Legal
Privacy Policy
Last updated: 17 September 2026Effective from: 17 September 2026Version 2026-09-17
This Privacy Policy explains how Oliwier Zaremba – RMXVisual processes personal data in connection with RemiXiss.
RemiXiss has two distinct roles. For photographer accounts, billing metadata, security and service operation, the Service Provider generally acts as controller. For photographs, gallery content and client-related data that a Photographer uploads or creates in order to deliver work to that Photographer’s clients, the Photographer generally determines the purpose of processing and the Service Provider acts as processor. The Service Provider may still act as an independent controller for security, fraud-prevention and infrastructure data generated while providing the platform.
1. Controller identity
The controller for RemiXiss service and account data is:
Oliwier Zaremba – RMXVisual Górnośląska 21A 62-800 Kalisz Poland kontakt@rmxvisual.pl
No data protection officer has been appointed for publication in this Policy.
2. Controller and processor roles
The Photographer determines the purpose of processing their client and gallery content. RemiXiss provides the infrastructure required to host and deliver it, under the Data Processing Agreement.
A. RemiXiss acting as controller
- Photographer account information (name, email, display name, profile/branding settings)
- Authentication data (password hashes, sessions)
- Security and service logs, including IP address and browser user-agent stored with photographer sessions
- Subscription and billing metadata (plan, Stripe customer/subscription identifiers, status, period dates)
- Support and service communications, including password-reset email
- Abuse-prevention and platform-security information
B. RemiXiss acting as processor on behalf of Photographers
- Photographs and media uploaded by Photographers
- Gallery content, names, appearance and access settings
- Client names or identifiers supplied by Photographers, including gallery login identifiers
- Gallery access credentials (stored as a password hash)
- Client-related metadata and content supplied for delivery to Clients
- Gallery statistics events generated when Clients view, log in or download
3. Categories of personal data
- Identity and contact data for Photographers
- Account credentials and session data
- Gallery and media metadata; original files and generated derivatives
- Gallery client identifiers and access credentials
- Billing metadata; payment-card data handled by Stripe
- Gallery visitor identifiers (random first-party IDs, not advertising profiles)
- Technical data: IP address and user-agent on photographer sessions; request logs generated by hosting
4. Sources of personal data
Data comes from Photographers (registration, profile, uploads, gallery settings), from Clients using a gallery (login, viewing, downloading), from Stripe (subscription events), and from the technical operation of the Service (sessions, hosting logs, gallery statistics events).
5. Purposes of processing
- Providing photographer accounts and client galleries
- Authentication, security and abuse prevention
- Hosting, generating previews and delivering photographs to authorised persons
- Plan limits, storage quotas and billing
- Transactional email such as password reset
- Photographer-facing gallery statistics
- Handling complaints, legal requests and service communications
6. Legal bases (GDPR)
Contractual necessity (Art. 6(1)(b) GDPR) for creating and operating a photographer account, providing galleries, and performing a paid subscription.
Legal obligation (Art. 6(1)(c)) where accounting, tax or other legal duties require retention of billing or correspondence records.
Legitimate interests (Art. 6(1)(f)) for securing the service, preventing abuse, keeping photographer sessions, and producing first-party gallery statistics requested as part of the product. Those interests are balanced against the rights of the persons concerned.
Consent (Art. 6(1)(a)) is not used for the current core RemiXiss features. Acknowledging this Privacy Policy is not consent. There is currently no marketing-email programme and no advertising pixels.
7. Recipients
Personal data is disclosed to subprocessors listed on the Subprocessors page, to Photographers in respect of their own gallery statistics, to Clients to the extent a Photographer shares gallery content with them, and to public authorities where legally required.
8. Processors / subprocessors
Active infrastructure providers are listed at https://rmxvisual.pl/subprocessors. They currently include Vercel (hosting), Supabase (PostgreSQL), Cloudflare (R2 storage), Stripe (payments) and OVHcloud (transactional email).
9. Retention periods and criteria
- Account and profile data: for the life of the account and thereafter as needed to close the account and meet legal duties
- Galleries and media: until the Photographer deletes them, or the account is closed and deletion is carried out
- Photographer sessions: until expiry (14 days, refreshed during use) or logout / password reset (sessions are revoked on password reset)
- Client-gallery sessions: up to 30 days
- Gallery visitor identifiers: up to 365 days as a cookie; related statistics events remain until deleted with the gallery/account records
- Billing metadata: for the life of the customer relationship and for accounting/tax retention required by Polish law
- Password-reset tokens: until used or expired
- Operator audit records of plan changes: retained as operational security/admin records
10. Account deletion
Photographers can delete individual galleries and files in the product. Full account deletion is not currently a complete self-service flow. Send a request to the contact email. The Service Provider will not promise instant erasure of every backup or log copy held by infrastructure providers. Billing records required by law are retained.
11. Billing, subscriptions and the payment processor
Stripe processes payments and subscriptions. RemiXiss stores customer and subscription identifiers, plan, status and period dates. Full card numbers are not stored in RemiXiss.
12. Transactional and service email
RemiXiss sends transactional email such as password-reset messages and may send account, billing or security notices. These are service messages, not marketing. There is currently no marketing mailing list.
13. Security and authentication logs
Photographer sessions may store IP address and user-agent. Hosting providers generate request logs. Gallery statistics events store a visitor identifier, event type, gallery, optional photo and timestamp — not an advertising profile and not cross-site tracking.
14. Gallery analytics and visitors
When a Client (not the gallery owner) views a gallery, logs in, or downloads a photo, RemiXiss records an event for that Photographer’s statistics. A first-party visitor cookie is used so unique visitors can be counted per gallery. This is operational product statistics, not marketing analytics, Vercel Analytics, or a social/advertising pixel.
16. International data transfers
RemiXiss does not claim that all data always remains in the EU. Vercel, Stripe and Cloudflare may involve processing outside the EEA according to those providers’ own terms. The production PostgreSQL database is on European Union infrastructure. RemiXiss does not invent Standard Contractual Clauses or adequacy findings for those providers in this Policy; Photographers should review each provider’s published transfer documentation where relevant.
17. Data subject rights
You may request access, rectification, erasure, restriction, objection and data portability, and you may withdraw consent where processing is actually based on consent (none is currently used for core features). Requests: kontakt@rmxvisual.pl.
Where RemiXiss acts as processor for gallery content, client requests that concern a Photographer’s content should generally be directed to that Photographer; RemiXiss will assist as described in the DPA.
18. Complaint rights
You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO): https://uodo.gov.pl/.
19. Whether data provision is required
Email, password and a display name are required to conclude a photographer-account contract. Payment details are required by Stripe if you buy a paid plan. Gallery client credentials are optional and configured by the Photographer.
20. Automated decision-making / profiling
RemiXiss does not use automated decision-making producing legal or similarly significant effects, and does not perform marketing profiling. Plan limits are applied according to the selected plan and measured usage, which is not Art. 22 GDPR automated decision-making.
21. White-label galleries
Pro+ may reduce visible RemiXiss branding on client galleries. White-label presentation does not change the Service Provider’s role as infrastructure provider and, where applicable, processor.