Privacy Policy

1. Data Controller

The controller of your personal data is Narrix.studio Stanisław Trzcieliński, ul. Karawelowa 26, 60-480 Poznań, Poland, Polish Tax ID (NIP): 7812113123, REGON business register number: 545077302.

Privacy contact: film@narrix.studio.

2. What data we process and how we obtain it

We limit processing to the minimum needed to operate the website, handle enquiries and provide our services.

a) Website (no forms)

Our website does not have contact forms and does not collect information entered directly into the website.

b) E-mail and WhatsApp contact

If you contact us by e-mail or WhatsApp, we process the information needed to handle your message, in particular your e-mail address, phone number or WhatsApp identifier, message content, attachments and any other information you provide. We use it to reply, prepare an offer, take steps before entering into a contract or perform our cooperation.

When you choose WhatsApp contact, you are redirected to an external service provided in the European Region by WhatsApp Ireland Limited. Before you send a message, WhatsApp may process data under its own Privacy Policy.

Providing data is voluntary, but contact details and information necessary to handle the enquiry are required for us to reply or take steps related to cooperation. We do not add you to marketing lists and do not build mailing databases.

c) Technical data (server logs)

For technical and security reasons, the server may record logs such as IP address, date and time, browser or device information and requested resources. Logs are used to maintain the website, diagnose errors and protect it against abuse.

3. Browser mechanisms, external services, analytics and marketing

Analytics and marketing tools are activated only after the relevant consent has been obtained. Independently of that consent, the website uses the technical and functional resources described below to render the website and present video content.

a) Essential / functional mechanisms

We store separate analytics and marketing choices in browser storage so that they can be respected during future visits. This record is not used for advertising or profiling and is needed to remember your privacy settings.

b) Google Fonts

The website uses Google Fonts to display its typefaces. Your browser automatically downloads a stylesheet and font files tailored to the browser from Google servers. As a result, Google may receive technical data such as the IP address, browser and device information, the requested resource, referrer information, and the date and time of the connection. We do not use these connections to create our own user profiles.

c) YouTube content

Some pages embed YouTube content using privacy-enhanced mode (youtube-nocookie.com). Depending on the page, the player may load when the section is displayed, when a modal is opened or when the video is started; where the website design provides for it, playback may begin automatically. A connection to YouTube may transmit technical data to Google, such as the IP address, browser and device information, referrer information, the requested video and interactions with the player. Privacy-enhanced mode limits the use of the view for personalisation, but it does not eliminate the technical connection to Google. More information is available in the Google Privacy Policy.

d) Google Analytics 4 and Google Tag Manager

After analytics consent, we activate Google Analytics 4 through Google Tag Manager. It helps us measure page views, traffic sources, approximate device and browser information, and interactions such as scrolling, outbound clicks, PDF downloads and selected contact clicks.

The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We do not send names, message content or other information entered by users to Analytics. For users in the EU, Google Analytics 4 does not log or store individual IP addresses; the address is used briefly to derive approximate location data and is then discarded by Google.

User-level and event-level data is retained according to the GA4 property settings; we currently use a two-month period. Aggregated statistical reports may remain available for longer.

e) Meta Pixel

After marketing consent, we activate Meta Pixel ID 1568826704682729. The tool records a page view (PageView) and a Lead event when a user clicks an e-mail or WhatsApp contact link. It is used to measure activity from Facebook and Instagram and may enable the creation of remarketing audiences.

Meta Pixel may process the visited page URL, referring page, browser and device information, IP address and identifiers stored in cookies, such as _fbp and _fbc. We do not use advanced matching and do not send e-mail addresses or phone numbers to Meta.

The service provider is Meta Platforms Ireland Limited, ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland. More information is available in the Meta Privacy Policy.

f) Consent and changing your choice

Google Analytics and Meta Pixel are not loaded before the relevant category is accepted. Analytics and marketing can be selected independently. Refusal does not restrict access to the website. You can change or withdraw consent at any time through the “Privacy settings” link in the footer. After withdrawal, available first-party cookies related to the category are removed and the relevant tools are not loaded on subsequent page views.

How to manage website data

You can also remove cookies and website data through your browser settings.

4. Data recipients

Your data may be processed by the service providers we use, to the extent necessary to provide the relevant service:

• hosting and server providers — for logs, security and website maintenance,
• e-mail service providers — for handling correspondence,
• Google Ireland Limited — in connection with Google Fonts and YouTube content and, after analytics consent, also Google Analytics 4 and Google Tag Manager,
• Meta Platforms Ireland Limited — after marketing consent, in connection with Meta Pixel,
• WhatsApp Ireland Limited — if you choose to contact us through WhatsApp,
• authorised public authorities — where disclosure is required by law.

We do not sell personal data. Data is disclosed only to the extent necessary for the purposes described in this policy.

5. Legal basis for processing

We process data based on:

• Your consent (Art. 6(1)(a) GDPR) — for Google Analytics 4, Meta Pixel and analytics or marketing mechanisms stored on your device,
• Our legitimate interests (Art. 6(1)(f) GDPR) — for server logs, security, the proper operation and consistent rendering of the website, presenting video content, handling business correspondence with people representing companies or organisations, and establishing, pursuing or defending legal claims,
• Taking steps at your request before entering into a contract or performing a contract (Art. 6(1)(b) GDPR) — when you contact us in your own name regarding cooperation,
• Legal obligations (Art. 6(1)(c) GDPR) — including accounting and tax documentation requirements.

Storing information on, or accessing information from, your device is handled in accordance with Article 399 of the Polish Electronic Communications Law: on the basis of consent, unless the mechanism is necessary to transmit a communication or provide a service explicitly requested by the user, including remembering privacy settings or starting a selected function.

6. How long we store data

• Google Analytics: user-level and event-level data according to the GA4 retention setting — currently two months; aggregated reports may remain available for longer.
• Meta Pixel: data is retained and deleted according to the settings and rules of Meta services; we do not control the provider's full retention period.
• Google Fonts and YouTube: we do not create our own database from technical connections to these services; retention periods on Google's side are determined by the provider.
• Analytics and marketing choices: until you change them or remove website data in your browser.
• E-mail and WhatsApp: for the time needed to handle contact, arrangements and cooperation and, where justified, until the limitation period for potential claims expires or longer where required by law.
• Server logs: according to hosting settings and security needs, usually from a few days to a few months.
• Billing data: for the period required by law.

7. Your rights

Depending on the legal basis and circumstances of the processing, you may request:

• access to your data and a copy of it,
• rectification of your data,
• erasure of your data,
• restriction of processing,
• data portability,
• to object to processing based on our legitimate interests,
• to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can send a request to film@narrix.studio. We may ask for information needed to confirm your identity or locate the data, but only to the extent necessary to handle the request.

If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or another competent supervisory authority in the EEA. Information about complaints to UODO is available on the UODO website.

How we implement your rights in practice

We do not maintain our own database of website users or our own behavioural profiles. The identifying data we process directly is usually limited to e-mail or WhatsApp correspondence. After consent, Google and Meta may nevertheless process technical data and events to the extent described in this policy.

If a request concerns technical data such as server logs, we may be unable to link it to a specific person without additional information. If we no longer hold the data covered by the request, we will inform you.

8. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. After marketing consent, Meta Pixel may be used for profiling and creating remarketing audiences. Meta's selection and display of advertisements is governed by the provider's own rules.

9. Transfers outside the EEA

In connection with Google, Meta and WhatsApp services, data may also be processed outside the European Economic Area. Depending on the recipient and service, a transfer may rely on a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified US organisations, or on Standard Contractual Clauses or another mechanism provided for by the GDPR.

Information about safeguards is available in the providers' privacy policies and on the European Commission page on EU–US data transfers. You may also contact us for information about safeguards applicable in a specific case.

10. Changes to the policy

We may update this policy when the services we use, the operation of the website or legal requirements change. The current version is always available on this page.