Download PDF

www.annalipiak.com

Effective date: October 20, 2026

This Privacy Policy is an English translation of the Polish document “Polityka prywatności”. It applies to all users of www.annalipiak.com, the order pages on the Systeme.io platform (ania-lipiak.systeme.io), the newsletter and the Service Provider’s social media channels. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Who is the controller of my personal data?

The controller of your personal data, i.e. the entity that decides on the purposes and means of processing, is Anna Lipiak, conducting business under the name Anna Lipiak – Pianist, Pod Kasztanem 84B, 43-344 Bielsko-Biała, Poland, Tax ID (NIP): 6152016671, REGON: 524600674 (the “Controller”).

How can I contact you about personal data?

If you would like to contact us about the processing of your personal data, you can do so:

• by email: This email address is being protected from spambots. You need JavaScript enabled to view it.

• in writing, by post to: Anna Lipiak – Pianist, Pod Kasztanem 84B, 43-344 Bielsko-Biała, Poland

When and why do you process personal data?

We process your personal data:

• when you place an order and when we fulfill it;

• in connection with providing digital products, electronic materials, training, webinars or other online content;

• when delivering goods (physical products);

• when handling payments, complaints, returns or order-related requests;

• when you contact the Controller via a contact form, email, phone or social media;

• when you sign up for the newsletter or give marketing consents;

• in connection with participation in contests, promotions, partner programs or events organized by the Controller;

• when you publish reviews or comments on products or services;

• when you book or attend an online meeting or consultation (e.g. the Piano Playing Audit) held via Zoom or Google Meet;

• in connection with your use of the website and its functions, including through cookies and similar technologies;

• for analytical, statistical and marketing purposes and to improve the quality of our services;

• to ensure website security, prevent abuse, detect unauthorized activity and protect against breaches of the terms or attempts to circumvent the protection of digital products;

• to establish, pursue or defend claims;

• to comply with legal obligations, in particular tax, accounting and consumer protection obligations.

We may also process personal data to market our own products and services, including on social media platforms, through targeted advertising on social media, newsletters, remarketing, marketing automation, audience segmentation and matching advertising content to your interests — only to the extent permitted by applicable law and on the basis of your consent.

Do I have to provide my data?

Providing personal data is voluntary, but in some cases it may be necessary in order to use certain services or functions offered by the Controller.

Failure to provide the required data may result in:

• the inability to conclude or perform a contract;

• the inability to fulfill an order;

• no access to a digital product, training or user account;

• the inability to receive the newsletter or marketing information;

• the inability to reply to your inquiry or handle your request.

When placing an order or concluding a contract, providing the data marked as mandatory is necessary to perform the contract and to comply with legal obligations, in particular tax and accounting obligations.

Providing data for marketing purposes, including to receive the newsletter, educational materials, commercial offers or information about promotions, is voluntary and based on your consent. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

What data do you process?

The scope of personal data processed depends on the purpose of processing and on the type of service, function or user activity.

Fulfilling orders and providing services. To conclude and perform the contract, fulfill the order, provide digital products, deliver physical products, handle payments, issue accounting documents and contact you, the Controller processes: first and last name; email address; phone number; home or correspondence address; invoicing data, including company name, tax ID and business address; information about orders, payments and purchase history; data on the use of the digital product, physical product or service, including assigned access rights, login history, download history and information about your activity on the platform.

Contact and handling of requests. When you contact the Controller, the Controller may process: first and last name; email address; phone number; data contained in the message, form or request; information about previous communication; data related to a complaint, return or technical request.

Online meetings and consultations. When you book or attend an online meeting, lesson or consultation (e.g. the Piano Playing Audit), the Controller may process: first and last name; email address; the date and time of the meeting; information you provide when booking; your image and voice during the video call; and, if you choose to share them, recordings of your playing or sheet music. Meetings are not recorded unless participants have been informed in advance and, where required, have consented.

Newsletter and marketing. For marketing purposes, including targeted advertising on social media and sending the newsletter, educational materials, commercial information or content tailored to your interests, the Controller may process: first name; email address; phone number; information about your marketing activity, including email opens, link clicks, preferences, sign-up history and consents given; data on the source of the contact or interest in particular content; information on marketing segmentation and campaign effectiveness.

Contests, promotions and events. When you take part in contests, webinars, training, online events or promotions, the Controller may process: first and last name; email address; phone number; data needed to organize the event or hand over a prize; information on participation, activity or registration; data related to issuing a certificate, attendance list or settling the event.

Reviews, comments, content published by users and handling of content reports. When you publish reviews, comments or other content, the Controller processes: first name or pseudonym; email address; the content of the review, comment or message; information on the date of publication and your activity; your image or company name — if you voluntarily share such data.

Partner and affiliate programs. When you participate in partner or affiliate programs, the Controller processes: identification and contact data; settlement data; bank account number; information on referrals, commissions, affiliate activity and the effectiveness of partner activities.

Social media. When you contact the Controller via social media or follow the Controller’s profiles, the following are processed: username; first and last name; image; content of messages, comments or reactions; information publicly available in your profile.

Use of the website, cookies and analytics. In connection with your use of the website, the Controller processes: IP address; device identifiers; browser type and operating system; approximate location; referral source; your activity on the website; time spent on the website; information about clicks and how you use the website’s functions; information stored in cookies or similar technologies. These data may be used to ensure that the website works properly, to compile statistics, analyze traffic, conduct marketing and remarketing, and improve the security of services.

Security and abuse prevention. To ensure the security of the website, digital products and systems, the Controller processes: IP address; information about your devices and sessions; data on activity that may indicate a breach of the terms, an attempt to circumvent security or unauthorized access; technical information related to detecting abuse and protecting the IT infrastructure.

Complaints, withdrawal from contracts, claims and legal obligations. To handle complaints, establish, pursue or defend claims and comply with legal obligations, the Controller processes: identification and contact data; order and payment data; communication history; information related to the request, complaint, withdrawal or dispute; data required by tax, accounting or consumer protection law.

Invoicing and tax obligations. To issue invoices, including structured invoices, keep accounting records and comply with tax and accounting law, the Controller processes: first and last name; company name; tax ID; business or home address; order and payment data; bank account number; data required by accounting, tax and e-invoicing regulations.

Contact via Instagram, Facebook, MailerLite and ManyChat. When you contact the Controller via Instagram, Facebook or MailerLite, or through automated messages sent using ManyChat (e.g. after you comment with a keyword under a post), the Controller processes: username; first and last name; profile picture or publicly available image; message content; information on your activity in the conversation; data on sign-ups to marketing campaigns, newsletters or educational materials.

Archiving and evidence. To secure information that may serve to establish facts or to pursue or defend claims, the Controller processes: identification data; contact data; order and payment history; communication history; the content of contracts, requests, complaints and your statements; data related to your activity on the website or platform.

Compliance with data protection obligations. To comply with data protection obligations, the Controller processes: identification and contact data; information on consents given; history of information obligations fulfilled; data related to the exercise of data subjects’ rights; information required to maintain registers, records and GDPR documentation and to demonstrate compliance with the law.

Children’s data

The Controller’s products and the newsletter are intended for adults and for persons aged 16 or over. Personal data of children under 16 (e.g. piano students taking part in lessons, concerts or recordings) are processed only with the consent of, or on behalf of, their parent or legal guardian, and in the scope necessary for the given purpose. A child’s image or performance is published only on the basis of the written consent of the parent or legal guardian.

For what purpose and on what legal basis do you process my data?

The Controller processes personal data only where there is an appropriate legal basis under the GDPR.

Concluding and performing a contract. Your data may be processed to fulfill an order; provide a digital product or service, including online meetings and consultations; maintain a user account; ensure access to purchased content; handle payments; and contact you in matters related to the performance of the contract. Legal basis: Article 6(1)(b) GDPR — processing necessary to conclude and perform a contract or to take steps prior to entering into it.

Invoicing and legal obligations. Your data may be processed to issue invoices and structured invoices; keep accounting records; comply with tax and accounting obligations; comply with obligations under consumer protection and data protection law. Legal basis: Article 6(1)(c) GDPR — processing necessary to comply with a legal obligation of the Controller. If you buy as a business, the data needed to issue an invoice may be submitted to the Polish National e-Invoicing System (KSeF) in accordance with tax law. If you buy as a consumer (private person), invoice-related data are processed in our internal accounting records and in the systems used to handle sales. If the accounting or invoicing tools we use provide for integration with KSeF, the data may also be technically submitted to that system when sales documents are issued. In every case, personal data are processed only to the extent necessary to comply with legal obligations and keep accounts, and are protected in accordance with applicable law.

Contact and handling of requests. Your data may be processed to reply to your message; handle the contact form; communicate with you; handle complaints, returns or technical requests. Legal basis: Article 6(1)(b) GDPR — where the contact concerns the conclusion or performance of a contract; Article 6(1)(a) GDPR — in other cases where you initiate contact with us.

Newsletter and marketing of our own services. Your data may be processed to send the newsletter; send commercial information; conduct marketing activities; send educational materials; inform you about promotions, events or new products. Legal basis: Article 6(1)(a) GDPR — your consent.

Marketing, remarketing and profiling. Your data may be processed to personalize content; tailor advertising; segment audiences; analyze the effectiveness of marketing campaigns; conduct remarketing; target advertising on social media; automate marketing communication. Legal basis: Article 6(1)(a) GDPR — your consent.

Contact via social media and ManyChat. Your data may be processed to communicate via Instagram, Facebook and MailerLite; handle private messages; automate replies and communication using ManyChat. Legal basis: Article 6(1)(a) GDPR — your consent.

Webinars, training, events and contests. Your data may be processed to organize webinars, training or online events; handle registrations; contact you about organizational matters; issue certificates; organize contests and promotions. Legal basis: Article 6(1)(b) GDPR — performance of a contract or steps prior to entering into it; Article 6(1)(a) GDPR — your consent, where required.

Partner and affiliate programs. Your data may be processed to carry out partner cooperation; settle commissions; run the affiliate program; compile statistics and analyze the effectiveness of cooperation. Legal basis: Article 6(1)(b) GDPR — performance of a contract; Article 6(1)(f) GDPR — the Controller’s legitimate interest in organizing and developing partner cooperation.

Use of the website and analytics. Your data may be processed to ensure that the website works properly; analyze website traffic; compile statistics; improve the website’s functions; ensure the security of IT systems. Legal basis: Article 6(1)(a) GDPR — your consent given through the cookie settings, where required; Article 6(1)(f) GDPR — the Controller’s legitimate interest in conducting analyses and statistics and ensuring website security.

Cookies. Your data may be processed to analyze the website and our products and services. Legal basis: Article 6(1)(a) GDPR, which allows personal data to be processed with your consent. You give consent during your first visit to the website and may withdraw it at any time.

Security, archiving and claims. Your data may be processed to protect against abuse; detect unauthorized activity; secure evidence; archive documentation; establish, pursue or defend claims. Legal basis: Article 6(1)(f) GDPR — the Controller’s legitimate interest in protecting its rights, securing information and defending its interests.

Compliance with data protection obligations. Your data may be processed to keep the registers and records required by the GDPR; fulfill information obligations; handle data subjects’ requests; demonstrate the Controller’s compliance with data protection law. Legal basis: Article 6(1)(c) GDPR — compliance with the Controller’s legal obligations.

Handling reports concerning content published on the website. Your data may be processed to receive and consider reports concerning content published on the website; verify reports of infringements of the law, third-party rights or the terms; contact the reporting person; take action to remove, restrict or secure certain content; demonstrate the Controller’s compliance with applicable law. Legal basis: Article 6(1)(c) GDPR — to the extent necessary to comply with legal obligations; Article 6(1)(f) GDPR — the Controller’s legitimate interest in ensuring website security, protecting its rights and preventing infringements.

Cookies and similar technologies

To a limited extent, the Controller may collect personal data automatically through cookies and similar technologies used in particular, but not exclusively, on the website, in the store, on the training platform or in other online tools.

Cookies are small text files stored on your device (e.g. computer, tablet or smartphone) when you use a website. Cookies enable the website to function properly, increase security, remember your preferences, analyze website traffic and support marketing activities.

What types of cookies do we use?

Necessary cookies are essential for the website and electronic services to function properly. They include in particular: cookies storing data entered by the user for the duration of the session (user input cookies); authentication cookies used for services requiring login; security cookies, e.g. to detect authentication abuse; session cookies of media players.

Analytical and statistical cookies make it possible to analyze how the website is used, compile statistics, measure the effectiveness of marketing activities and improve the website’s functions. The Controller uses analytical tools such as Google Analytics, Google Tag Manager, Meta Pixel and Systeme.io. Analytical cookies help collect information such as the number of visits, traffic sources, time spent on the website, navigation patterns and the effectiveness of marketing campaigns. Information collected through cookies is aggregated and does not serve to identify users directly.

Marketing and remarketing cookies make it possible to tailor advertising content to your interests, limit how often ads are shown and conduct remarketing. They may be used by the Controller or by advertising partners such as social media or advertising system providers. We use tools from Google, Meta, Instagram, YouTube, ManyChat, MailerLite and Systeme.io.

Managing cookies. During your first visit to the website, you can manage your cookie settings through the cookie banner or the privacy settings. You can also at any time: change your cookie settings; withdraw your consent; delete stored cookies; restrict or block cookies in your web browser settings. How to manage cookies depends on the browser you use. Restricting cookies may affect some functions of the website, store or platform and, in some cases, prevent the use of certain services or products.

Third-party technologies. The Controller uses tools provided by third parties that use cookies or similar technologies, in particular Google, Meta, Instagram, YouTube, MailerLite, Systeme.io and ManyChat. The processing of data by these entities is governed by their own privacy policies and terms.

How long will you process my data?

We process personal data only for as long as necessary to achieve the purpose for which they were collected, unless a longer retention period results from applicable law or is necessary to secure claims. The retention period depends on the purpose:

• Performance of contracts and provision of services: for the term of the contract or provision of services, and then until the limitation period for contract-related claims expires.

• Tax and accounting obligations: for the period required by law, as a rule 5 years from the end of the tax year. Data contained in structured invoices submitted to KSeF are stored there for 10 years, in accordance with the Polish Act on Value Added Tax.

• Newsletter and marketing: until you withdraw your consent.

• Contact and handling of requests: for the time needed to handle the matter, and then for the time needed to secure any claims.

• Online meetings and consultations: for the time needed to provide the service, and then until the limitation period for claims expires; recordings (if any) are kept only for the period communicated to participants.

• Webinars, training, contests and events: for the time needed to organize and settle them, and then until the limitation period for any claims expires.

• Partner and affiliate programs: for the duration of the cooperation and financial settlements, and until the limitation period for claims expires.

• Cookies and analytical data: for the lifetime of the relevant cookie, or until you delete cookies, withdraw your consent or change your browser settings.

• Archiving and claims: data may also be processed after the main purpose has been achieved if this is necessary to establish, pursue or defend claims, secure evidence, demonstrate compliance with the law or fulfill archiving obligations — until the limitation periods expire or proceedings end.

• Data processed on the basis of legitimate interest (Article 6(1)(f) GDPR): until you successfully object or the Controller’s legitimate interest ceases.

• Data processed on the basis of consent: until you withdraw it. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Who are the recipients of the data?

The recipients of personal data are persons authorized by the Controller, employees, associates and entities cooperating with the Controller, which process the data only to the extent necessary for the given purposes and in accordance with applicable law.

In connection with our business, we may transfer personal data to entities that support us in providing services, running the business and complying with legal obligations, in particular to the following categories of recipients:

• providers of hosting, IT, administrative and technical services;

• providers of CRM systems, mailing systems, analytical and marketing tools;

• entities handling electronic payments, banks and payment operators;

• accounting offices, auditors, law firms and advisors;

• providers of marketing, advertising, affiliate or communication automation services;

• providers of archiving, storage or document destruction services;

• providers of cloud services and work organization and communication tools (e.g. Google Drive);

• providers of video-call and online meeting tools (Zoom, Google Meet) and online scheduling tools (e.g. Calendly, once used);

• entities supporting customer service, request handling and moderation of content published on the website;

• operators of webinars, training platforms and tools used to organize online events;

• business partners or cooperating entities — only to the extent necessary to provide the services;

• public authorities, courts, law enforcement or other authorized institutions — only in cases provided for by law, in particular in connection with invoicing.

Where entities process data on behalf of the Controller, data are transferred on the basis of appropriate data processing agreements. The Controller takes due care to ensure that cooperating entities provide an adequate level of security and protection of personal data.

Personal data may be transferred between entities cooperating organizationally or technologically, in particular those using a shared IT infrastructure, CRM systems, marketing tools or shared customer service processes, only in accordance with applicable law and with an appropriate legal basis for processing.

Do you share my data, and with whom?

We do not share your data with third parties, except where:

• you have voluntarily consented to such sharing (you may withdraw previously given consent at any time, as easily as you gave it);

• sharing is necessary to perform a contract or provide a service;

• in specific cases, your data may be disclosed to entities authorized under generally applicable law (e.g. law enforcement authorities or a statutory auditor examining financial statements).

We examine every request for disclosure carefully, and data are disclosed only if this analysis shows that there is a valid and effective legal basis for the request.

Do you transfer personal data outside the European Union?

The Controller may transfer collected data to other entities only where permitted by a legal basis.

Entities to which we transfer data outside the European Economic Area (EEA):

• Google (including YouTube, Google Analytics, Google Tag Manager, Google Meet and Google Drive);

• Meta (Instagram, Facebook);

• ManyChat Inc.;

• Zoom Communications, Inc.;

• Calendly LLC (once used);

• providers of AI tools (see the section on artificial intelligence below).

Some of the Controller’s service providers may be established outside the EEA. When transferring data outside the EEA, the Controller exercises increased caution and verifies whether the providers guarantee a high level of personal data protection consistent with the legal requirements applicable in the EEA. When transferring personal data to entities established in the United States, the Controller relies on the EU–U.S. Data Privacy Framework (DPF) and on Standard Contractual Clauses approved by the European Commission.

Within the EEA, we may transfer data to:

• the Polish Ministry of Finance (National e-Invoicing System, KSeF);

• Systeme.io (data are stored on Amazon Web Services (AWS) servers in Ireland);

• OVH Cloud (hosting of the website www.annalipiak.com);

• MailerLite (newsletter sending);

• Stripe Payments Europe, Limited (Ireland);

• Mollie B.V. (Netherlands);

• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg);

• Klarna Bank AB (Sweden);

• ING Bank Śląski S.A. (Poland);

• Biuro Rachunkowe CONSILTAX Monika Wychowaniec-Kowalska, based in Warsaw (accounting office);

• Poczta Polska S.A. and InPost Sp. z o.o. (delivery of physical goods).

How do you protect my data?

The Controller makes every effort to apply physical, technical and organizational measures to protect personal data against accidental or intentional destruction, accidental loss, alteration, unauthorized disclosure, use or access, in accordance with all applicable laws.

What are my rights and how can I exercise them?

In connection with the processing of your personal data, you have the right to:

• information about the processing of your personal data (Articles 12 and 13 GDPR);

• access your personal data (Article 15 GDPR);

• request rectification of your personal data (Article 16 GDPR), i.e. correction of inaccurate data and completion of incomplete data;

• request restriction of processing (Article 18 GDPR);

• data portability to another controller (Article 20 GDPR);

• object to processing on grounds relating to your particular situation (Article 21(1) GDPR); this right is not absolute — we may continue to process your data if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims;

• withdraw consent; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal;

• request erasure of your personal data (Article 17 GDPR) — the “right to be forgotten” — for example where the Controller processes your data unlawfully, where you object to processing for marketing purposes, or where the data must be erased to comply with a legal obligation.

You can exercise these rights by sending a statement to us (the Controller): by email to This email address is being protected from spambots. You need JavaScript enabled to view it., or in writing by post to Anna Lipiak – Pianist, Pod Kasztanem 84B, 43-344 Bielsko-Biała, Poland, marked “personal data”.

You also have the right to lodge a complaint with a supervisory authority, i.e. the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), or with the data protection authority of the EU Member State of your habitual residence or place of work.

How do you update this privacy policy?

We may update this policy from time to time. If we make material changes, we will notify you by email. To the extent permitted by applicable law, continued use of our services after such notification means that you accept the updated policy.

We encourage you to review this policy periodically for the latest information on our privacy practices. Previous versions of this policy are also available for inspection.

The policy is reviewed on an ongoing basis. The current version was adopted and has been in effect since October 20, 2026. Archived versions of this document are available on our website.

Newsletter and marketing communication

You may voluntarily subscribe to the newsletter or consent to receiving commercial information and marketing content electronically, including by email, text message, messaging apps or phone calls.

Through the newsletter we may send you in particular: information about products, services, training, webinars and events; educational, industry and promotional materials; marketing and sales content; information about new features, special offers and promotions; surveys, invitations and content related to the Controller or cooperating entities.

The newsletter is available in Polish and in English, depending on the sign-up form you use. You can sign up via a form on the website or via Instagram (by commenting or messaging a keyword, after which ManyChat sends you a link to the sign-up form). Every sign-up is confirmed by clicking an activation link sent to your email address (double opt-in).

Providing data to receive the newsletter is voluntary, but necessary to provide the newsletter service. We process your first name and email address. The legal basis for processing in connection with the newsletter is your consent (Article 6(1)(a) GDPR).

The Controller may analyze your activity related to the messages sent, including email opens, link clicks, activity on the website after clicking through from the newsletter, and interest in particular topics or offers. The Controller uses MailerLite to send the newsletter.

You may withdraw your consent to receive the newsletter at any time by clicking the unsubscribe link in the message or by contacting the Controller at the address given in this Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Links to other websites

The website may contain links to other websites. If you click a link to another website, you will be redirected to it. Please note that these external websites are not operated by us. The Controller therefore recommends that you read their privacy policies. The Controller has no control over and assumes no responsibility for the content, privacy policies or practices of third-party websites.

Legitimate interest of the Controller

The Controller may process data on the basis of its legitimate interest (Article 6(1)(f) GDPR), for example to pursue possible claims. Whenever the Controller processes personal data on the basis of legitimate interest, it seeks to analyze and balance its interest against the potential impact on the data subject (both positive and negative) and the data subject’s rights under data protection law.

Data protection

The Controller uses all available physical, technical and organizational measures to ensure proper protection of personal data. In particular, it protects data against destruction, accidental loss, disclosure to unauthorized persons and alteration, and verifies the scope of access. The Controller respects the rights of data subjects.

How do you obtain personal data?

The Controller obtains personal data in particular from the following sources:

• directly from you, in particular when you place an order, subscribe to the newsletter, fill in forms, book a meeting or contact us;

• when you use the website or platform (including through cookies and similar technologies);

• from providers of marketing and analytical tools, including advertising platforms (e.g. Meta, Google, Systeme.io, MailerLite);

• from social media, in particular when you contact us via Instagram, Facebook or other messaging apps;

• from providers of communication automation services (e.g. ManyChat) — to the extent of your interactions.

Automated decision-making and profiling

We do not use your data for automated decision-making that could affect your legal situation or have other similarly significant effects on you. This means that none of the automation tools we use makes decisions on its own that could, for example, result in refusing to conclude a contract, restricting access to services or significantly worsening the terms of using our services solely on the basis of automated processing.

Tools used on our websites may profile user behavior in order to improve the functioning of the website, analyze how it is used and tailor the content displayed. To this extent, we process statistical or behavioral data such as pages visited, traffic source, time spent on the website, approximate location, device type or general interests resulting from activity on the website. As a rule, these data are processed in aggregated or pseudonymized form and do not serve to identify users directly, unless you consent to the use of additional analytical or marketing tools, in particular by accepting the relevant cookies.

We use cookies and analytical tools that are standard for websites.

Server logs

In connection with the use of the website or platform, the Controller may process data in the form of system logs, in particular: IP address; date and time of connection; browser and operating system information; device identifiers; system error data; information about user activity in the system. These data are processed to ensure system security; detect abuse and attempts at unauthorized access; administer the system; and analyze errors and improve functionality.

Social media

In connection with the Controller’s use of marketing, analytical and advertising tools provided by third parties, joint controllership of personal data may arise. Joint controllership means that, to a certain extent, both the Controller and the provider of the tool (e.g. a social media or advertising platform) jointly determine the purposes and means of processing certain personal data.

This applies in particular to: displaying ads and running marketing campaigns; analyzing the effectiveness of ads and marketing activities; compiling statistics on the use of profiles or pages; conducting remarketing; analyzing user behavior on websites or social media. Joint controllership may arise in particular in relation to Meta Platforms (Facebook, Instagram), Google (including Google Ads and Google Analytics) and other advertising and analytical platforms used by the Controller.

Under joint controllership: the Controller and the tool provider process data on their own legal bases; each entity is responsible for processing to the extent it determines itself or jointly with the other; you may exercise your GDPR rights against both the Controller and the tool provider, in accordance with their roles and arrangements. Detailed rules for the processing of data by these entities, including their responsibilities and how they handle data subjects’ rights, are set out in their own privacy policies and joint controllership documents.

The Controller takes due care to use only tools that provide an adequate level of personal data protection and compliance with the GDPR.

We operate on the following platforms:

• Facebook: https://www.facebook.com/ania.pianist/

• Instagram: https://www.instagram.com/annalipiak

• TikTok: https://www.tiktok.com/@annalipiak

Do you use artificial intelligence?

In running the website and serving Customers (in particular for communication, analyzing inquiries, preparing replies, translating and creating informational and marketing content), the Controller may use artificial intelligence (AI) tools provided by third parties such as OpenAI, Anthropic and Google (Gemini).

AI tools are used only as auxiliary and technical support in internal processes and to improve customer service. The Controller takes steps to limit the transfer of personal data and information allowing the direct identification of persons to AI systems, unless this is necessary to perform a given task.

Artificial intelligence is not used to make decisions concerning Customers that produce legal effects or otherwise significantly affect their situation within the meaning of data protection law. All significant actions, decisions and content addressed to Customers may be reviewed and approved by the Controller. Where a Customer uses AI-based solutions, the Controller informs them of this clearly and comprehensibly, in particular by marking the communication channel or function.

You have the right at any time to request contact with a human instead of an AI-based system, in particular by writing to the email address given in this Privacy Policy. In that case, your request will be forwarded to the Controller.