How I handle your data.

Last updated: 9 October 2026

Who is responsible for your data

This website is run by Magdalena Leszczynska Photography, a sole trader business owned by Magdalena Leszczyńska. I am the controller of the personal data described here.

This policy covers the website and my dealings with clients and customers. How photographs from an event or a shoot may be used is agreed with the client for each booking.

What I collect, and why

Booking requests and messages. When you send the booking form or email me, I receive your name, email address and what you tell me about your event or shoot. I use this to answer you and, if you book, to plan and carry out the work. The legal basis is taking steps at your request before a contract, and my legitimate interest in answering enquiries.

Print orders. When you buy a print, I receive your name, email address, delivery address, what you ordered and what you paid. Payment is handled by Stripe or PayPal; I never see or store your full card details. I use this information to produce and deliver your print and to handle returns and complaints. The legal basis is the purchase contract, and my legal obligation to keep accounting records.

Reviews. When you send a review, I receive your name, your rating and text, what the review is about and, if you choose to give it, your email address. With your consent I publish your name, rating, text and what it is about on this website. Your email address is never published. You can withdraw your consent at any time by emailing me, and I will remove the review.

Withdrawals and complaints. If you withdraw from a purchase or make a complaint, I use your name, contact details and order details to handle it. The legal basis is my legal obligations as a seller.

I do not use your details for newsletters or advertising, and I do not sell them.

Who receives your data

I share personal data only with the services I need to run this website and the shop:

• Netlify hosts the website and receives what you send through the forms (booking, review, withdrawal). To deliver the pages, it also processes technical data such as your IP address.
• Stripe and PayPal process payments. They are independently responsible for the payment data they handle, under their own privacy policies.
• My print partner in Sweden receives your name, delivery address and order so that the print can be produced and shipped to you.
• My email provider stores the messages we exchange.
• Google Fonts supplies the typefaces on this website. Your browser fetches them from Google's servers, which means Google receives your IP address.

Some of these companies process data outside the EU/EEA, mainly in the United States. In those cases the transfer relies on safeguards recognised under EU data protection law, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies

This website does not set cookies of its own and does not use analytics or advertising trackers. PayPal's payment button is loaded only when you reach the shop section; from then on PayPal may set cookies that it needs for payments and fraud prevention. Card payments open on Stripe's own checkout page, which is covered by Stripe's cookie policy.

How long I keep it

• Enquiries that do not lead to a booking: up to 12 months after our last contact.
• Bookings and print orders: the records I must keep for bookkeeping are stored for seven years after the end of the financial year, as Swedish accounting law requires.
• Published reviews: until you ask me to remove them.
• Unpublished reviews: up to 12 months.

Your rights

You have the right to ask for a copy of the personal data I hold about you, to have it corrected or deleted, to have its use restricted, to object to its use, and to receive data you gave me in a portable format. Where I rely on your consent, you can withdraw it at any time. To use any of these rights, email contact@magdalenaleszczynska.photography.

If you think I am handling your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority in your own country.

Changes to this policy

If I change how I handle personal data, I will update this page and the date at the top.