PRIVACY POLICY
Last updated: 29 july 2026

General Information
This Privacy Policy explains how Water Witch Sp. z O.O., operating under the business name Water Witch RPG Studio (“we”, “us”, “our” or the “Company”), collects, uses, stores and protects personal data in connection with the use of the website https://waterwitchrpgstudio.com (the “Website”).
We process personal data in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, commonly known as the General Data Protection Regulation (“GDPR”);
• applicable Polish data protection legislation; and
• other applicable laws governing electronic communications and online services.

This Privacy Policy applies to visitors to the Website, persons who contact us through the Website or by e-mail, business representatives and other persons whose personal data we process through the Website.
If you have any question regarding your privacy, you may contact us by email or traditional mail at the address: ul. Al. BOLESŁAWA KRZYWOUSTEGO, 4/1, 40-870, KATOWICE, POLAND
We have not appointed a Data Protection Officer unless expressly indicated otherwise on the Website.

Personal Data We Collect
Depending on how you use the Website, we may collect the following categories of personal data.
When you contact us through a contact form, by e-mail or through another communication channel, we may process if provided:

• your name and surname;
• your e-mail address;
• your telephone number;
• your company name and professional position;
• information about your project, business or inquiry;
• the content of your correspondence;
• files, references, briefs or other materials submitted by you; and
• any other information you voluntarily provide.

Please do not provide special categories of personal data, such as information concerning health, racial or ethnic origin, political opinions, religious beliefs or sexual orientation, unless it is strictly necessary and we have expressly requested it.
When you visit the Website, certain technical information may be collected automatically, including:

• IP address;
• browser type and version;
• device type;
• operating system;
• language settings;
• date and time of access;
• pages visited;
• referring website;
• server logs;
• information concerning errors, security incidents and Website performance; and
• cookie identifiers and similar technical identifiers, where applicable.

Some of this information may constitute personal data under applicable law.
We may use cookies, local storage, pixels, tags, scripts and similar technologies.
Detailed information about these technologies is provided in our Cookie Policy.
Non-essential cookies, including analytics, functionality and marketing cookies, will be used only where permitted by applicable law and, where required, after obtaining your consent.

Purposes and Legal Bases of Processing
We process personal data only where we have a lawful basis under the GDPR.
We process your contact details, correspondence and information concerning your inquiry in order to:

• respond to your questions;
• discuss potential cooperation;
• prepare an offer or estimate;
• arrange a meeting; and
• take steps at your request before entering into a contract.

The legal basis is:

• Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract; or
• Article 6(1)(f) GDPR, based on our legitimate interest in communicating with persons interested in our services.

Where you are our customer, contractor, supplier or business partner, we may process personal data in order to:

• enter into and perform a contract;
• manage projects and communication;
• issue invoices and process payments;
• deliver services and project files;
• maintain business records; and
• handle claims or disputes.

The legal basis is:

• Article 6(1)(b) GDPR, where you are a party to the contract;
• Article 6(1)(f) GDPR, where we process the data of representatives, employees or collaborators of a contracting entity; and
• Article 6(1)(c) GDPR, where processing is required to comply with legal obligations, including accounting and tax obligations.

We may process technical data and server logs in order to:

• operate and maintain the Website;
• detect errors and technical problems;
• prevent unauthorized access, fraud, abuse and cyberattacks;
• protect our systems, users and business interests; and
• establish, exercise or defend legal claims.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in maintaining a secure and functional Website and protecting our legal rights.
Where analytics tools are used, we may process information about visits, devices and Website interactions in order to:

• understand how visitors use the Website;
• measure Website traffic and performance;
• improve Website content and usability; and
• evaluate the effectiveness of our communications.

Where required by law, the legal basis is your consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time through the cookie preference tool available on the Website.
We may send marketing communications only where:

• you have expressly consented to receive them;
• applicable law otherwise permits us to do so; or
• the communication is directed to an existing business contact and is lawful under the circumstances.

The legal basis:

• Article 6(1)(a) GDPR, based on your consent; or
• Article 6(1)(f) GDPR, where permitted, based on our legitimate interest in promoting our services to relevant business contacts.

Where consent is legally required under electronic communications or direct marketing laws, we will obtain such consent separately.
You may withdraw your consent or object to direct marketing at any time.
We may process personal data to comply with:

• tax and accounting requirements;
• requests from courts, regulators or public authorities;
• legal recordkeeping requirements; and
• other obligations imposed by applicable law.

The legal basis is Article 6(1)(c) GDPR.
We may process personal data for the establishment, exercise or defence of legal claims.
The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in protecting our rights and interests.

Whether Providing Data Is Mandatory
Providing personal data through the Website is generally voluntary.
However, certain data may be necessary for us to:

• respond to your inquiry;
• prepare an offer;
• enter into or perform a contract;
• process a payment; or
• comply with legal obligations.

If you do not provide the necessary information, we may be unable to respond to your request or provide the requested services.

Recipients of Personal Data
We may disclose personal data only where reasonably necessary and legally permitted.
Recipients may include:

• hosting and cloud service providers;
• e-mail and communication service providers;
• website developers and technical support providers;
• analytics and cookie management providers;
• project management and customer relationship management providers;
• accounting, tax and payment service providers;
• professional advisers, including lawyers and accountants;
• subcontractors involved in providing our services;
• public authorities, courts and regulators where disclosure is legally required; and
• potential purchasers, successors or advisers in connection with a corporate transaction.

These recipients may process personal data on our behalf as processors or for their own purposes as independent controllers.
Where required, we enter into appropriate data processing agreements with service providers processing personal data on our behalf.

Third-Party Services and Embedded Content
The Website may contain embedded content or links to third-party services, including, for example:

• YouTube;
• Vimeo;
• ArtStation;
• Instagram;
• LinkedIn;
• Discord;
• X;
• Google services; or
• other portfolio, video, social media or communication platforms.

Embedded content may allow the relevant third party to collect information about your device and interaction with the embedded element.
Where technically possible and legally required, non-essential third-party content will not be loaded until you provide the appropriate consent.
Third-party websites and services operate under their own privacy policies. We are not responsible for their independent processing activities.

International Transfers of Personal Data
Some of our service providers may process personal data outside the European Economic Area (“EEA”).
Where personal data are transferred outside the EEA, we use an appropriate transfer mechanism where required, such as:

• an adequacy decision adopted by the European Commission;
• the European Commission’s Standard Contractual Clauses;
• supplementary technical and organizational safeguards; or
• another lawful transfer mechanism permitted under the GDPR.

You may contact us for further information about the safeguards applicable to a particular transfer.

Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected and to comply with legal obligations.
In particular:

• data relating to contracts may be retained for the duration of the contractual relationship and thereafter for the applicable limitation period;
• invoices and accounting records may be retained for the period required under Polish tax and accounting laws;
• data processed for direct marketing may be retained until consent is withdrawn or an objection is made;
• consent records may be retained for as long as necessary to demonstrate compliance;
• server and security logs may generally be retained for 180 days, unless a longer period is necessary to investigate an incident; and
• cookie-related data are retained for the periods specified in the Cookie Policy.

Personal data may be retained for a longer period where necessary for the establishment, exercise or defence of legal claims or where required by law.

Your Rights
Subject to the conditions and limitations set out in the GDPR, you have the right to:

• obtain confirmation as to whether we process your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on our legitimate interests;
• object at any time to processing for direct marketing;
• receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and
• lodge a complaint with a competent supervisory authority.

Requests may be submitted to [PRIVACY EMAIL].
We may need to verify your identity before responding to a request.

Right to Lodge a Complaint
You have the right to lodge a complaint with the Polish supervisory authority:
President of the Personal Data Protection Office
Prezes Urzędu Ochrony Danych Osobowych
You may also contact the supervisory authority in the EU or EEA Member State of your habitual residence, place of work or place of the alleged infringement.

Automated Decision-Making and Profiling
We do not use personal data collected through the Website to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
If this changes, we will provide the information required by applicable law.
Any basic audience segmentation or analytics performed through cookies will be described in the Cookie Policy and, where required, will be subject to your consent.

Data Security
We use appropriate technical and organizational measures designed to protect personal data.
These measures may include access controls, encrypted connections, backups, restricted user permissions, software updates and contractual safeguards with service providers.
However, no online transmission or storage system can be guaranteed to be completely secure.

Children’s Privacy
The Website is intended for business and general audiences and is not directed specifically at children.
We do not knowingly collect personal data from children through the Website.
If you believe that a child has provided us with personal data without appropriate authorization, please contact us so that we can review and, where appropriate, delete the information.

External Links
The Website may contain links to websites operated by third parties.
We are not responsible for the privacy practices, security or content of third-party websites. You should review the privacy policy of each external website you visit.

Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
The updated version will be published on the Website together with the revised “Last updated” date.