EdSky.pl · Edgar Studio
Effective from 20 October 2026. Translation of the document for users of the Polish version of the website.
Privacy policy
1. Who is responsible for your data?
I am the controller of personal data on EdSky.pl: Edgar Czajka, trading as EdgarStudio, Brombeerweg 11, 22880 Wedel, Germany. For questions about privacy and your data, email serwishamburg@gmail.com or write to the postal address above.
This information covers visits to the website and the functions described below. My business is based in Germany; the Polish language version and .pl domain do not change that. Data protection is based on the GDPR. For information stored on your device, I take account of German section 25 TDDDG and Article 399 of the Polish Electronic Communications Law where applicable.
2. What data do I process, and why?
I receive data directly from you, technical connection data and, if you choose social sign-in, data shared by the account provider. Reading the website does not require registration.
| Situation | Data and purpose | Legal basis |
|---|---|---|
| Visiting the website | IP address, request time and URL, browser and device information and error messages: delivering content, maintaining operation and protecting the website. Servers may also receive the referring URL. | Article 6(1)(f) GDPR — my legitimate interest in website availability and security. |
| Contact form and email | Name, email address, selected service, subject, message and information you voluntarily provide: responding and agreeing the scope of work. Do not send passwords, credentials or unnecessary sensitive data. | Article 6(1)(b) GDPR for enquiries about entering into or performing a contract; otherwise Article 6(1)(f) for handling correspondence. |
| Customer account | Email address, profile details, account ID, authentication and session data: creating an account, signing in, recovering access and providing linked services. | Article 6(1)(b) GDPR for the account service; Article 6(1)(f) for preventing misuse and protecting access. |
| Licences and activations | Customer and product IDs, licence entitlements, device identifiers or their hashes and activation status: managing the licence and device limits. | Article 6(1)(b) GDPR for performing the licence agreement; Article 6(1)(f) for detecting misuse and protecting software rights. |
| Live file inbox | Your alias, message, files and metadata, inbox ID, access details and account link if present: receiving, processing and returning material. Send only material for which you have the necessary rights. | Article 6(1)(b) GDPR for steps requested before a contract or its performance; Article 6(1)(f) for securing private transfers. |
| Optional external content | Connection data sent to the player provider, including IP and device information, followed by data relating to use of its service. | Article 6(1)(a) GDPR — your consent to load embedded content. Device access and consent are explained in the cookie policy. |
| Records and claims relating to our work together | Contract details, correspondence and billing documents arising from a service: meeting legal obligations and establishing, exercising or defending claims. | Article 6(1)(c) GDPR for applicable German legal obligations; Article 6(1)(f) for protecting rights. |
Form details are voluntary, but I cannot reply without an email address and an explanation of your enquiry. Accounts, licences and file transfers require information needed for that service. Consent to optional content is not required to read other content or send an ordinary enquiry. You do not need to consent to data processing simply to contact me about a service.
The current shop presents products; planned sales do not mean checkout is active. I do not collect payment card details while you browse these offers. Information about future payments must be updated before that function is enabled.
3. Who receives data?
- OVHcloud — hosting provider for the current website, handling file delivery and technical connection data. Hosting and the shop run on OVH with PrestaShop.
- PrestaShop — shop software running on OVH infrastructure. It handles the catalogue, cart, orders and shop customer data; it is not a separate data controller.
- Google — provider of Gmail used for correspondence, and of YouTube and Google Maps. YouTube players may transfer data to Google Ireland Limited and related entities under that service’s rules.
- Google and Facebook sign-in providers — choosing their button takes you to their service. Shared data depends on the provider and permissions shown during sign-in, and is used to link and authenticate your account.
- TikTok — if you load the embedded profile on the Live page or visit that platform. The provider processes data there under its own rules.
Data may be disclosed where necessary to competent authorities as required by law, and to parties handling a legal or billing matter. Placing material in a private Live inbox does not constitute consent to public publication.
4. Processing outside the European Economic Area
Using OVH, PrestaShop and global Google, Facebook or TikTok services may involve processing outside the EEA. This does not mean all data stays exclusively in Poland, Germany or on OVH.
Shop and account data is stored on OVH in the EEA. Google, Facebook and TikTok describe transfer mechanisms in their policies. I do not assign a single transfer basis to every provider.
Details and safeguards: Google’s data transfer rules, Facebook’s privacy policy and TikTok’s privacy policy. You can also ask me about safeguards applying to the processing of your data.
5. How long do I keep data?
From 20 October 2026 I apply the following retention and deletion rules. Periods relate to specific purposes; they do not mean all correspondence, files and account data are kept as long as invoices. Where less data is sufficient, I retain only that subset.
| Data type | Period or criterion |
|---|---|
| Ordinary enquiries not resulting in a contract | Up to six months after the last substantive message in a closed matter. Automatic notifications do not extend the period. If an enquiry becomes a commission, necessary records move to the appropriate category below. |
| Working material and project arrangements | During the work; project working files normally up to 30 days after completion and delivery of the agreed result. Longer file retention requires a separate agreed purpose and end date, such as commissioned archiving. Necessary contract and billing evidence is kept separately under the relevant category; this does not justify retaining every recording. |
| Customer account | While the account is in use; profile data is normally deleted or anonymised within 30 days after closure. Accounts without active commissions or entitlements needing support are considered for closure after 24 months of inactivity, with advance notice and at least 30 days to respond. Inactivity alone does not remove a valid licence. |
| Licences and activations | Minimum entitlement and assigned-device data for the duration of the licence and activation support; for perpetual licences, as long as needed to provide that entitlement. Afterwards, only billing or specific claim-related information is retained. Historical auxiliary activation logs are deleted after 90 days unless needed to investigate an incident. Deleting a profile does not regenerate keys or invalidate a lawfully acquired licence. |
| Private Live inbox and files | Inbox access expires 90 days after creation. Content and technical records are then scheduled for administrative deletion, no later than day 120. Earlier project completion may justify earlier deletion under working-material rules. Longer archiving is agreed separately. Link expiry alone does not delete files. |
| Technical logs and diagnostics | My own logs and exports used for ongoing diagnostics are kept up to 30 days after recording. For a specific incident, only necessary evidence is separated and retained until investigation ends or for the applicable claims period. This does not justify indefinite storage of complete logs. |
| My own backups | On a cycle of up to 30 days. Deleted data may remain until then in isolated copies not used for routine operations. Restores take previous deletion requests into account. Copies needed for a specific legal duty or dispute are separated for that purpose only. Migration copies remain until restoration is verified and migration finishes, then are deleted within 30 days unless a particular document has a separate retention duty. |
| Invoices and records subject to retention duties | Under applicable German duties: invoices and accounting vouchers generally eight years; required books, inventories and financial statements ten years; business correspondence and other covered documents generally six years. The relevant period normally starts at the end of the calendar year specified by law. A particular document’s duty may be extended, for example by tax proceedings; this does not automatically apply to all customer data. |
| Establishing, exercising or defending claims | Only data genuinely necessary for the matter. The standard German limitation period is generally three years; its start depends on matters including the claim arising and knowledge of it, normally at the end of the relevant year. Different periods, suspensions or proceedings are applied only to the specific case. Separated material is deleted when its basis ends. |
| Privacy choices and browser data | The application respects the panel choice for up to 180 days. Other mechanisms follow separate cookie-policy rules; not all localStorage entries expire automatically. |
Mandatory retention is based in particular on § 14b UStG, § 147 AO and, where applicable to the document and business activity, § 257 HGB. Standard limitation periods are governed by § 195 and § 199 BGB. Operational periods of six months and 30, 90 and 120 days are organisational rules, not universal deadlines imposed by the GDPR.
Deletion process: I use reviews and administrative actions in each service. Publishing this policy does not itself start automatic deletion. Deletion also covers relevant PrestaShop submissions, correspondence, records and files unless a separate retention basis exists. Where a provider must act, I send an appropriate request. I review retention at least monthly and plan deletion to meet the stated periods.
The 30-day period for my own logs and copies does not declare changed provider settings or deletion of every copy at OVH, PrestaShop or Google. Providers may separately process data for their own security and legal duties under their rules. I include data entrusted to them in deletion through available functions or provider requests; technical limits do not justify indefinite storage of my exports. Contact me for information about your data in a particular service.
6. Your rights and how to exercise them
Subject to GDPR rules and exceptions, you may request access and a copy, correction, deletion and restriction. Portability applies to data processed automatically on consent or contract grounds. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. An objection to direct marketing needs no such justification.
You may withdraw consent at any time without affecting the lawfulness of earlier processing. The cookie policy explains how to disable embedded content. Send other requests to serwishamburg@gmail.com. To protect your data, I may ask for proportionate identity verification. I normally respond within one month; in cases allowed by the GDPR, this may be extended by two months, with notice during the first month.
You may complain to a supervisory authority, particularly in the country of your habitual residence, workplace or alleged infringement. In Poland this is the President of the Polish Personal Data Protection Office. The locally competent authority for a business based in Wedel is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein. You are not limited to a German authority simply because my business is based there.
7. Automated decisions and document changes
The website automatically checks account, licence and file permissions and applies security limits. This is not intended to make decisions producing legal or similarly significant effects on you under Article 22 GDPR. External platform providers explain their own processing.
The document will be updated if website operation or services change. A text change does not expand earlier consent. The current dated version remains available at the same address.