Privacy Policy

Last updated: 20 July 2026

Who we are

This policy applies to EYE C U's professional partner program, addressed to photographers and studios ordering personalised jewellery from EYE C U. The data controller is EYE C U sp. z o.o. (details below).

Consent & legal basis

By placing an order or registering a partner account, you consent to the collection, use, and storage of your personal data as described in this policy. Processing is carried out on the basis of (i) the performance of our contract with you, and (ii) our legitimate interest in managing the business relationship.

What data we collect

To manage your partner account and process your orders, we collect: company name, contact person's first and last name, VAT identification number, billing address, country, email address, phone number, and the photos you provide for jewellery integration.

How we use it

Your data is used solely to manage your partner account, process your orders, and provide you with support. It is not sold or shared with third parties, and remains within the EYE C U organisation. It may be shared with our payment and shipping providers strictly to fulfil your order.

Data retention

• Account & order data: retained for up to 1 year from your last interaction with us, to handle any related questions, claims, or after-sales support — or longer where required by law (e.g. accounting obligations).
• Photos submitted for jewellery integration: deleted within 15 days of your order's completion.

Your rights

Under applicable data protection law (including the EU GDPR), you have the right to:

To exercise any of these rights, contact us at b2b@eyecu-irisphoto.com. If you believe your rights have not been respected, you may also lodge a complaint with the Polish supervisory authority (Urząd Ochrony Danych Osobowych, UODO).

Data security

• Secure storage — personal data and photos are stored using encrypted online storage services (Google Drive).
• Restricted access — only authorised, trained staff can access personal data.
• Two-factor authentication on accounts holding sensitive data.
• Regular security review of our systems and processes.

International data transfers

Some of our service providers (such as Google, for file storage and website fonts) may process data outside the European Economic Area. Where this occurs, it is done under providers' standard contractual clauses or equivalent safeguards recognised under GDPR.

Cookies & website

This website does not use advertising or analytics cookies. It loads typefaces from Google Fonts, which involves a request to Google's servers when you visit the site. No personal profile or tracking cookie is created by this.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Material changes will be communicated to active partners by email.