effective from 1 September 2026
1. General information
This Privacy Policy sets out the rules for the processing of personal data of users of the website okulary-3d.pl, hereinafter referred to as the “Portal”, as well as the rules for the use of cookies and similar technologies.
This Policy applies in particular to:
browsing publicly available content on the Portal,
creating and maintaining a User Account,
using the Community Gallery,
using 3D LAB tools,
using functionalities based on artificial intelligence,
contacting the Operator,
subscribing to the newsletter,
using the online store operating within the okulary-3d.pl domain,
technical and analytical data related to the use of the Portal.
The rules governing purchases are set out in the separate Online Store Terms and Conditions. This Privacy Policy also applies to the processing of personal data related to order fulfilment.
2. Personal Data Controller
The Controller of personal data is:
Elvenica Spółka z ograniczoną odpowiedzialnością
ul. Polna 4
87-162 Lubicz Górny
Poland
KRS: 0001213772
NIP: 8792772945
REGON: 543608391
website: https://okulary-3d.pl
contact regarding personal data:
In the remainder of this Policy, the Controller may also be referred to as the “Operator”.
3. Basic principles of personal data processing
The Operator processes personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data Protection Regulation (“GDPR”).
Personal data is processed:
lawfully, fairly and transparently,
only for specified and legitimate purposes,
only to the extent necessary for those purposes,
for no longer than necessary,
with appropriate technical and organisational safeguards.
The Operator does not require Users to provide personal data which is not necessary for the use of a specific functionality of the Portal.
4. What data may be processed
The scope of personal data processed depends on how the User interacts with the Portal.
4.1. Using the Portal without an Account
When browsing the Portal without logging in, technical data may be processed, including:
IP address,
date and time of connection,
URL of the visited page,
browser information,
operating system and device type,
session information,
data stored in technically necessary cookies,
information relating to errors and system security.
Some of this data may not directly identify a specific person, but it may nevertheless constitute personal data under applicable law.
5. User Account
Creating an Account allows the User to access functionalities intended for registered users.
During registration, the following data may in particular be processed:
first name or username,
email address,
password stored in an appropriately secured form,
date of Account creation,
information regarding acceptance of required terms and privacy documents,
information relating to Account activity,
technical information relating to login and security.
Passwords used to access the Account should not be stored by the system in plain text.
Purpose of processing
Personal data is processed for the purpose of:
creating the Account,
authenticating the User,
providing services available after login,
enabling Account management,
ensuring Account security,
preventing misuse and abuse.
Legal basis
The legal basis for such processing is primarily:
Article 6(1)(b) GDPR – processing necessary for the performance of a contract for the provision of electronic services or to take steps at the request of the User prior to entering into such a contract.
For security purposes, abuse prevention and protection of the Operator’s rights, the legal basis may also be:
Article 6(1)(f) GDPR – the legitimate interests pursued by the Controller.
6. Community Gallery
Registered Users may be able to upload their own works to the Gallery, in particular stereoscopic pairs, photographs and other materials relating to 3D imaging.
In connection with the use of the Gallery, the following data may be processed:
User identifier,
author name displayed in the Gallery,
uploaded photographs and other files,
titles and descriptions of works,
information relating to publication and moderation,
date of upload,
other information voluntarily included by the User in the submitted material.
Materials intended for publication in the public Gallery may be publicly displayed together with information about the author, in accordance with the Portal settings and applicable rules.
The User should upload only materials for which they have the necessary rights.
If an uploaded photograph contains identifiable individuals, the User should have an appropriate legal basis allowing the transfer and publication of their image.
The Operator may moderate submitted materials before publication.
7. 3D LAB – local image processing
Certain 3D LAB tools may process images directly in the User’s web browser.
If a specific tool states that the file is processed locally:
the image is not uploaded to the Operator’s server for the purpose of performing that operation,
the Operator does not receive the contents of the file solely because the User has used the tool,
processing is carried out using the resources of the User’s device.
This may apply, for example, to:
image format conversion,
anaglyph generation,
preparation of stereoscopic pairs,
other image-processing operations performed directly by browser-side code.
The information displayed directly within a given tool specifies the processing method used by that functionality.
If, in the future, the method of operation of a particular tool changes and files are uploaded to a server, the User will be appropriately informed.
8. Artificial Intelligence functionalities
The Portal may provide services using artificial intelligence systems, including generative AI models.
Such functionalities may in particular be used for:
generating images,
modifying images,
improving image quality,
reconstructing photographs,
style transformation,
removing or adding elements,
analysing images,
transforming 2D and 3D materials,
generating text,
creating other digital content.
Some of these services may be paid services.
8.1. Uploading files to an AI service
Unlike tools operating locally in the browser, some AI functions may require the file to be uploaded:
to the Operator’s server, or
to an external AI technology provider.
Before using a function which requires such transfer, the User should receive information about the processing method applicable to that particular tool.
The following data may be processed:
the uploaded image or other file,
the User’s text prompt,
generation parameters,
output file,
technical information regarding the operation,
User identifier,
information concerning usage limits or payment.
The legal basis for processing data necessary to provide the requested service is generally:
Article 6(1)(b) GDPR.
8.2. Images and personal data of third parties
An uploaded image may contain personal data of other individuals, in particular their likeness.
The User should use such materials only where they have a lawful basis for their use and processing through the selected functionality.
Users should not unnecessarily upload to AI systems:
identity documents,
financial information,
medical documentation,
confidential information,
special categories of personal data,
materials containing personal data of third parties where such processing is not necessary or lawful.
9. Paid digital functionalities
Certain functionalities of the Portal, in particular those requiring paid AI models, external APIs or significant computing resources, may be subject to a fee.
In such cases, the following data may be processed:
Account identifier,
email address,
history of performed operations,
information about purchased limits or services,
payment identifier,
payment status,
data required for accounting documents.
The legal basis may include:
Article 6(1)(b) GDPR – performance of a contract,
Article 6(1)(c) GDPR – compliance with legal obligations, including tax and accounting obligations,
Article 6(1)(f) GDPR – establishment, exercise or defence of legal claims.
10. Online Store
An online store operates or may operate within the okulary-3d.pl domain.
In connection with placing an order, the following data may in particular be processed:
first name and surname,
company name,
address,
delivery address,
email address,
telephone number,
tax identification number or other information required to issue accounting documents,
order information,
payment information,
delivery information,
order fulfilment history,
information relating to complaints, returns or withdrawal from the contract.
The legal basis for processing is, as applicable:
Article 6(1)(b) GDPR – conclusion and performance of the contract,
Article 6(1)(c) GDPR – obligations under tax, accounting and consumer protection laws,
Article 6(1)(f) GDPR – establishment, exercise or defence of legal claims.
The detailed rules governing purchases are set out in the separate Online Store Terms and Conditions.
11. Payments
Where payment is processed by an external payment service provider, part of the information necessary to process the transaction is transferred to that provider.
The Operator receives data necessary to confirm and reconcile the transaction, including in particular:
transaction identifier,
amount,
currency,
payment status,
information allowing the payment to be assigned to a specific order or service.
The scope of data processed directly by the payment service provider is also governed by that provider’s own privacy policy.
12. Contact with the Operator
If the User contacts the Operator by email, contact form or by other means, the following data may be processed:
first name and surname or name provided by the User,
email address,
telephone number, if provided,
content of the message,
attachments,
other information voluntarily provided by the User.
Depending on the nature of the inquiry, the legal basis is:
Article 6(1)(b) GDPR, where the contact concerns a contract or steps taken prior to entering into a contract,
Article 6(1)(f) GDPR, i.e. the legitimate interest of the Operator in conducting correspondence, responding to inquiries and handling requests,
Article 6(1)(c) GDPR, where further retention of certain information is required by law.
13. Newsletter
The User may voluntarily subscribe to the Portal newsletter.
For this purpose, the following data is processed in particular:
email address,
date of subscription,
information necessary to document consent,
information concerning email address confirmation,
information concerning withdrawal from the newsletter.
The legal basis for processing newsletter data is:
Article 6(1)(a) GDPR – the User’s consent.
The sending of commercial information by electronic means is also carried out in accordance with the applicable Polish electronic communications legislation.
Newsletter consent:
is voluntary,
is not a condition for having an Account,
may be withdrawn at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
The User may unsubscribe, in particular, using the unsubscribe function contained in the newsletter or by contacting the Operator.
14. Technical data, logs and security
The Portal server may automatically record technical information relating to requests made to the system.
Such information may include:
IP address,
date and time of connection,
URL address,
server response code,
browser information,
operating system information,
technical session identifiers,
application error information,
information concerning login attempts.
This data may be used for:
ensuring proper functioning of the Portal,
protecting against attacks and abuse,
detecting errors,
diagnosing technical problems,
ensuring service continuity and security.
The legal basis for processing is:
Article 6(1)(f) GDPR – the legitimate interest of the Controller in maintaining security and proper operation of the system.
15. Portal analytics
The Operator may maintain statistics concerning the use of the Portal in order to understand how the service is used and to further improve it.
Depending on the technology used, the following information may be analysed:
visited pages,
source of the visit,
length of visit,
type of device,
general browser information,
use of individual Portal functionalities,
events relating to the use of Portal tools.
Where an analytics system requires storing or accessing information on the User’s device and this is not strictly necessary for providing the requested service, it will be activated only after obtaining the required consent.
Where possible, the Operator may also use aggregated or anonymous statistics which do not constitute personal data.
16. Cookies and similar technologies
The Portal uses cookies and similar information storage technologies.
Cookies are small pieces of information stored on the User’s device by the web browser.
16.1. Necessary cookies
Necessary cookies may be used, in particular, to:
maintain a session,
log a User in,
protect forms,
remember basic settings required for the operation of the service,
operate the shopping cart,
ensure security.
Where a specific item of information is necessary to provide a service explicitly requested by the User, its use does not require consent applicable to optional cookies.
16.2. Functional cookies
Functional cookies may be used to remember additional User preferences.
If they are not necessary for the operation of the requested functionality, they may be activated only after consent has been given.
16.3. Analytics cookies
Analytics cookies may be used to measure traffic and the way in which the Portal is used.
Where they require access to information stored on the User’s device, they are activated in accordance with the User’s consent choices.
16.4. Marketing cookies
If the Portal uses marketing or advertising technologies requiring consent, they will be activated only after such consent has been obtained.
The User may refuse such consent without losing access to the basic functions of the Portal.
17. Managing cookie consent
During the first visit to the Portal, the User may be given the opportunity to define their preferences regarding optional cookies.
The User should be able to:
accept selected categories,
reject non-essential technologies,
modify a previous choice.
Consent may also be changed or withdrawn after it has been given.
The User may additionally manage cookies through the settings of their web browser.
Deleting technical cookies may result in, among other things:
being logged out,
loss of session settings,
loss of unsaved shopping cart contents,
the need to set certain preferences again.
18. Recipients of personal data
Personal data may be disclosed only to entities whose participation is necessary for the provision of services or compliance with the Operator’s obligations.
These may include, in particular:
hosting and server infrastructure providers,
IT service providers and system administrators,
email service providers,
newsletter delivery providers,
payment service providers,
banks,
courier companies and postal operators,
accounting system providers,
accounting offices,
analytics providers, if activated in accordance with applicable consent rules,
AI model and service providers, if the User uses a functionality requiring such a provider,
entities providing technical support or system security.
Entities processing data on behalf of the Operator receive it only to the extent necessary to perform the tasks entrusted to them.
Personal data may also be disclosed to authorised public authorities where such disclosure is required by law.
19. AI providers and transfers outside the European Economic Area
Some current or future AI functionalities may use providers whose infrastructure is located outside the European Economic Area.
Where the use of a specific service involves transferring personal data to a third country, the Operator applies an appropriate legal transfer mechanism under the GDPR, in particular:
an adequacy decision adopted by the European Commission, or
Standard Contractual Clauses approved by the European Commission together with any additional safeguards required by law.
Information regarding entities involved in providing a specific functionality may also be presented directly within that service.
The Operator should select technology providers taking into account personal data protection and information security requirements.
20. External links and embedded content
The Portal may contain:
links to external websites,
embedded content,
links to social media services,
videos or other elements provided by third parties.
When the User enters an external website, further processing of personal data may be carried out in accordance with the privacy rules of the operator of that website.
The Operator of okulary-3d.pl is not responsible for the privacy practices of independent external websites.
Where a third-party component embedded directly in the Portal requires optional cookies or similar technologies, it should be activated in accordance with applicable consent requirements.
21. Data retention periods
Personal data is not stored for longer than necessary.
The retention period depends on the purpose of processing.
User Account
Data related to the Account is processed for the period during which the Account remains active.
After Account deletion, certain data may be retained where necessary:
to comply with legal obligations,
to handle complaints,
to establish, exercise or defend legal claims,
to ensure system security.
Orders and payments
Data is stored for the period necessary to perform the contract and subsequently for the period required by tax, accounting and other applicable laws, as well as for the relevant limitation period for legal claims.
Newsletter
Newsletter data is processed until consent is withdrawn or the newsletter service is discontinued.
Information allowing the Operator to demonstrate that consent was given or withdrawn may be retained for as long as necessary to demonstrate compliance with legal obligations.
Correspondence
Correspondence is retained for the period necessary to handle the matter and, where justified, for the period necessary to protect against possible legal claims.
Technical logs
Logs are retained for a period justified by system security, diagnostics and maintenance needs, after which they are deleted or anonymised unless further retention is necessary due to a specific security incident or legal obligation.
Data processed by AI
Files submitted to a specific AI service are retained only for the period resulting from the operation of that functionality, technical requirements and the applicable rules of the relevant service provider.
Where a file can be deleted immediately after completion of the operation, the Operator should limit retention to the minimum technically necessary period.
22. Rights of data subjects
Subject to the conditions set out in the GDPR, each data subject has the following rights:
Right of access
A person may obtain information as to whether the Operator processes personal data relating to them and may obtain access to that data.
Right to rectification
A person may request correction of inaccurate data or completion of incomplete data.
Right to erasure
In the circumstances specified in the GDPR, a person may request deletion of their personal data.
This right is not absolute. Certain data may continue to be stored where required by law or where necessary for the establishment, exercise or defence of legal claims.
Right to restriction of processing
In cases provided for by the GDPR, a person may request restriction of the way in which their personal data is processed.
Right to data portability
Where processing is based on consent or contract and is carried out by automated means, a person may have the right to receive their data in a structured, commonly used and machine-readable format and to transmit it to another controller.
Right to object
Where personal data is processed on the basis of the legitimate interests of the Controller, a person may object to such processing on grounds relating to their particular situation.
Where data is processed for direct marketing purposes, the person may object at any time.
Right to withdraw consent
Where processing is based on consent, the person may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
23. How to exercise your rights
Any request concerning personal data may be sent to:
The request should describe the matter sufficiently to allow the Operator to determine what action is requested.
Where the Operator has reasonable doubts regarding the identity of the person making the request, additional information necessary to verify identity may be requested.
The Operator will not request additional data solely for identification purposes where this is not necessary.
24. Right to lodge a complaint
If a User believes that their personal data is being processed unlawfully, they have the right to lodge a complaint with the supervisory authority:
President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych – UODO)
Poland.
Information about lodging complaints is available on the website of the Personal Data Protection Office.
Exercising the right to lodge a complaint does not limit the right to use other legal remedies.
25. Voluntary provision of data
Providing personal data is generally voluntary.
However, some personal data is necessary to use a particular service.
For example:
without an email address and the data required by the registration form, it is not possible to create an Account,
without contact details, it may not always be possible to respond to an inquiry,
without delivery information, it is not possible to fulfil an order requiring shipment,
without data required by law, the appropriate accounting document cannot be issued,
without uploading an image, an AI service requiring analysis or modification of that image cannot be performed.
Refusing consent to optional analytics or marketing cookies should not prevent the User from accessing the core functionalities of the Portal.
26. Automated decision-making and profiling
The mere use of automated image processing tools or generative AI does not mean that automated decisions within the meaning of Article 22 GDPR are being taken with respect to the User.
The Operator does not use User data to make decisions based solely on automated processing which produce legal effects concerning the User or similarly significantly affect them, unless the User is appropriately informed before such functionality is introduced.
Data may be used for ordinary analysis of the operation of the Portal and for statistical purposes, subject to the User’s privacy settings.
27. Data security
The Operator applies appropriate technical and organisational measures intended to protect personal data against:
loss,
unauthorised access,
unauthorised disclosure,
alteration,
destruction,
unlawful use.
The level of security is adjusted to the nature of the system, the type of personal data processed and the level of risk.
Access to personal data should be granted only to persons and entities for whom such access is necessary to perform their duties.
The Operator develops the system with the principles of privacy by design and privacy by default in mind.
28. Backups
Data contained in the system may be included in technical backups created to ensure service continuity, security and restoration of the system after a failure.
Data stored in backups is not used for purposes other than security and system restoration.
Deleted data may remain in existing backups for a limited period until those backups are rotated, replaced or overwritten.
29. Personal data breaches
In the event of a personal data breach, the Operator assesses its potential impact and takes the actions required under the GDPR.
Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, affected individuals will be informed where required by law.
30. Changes to this Privacy Policy
This Privacy Policy may be updated, in particular, in the event of:
development of the Portal,
introduction of new functionalities,
changes in data processing methods,
introduction of new AI tools,
changes in technology providers,
introduction of new payment or delivery systems,
changes in applicable law.
The current version of the Privacy Policy is published on the Portal.
If a change materially affects the processing of data of Registered Users, the Operator may additionally notify them by an appropriate notice or email.
A change to this Privacy Policy does not in itself constitute a legal basis for processing data for a new purpose where applicable law requires separate User consent for such processing.
31. Contact
For any questions regarding privacy or personal data processing, please contact:
Data Controller:
Elvenica Sp. z o.o.
ul. Polna 4
87-162 Lubicz Górny
Poland
KRS: 0001213772
NIP: 8792772945
REGON: 543608391
Portal: okulary-3d.pl