — the user's consent, where required.

Partner and affiliate programs

Your data may be processed to:

• carry out partner cooperation,

• settle commissions,

• run the affiliate program,

• compile statistics and analyze the effectiveness of cooperation.

The legal basis for processing is:

• Article 6(1)(b) GDPR — performance of a contract,

• Article 6(1)(f) GDPR — the Controller's legitimate interest in organizing and developing partner cooperation.

Use of the website and analytics

Your data may be processed to:

• ensure that the website works properly,

• analyze website traffic,

• compile statistics,

• improve the website's functions,

• ensure the security of IT systems.

The legal basis for processing is:

• Article 6(1)(a) GDPR — the user's consent given through the cookie settings, where required,

• Article 6(1)(f) GDPR — the Controller's legitimate interest in conducting analyses and statistics and ensuring website security.

Cookies

Your data may be processed to:

• analyze the website and our products and services.

The legal basis is Article 6(1)(a) GDPR, which allows personal data to be processed with your consent. You give consent during your first visit to the website and may withdraw it at any time.

Security, archiving and claims

Your data may be processed to:

• protect against abuse,

• detect unauthorized activity,

• secure evidence,

• archive documentation,

• establish, pursue or defend claims.

The legal basis for processing is Article 6(1)(f) GDPR, i.e. the Controller's legitimate interest in protecting its rights, securing information and defending its interests.

Compliance with data protection obligations

Your data may be processed to:

• keep the registers and records required by the GDPR,

• fulfill information obligations,

• handle data subjects' requests,

• demonstrate the Controller's compliance with data protection law.

The legal basis for processing is Article 6(1)(c) GDPR, i.e. compliance with the Controller's legal obligations.

Handling reports concerning content published on the website

Your data may be processed to:

• receive and consider reports concerning content published on the website,

• verify reports of infringements of the law, third-party rights or the terms,

• contact the reporting person,

• take action to remove, restrict or secure certain content,

• demonstrate the Controller's compliance with applicable law.

The legal basis for processing is:

• Article 6(1)(c) GDPR — to the extent processing is necessary to comply with legal obligations,

• Article 6(1)(f) GDPR — the Controller's legitimate interest in ensuring website security, protecting the Controller's rights and preventing infringements.

To a limited extent, the Controller may collect personal data automatically through cookies and similar technologies used in particular, but not exclusively, on the website, in the store, on the training platform or in other online tools.

Cookies are small text files stored on the user's device (e.g. computer, tablet or smartphone) when using a website. Cookies enable the website to function properly, increase security, remember user preferences, analyze website traffic and support marketing activities.

What types of cookies do we use?

The Controller may use the following types of cookies:

Necessary cookies

These cookies are essential for the website and electronic services to function properly.

They include in particular:

• cookies storing data entered by the user for the duration of the session (user input cookies),

• authentication cookies used for services requiring login,

• security cookies, e.g. to detect authentication abuse,

• session cookies of media players.

Analytical and statistical cookies

These cookies make it possible to analyze how the website is used, compile statistics, measure the effectiveness of marketing activities and improve the website's functions.

The Controller uses analytical tools such as:

Google Analytics,

• Google Tag Manager,

• Meta Pixel,

• Systeme.io

Analytical cookies help collect information such as:

• the number of visits,

• traffic sources,

• time spent on the website,

• how users navigate the website,

• the effectiveness of marketing campaigns.

Information collected through cookies is aggregated and does not serve to identify users directly.

Marketing and remarketing cookies

These cookies make it possible to tailor advertising content to the user's interests, limit how often ads are shown and conduct remarketing.

They may be used by the Controller or by advertising partners, such as social media or advertising system providers.

We use tools such as:

• Google,

• Meta,

• Instagram,

• YouTube,

• ManyChat,

• MailerLite,

• Systeme.io.

Managing cookies

During your first visit to the website, you can manage your cookie settings through the cookie banner or the privacy settings.

You can also at any time:

• change your cookie settings,

• withdraw your consent,

• delete stored cookies,

• restrict or block cookies in your web browser settings.

How to manage cookies depends on the web browser you use.

Restricting cookies may affect some functions of the website, store or platform and, in some cases, prevent the use of certain services or products.

Third-party technologies

The Controller uses tools provided by third parties that use cookies or similar technologies, in particular:

• Google,

• Meta,

• Instagram,

• YouTube,

• MailerLite,

• Systeme.io,

• ManyChat.

The processing of data by these entities is governed by their own privacy policies and terms.

How long will you

process my

data?

We process personal data only for as long as necessary to achieve the purpose for which they were collected, unless a longer retention period results from applicable law or is necessary to secure claims.

The retention period depends on the purpose of processing.

Performance of contracts and provision of services

Data related to fulfilling orders, providing services, maintaining a user account or providing digital products will be processed for:

• the term of the contract or the provision of services,

• and then until the limitation period for contract-related claims expires.

Tax and accounting obligations

Data processed to comply with tax and accounting obligations and in connection with issuing invoices and keeping accounting records will be stored for the period required by law, as a rule 5 years from the end of the tax year. Data contained in structured invoices submitted to the Polish National e-Invoicing System (KSeF) are stored there for 10 years, in accordance with the Polish Act on Value Added Tax.

Newsletter and marketing

Data processed on the basis of the user's consent for marketing purposes, including sending the newsletter or commercial information, will be processed until consent is withdrawn.

Contact and handling of requests

Data related to correspondence, contact forms, complaints, requests or communication with the user will be processed for the time needed to handle the matter, and then for the time needed to secure any claims.

Webinars, training, contests and events

Data related to organizing events, webinars, training, contests or promotions will be processed for the time needed to carry them out and settle them, and then until the limitation period for any claims expires.

Partner and affiliate programs

Data related to partner or affiliate cooperation will be processed for the duration of the cooperation and financial settlements, and until the limitation period for claims expires.

Cookies and analytical data

Data collected through cookies or similar technologies will be processed for the lifetime of the relevant cookie or until:

• the user deletes the cookies,

• consent is withdrawn,

• the browser settings are changed.

Archiving and claims

Data may also be processed after the main purpose has been achieved if this is necessary to:

• establish, pursue or defend claims,

• secure evidence,

• demonstrate the Controller's compliance with the law,

• fulfill archiving obligations.

In such a case, the data will be processed until the limitation periods for claims expire or proceedings end.

Data processed on the basis of legitimate interest

Data processed on the basis of Article 6(1)(f) GDPR will be processed until an objection is successfully raised or the Controller's legitimate interest ceases.

Data processed on the basis of consent

Where the legal basis for processing is the user's consent, the data will be processed until consent is withdrawn. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The recipients of personal data are persons authorized by the Controller, employees, associates and entities cooperating with the Controller, which process the data only to the extent necessary for the given purposes and in accordance with applicable law.

In connection with our business, we may transfer personal data to entities that support us in providing services, running the business and complying with legal obligations.

Data may be transferred in particular to the following categories of recipients:

• providers of hosting, IT, administrative and technical services,

• providers of CRM systems, mailing systems, analytical and marketing tools,

• entities handling electronic payments, banks and payment operators,

• accounting offices, auditors, law firms and advisors,

• providers of marketing, advertising, affiliate or communication automation services,

• providers of archiving, storage or document destruction services,

• providers of cloud services and work organization and communication tools (e.g. Google Drive),

• providers of video-call and online meeting tools (Zoom, Google Meet) and scheduling tools (e.g. Calendly – once implemented),

• entities supporting customer service, request handling and moderation of content published on the Website,

• operators of webinars, training platforms and tools used to organize online events,

• business partners, advisors or cooperating entities — only to the extent necessary to provide the services,

• public authorities, courts, law enforcement or other authorized institutions — only in cases provided for by law, in particular in connection with invoicing.

Where entities process data on behalf of the Controller, data are transferred on the basis of appropriate data processing agreements. The Controller takes due care to ensure that cooperating entities provide an adequate level of security and protection of personal data.

Personal data may be transferred between entities cooperating organizationally or technologically, in particular those using a shared IT infrastructure, CRM systems, marketing tools or shared customer service processes, only in accordance with applicable law and with an appropriate legal basis for processing.

Do you share my data,

and with whom?

We do not share your data with third parties, except where:

1. you have voluntarily consented to such sharing. You may withdraw previously given consent at any time, as easily as you gave it.

2. sharing is necessary to perform a contract or provide a service.

3. in specific cases, your data may be disclosed to entities authorized under generally applicable law (e.g. law enforcement authorities or a statutory auditor examining financial statements).

We examine every request for disclosure carefully, and data are disclosed only if this analysis shows that there is a valid and effective legal basis for the request.

The Controller may transfer collected data to other entities only where permitted by a legal basis.

Entities to which we transfer data outside the EEA:

• Google (YouTube, Google Analytics, Google Tag Manager, Google Meet, Google Drive),

• Meta (Instagram, Facebook)

• ManyChat Inc.

• Zoom Communications, Inc.,

• Calendly LLC (once implemented),

• providers of AI tools (see the section on artificial intelligence).

Some of the Controller's service providers may be established outside the European Economic Area (EEA). When transferring data outside the EEA, the Controller exercises increased caution and verifies whether the providers guarantee a high level of personal data protection consistent with the legal requirements applicable in the EEA. When transferring personal data to entities established in the United States, the Controller relies on the EU–U.S. Data Privacy Framework (DPF) and on Standard Contractual Clauses.

Within the EEA, we may transfer data to:

• the Polish Ministry of Finance (National e-Invoicing System, KSeF)

• Systeme.io (data are stored on Amazon Web Services (AWS) servers in Ireland)

• MailerLite (newsletter sending),

• OVH Cloud (hosting of the website www.annalipiak.com),

• Stripe Payments Europe, Limited (Ireland),

• Mollie B.V. (Netherlands),

• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg),

• Klarna Bank AB (Sweden),

• ING Bank Śląski S.A.,

• Biuro Rachunkowe CONSILTAX Monika Wychowaniec-Kowalska, based in Warsaw (accounting office)

• Poczta Polska S.A.,

• InPost Sp. z o.o.

How do you protect my

data?

What are my

rights and how can I exercise them?

In connection with the processing of your personal data, you have the right to:

1. information about the processing of your personal data, the so-called "information obligation" (Articles 12 and 13 GDPR),

2. access your personal data (Article 15 GDPR),

3. request rectification of your personal data (Article 16 GDPR), i.e. correction of inaccurate data and completion of incomplete data,

4. request restriction of processing of your personal data (Article 18 GDPR),

5. request the transfer of your personal data to another controller (Article 20 GDPR),

6. object to processing on grounds relating to your particular situation (Article 21(1) GDPR); however, this right is not absolute – we may continue to process your personal data if we demonstrate compelling legitimate grounds for processing that override your rights and freedoms, or grounds for establishing, pursuing or defending claims,

7. withdraw consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8. request erasure of your personal data (Article 17 GDPR) – the so-called "right to be forgotten"; you may exercise this right, for example, when:

   1. the Controller processes your personal data unlawfully,

   2. you object to the processing of data for marketing purposes,

   3. the data must be erased for the Controller to comply with a legal obligation;

You can exercise the above rights by sending us (the data controller) an appropriate statement:

1. by email: This email address is being protected from spambots. You need JavaScript enabled to view it.

or

2. in writing – by post to:

Anna Lipiak – Pianist, Pod Kasztanem 84B, 43-344 Bielsko-Biała, Poland

marked: personal data

9. you also have the right to lodge a complaint with a supervisory authority, i.e. the President of the Polish Personal Data Protection Office (UODO), or with the supervisory authority of the EU Member State of your habitual residence or place of work.

We may update this policy from time to time. If we make material changes, we will notify you by email. To the extent permitted by applicable law, continued use of our services after such notification means that you accept the updated policy.

We encourage you to review this policy periodically for the latest information on our privacy practices. Previous versions of our privacy policy are also available for inspection.

The Policy is reviewed on an ongoing basis. The current version of the Policy was adopted and has been in effect since October 20, 2026. Archived versions of this document are available on our website.

You may voluntarily subscribe to the newsletter or consent to receiving commercial information and marketing content electronically, including by email, text message, messaging apps or phone calls.

Through the newsletter we may send you in particular:

• information about products, services, training, webinars and events,

• educational, industry and promotional materials,

• marketing and sales content,

• information about new features, special offers and promotions,

• surveys, invitations and content related to the Controller or cooperating entities.

Providing data to receive the newsletter is voluntary, but necessary to provide the newsletter service.

The data we process are your first name and email address.

The newsletter is available in Polish and in English, depending on the sign-up form used. You can sign up via a form on the website or via Instagram (a comment or message with a keyword, after which ManyChat sends you a link to the sign-up form). Every sign-up is confirmed by clicking an activation link sent to your email address (double opt-in).

The legal basis for processing personal data in connection with the newsletter is:

• the user's consent (Article 6(1)(a) GDPR).

The Controller may analyze the user's activity related to the messages sent, including:

• email opens,

• link clicks,

• activity on the Website after clicking through from the newsletter,

• interest in particular topics or offers.

The Controller uses MailerLite to send the newsletter.

You may withdraw your consent to receive the newsletter at any time. You can unsubscribe by:

• clicking the unsubscribe link in the message,

• contacting the Controller at the address given in this Policy.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The Controller obtains personal data in particular from the following sources:

• directly from the user, in particular when placing an order, subscribing to the newsletter, filling in forms or making contact,

• when the user uses the website or platform (including through cookies and similar technologies),

• from providers of marketing and analytical tools, including advertising platforms (e.g. Meta, Google, Systeme.io, MailerLite),

• from social media, in particular when contacted via Instagram, Facebook or other messaging apps,

• from providers of communication automation services (e.g. ManyChat) — to the extent of the user's interactions.

We do not use your data for automated decision-making that could affect your legal situation or have other similarly significant effects on you.

This means that none of the automation tools we use makes decisions on its own that could, for example, result in refusing to conclude a contract, restricting access to services or significantly worsening the terms of using our services solely on the basis of automated processing.

Tools used on our websites may profile user behavior in order to improve the functioning of the website, analyze how it is used and tailor the content displayed.

To this extent, we process statistical or behavioral data such as pages visited, traffic source, time spent on the website, approximate location, device type or general interests resulting from activity on the website.

As a rule, these data are processed in aggregated or pseudonymized form and do not serve to identify users directly, unless the user consents to the use of additional analytical or marketing tools, in particular by accepting the relevant cookies.

We use cookies and analytical tools that are standard for websites.

In connection with the use of the website or platform, the Controller may process data in the form of system logs, in particular:

• IP address,

• date and time of connection,

• browser and operating system information,

• device identifiers,

• system error data,

• information about user activity in the system.

These data are processed to:

• ensure system security,

• detect abuse and attempts at unauthorized access,

• administer the system,

• analyze errors and improve functionality.

In connection with the Controller's use of marketing, analytical and advertising tools provided by third parties, joint controllership of personal data may arise.

Joint controllership means that, to a certain extent, both the Controller and the provider of the tool (e.g. a social media or advertising platform) jointly determine the purposes and means of processing certain personal data.

This applies in particular to:

• displaying ads and running marketing campaigns,

• analyzing the effectiveness of ads and marketing activities,

• compiling statistics on the use of profiles or pages,

• conducting remarketing,

• analyzing user behavior on websites or social media.

In particular, joint controllership may arise in relation to entities such as:

• Meta Platforms (Facebook, Instagram),

• Google (including Google Ads and Google Analytics),

• other advertising and analytical platforms used by the Controller.

Under joint controllership:

• the Controller and the tool provider process data on their own legal bases,

• each entity is responsible for processing to the extent it determines itself or jointly with the other entity,

• the user may exercise their GDPR rights against both the Controller and the tool provider, in accordance with their roles and arrangements.

Detailed rules for the processing of data by these entities, including information on their responsibilities and how they handle data subjects' rights, are set out in their own privacy policies and joint controllership documents.

The Controller takes due care to use only tools that provide an adequate level of personal data protection and compliance with the GDPR.

• We operate on the following platforms:

• Facebook [https://www.facebook.com/ania.pianist/]

• Instagram [https://www.instagram.com/annalipiak]

• TikTok [https://www.tiktok.com/@annalipiak]

In running the website and serving Customers (in particular for communication, analyzing inquiries, preparing replies and creating informational and marketing content), the Controller may use artificial intelligence (AI) tools provided by third parties such as OpenAI, Anthropic and Google (Gemini).

AI tools are used only as auxiliary and technical support in internal processes and to improve customer service. The Controller takes steps to limit the transfer of personal data and information allowing the direct identification of persons to AI systems, unless this is necessary to perform a given task.

Artificial intelligence is not used to make decisions concerning the Customer that produce legal effects or otherwise significantly affect their situation within the meaning of data protection law. All significant actions, decisions and content addressed to the Customer may be reviewed and approved by the Controller. Where the Customer uses AI-based solutions, the Controller informs them of this clearly and comprehensibly, in particular by marking the communication channel or function.

The Customer has the right at any time to request contact with a human instead of an AI-based system, in particular by writing to the email address given in this Privacy Policy. In that case, the request will be forwarded to the Controller.