Privacy policy — Produkcja Obrazu Panel
Effective 30 October 2026. Applies to panel.produkcjaobrazu.com (formerly upload.produkcjaobrazu.com, which now redirects to the panel). The Polish version is binding; this is a translation.
1. Data controller
The controller of personal data is Produkcja Obrazu Sp. z o.o., Polish tax ID (NIP) 6040257866. Contact for data protection matters: kontakt@produkcjaobrazu.com.
2. What data we process
- People with access to the panel (editors, administrators): Google account e-mail address, name set by the administrator, role, chosen language.
- Uploads: file names and sizes, names assigned by the panel, version numbers, upload start and end times, status, comments on versions.
- Projects and reels: client and project name, project description (e.g. category, product, location), scope, deadlines, work statuses and status history; the project price is visible to the administrator only.
- Notes on edit versions: note text, timecode, author, round and status.
- “What are you missing?” feedback: text, author, the page it was sent from, and date.
- Upload logs and event log: who did what and when in the panel (sign-in, upload, approval). We also record the e-mail and IP address of failed sign-in attempts by accounts not on the list.
- Client’s Google Drive account: its e-mail address and an encrypted access token.
Files sent through the panel go directly from the browser to Google. Exception: for edit versions, the panel server creates a lighter preview copy (for viewing and notes in the panel) — it downloads the original from the client’s Drive, deletes it right after conversion, and keeps the copy for up to 30 days after the final version is approved. Copies are visible only to signed-in people with access to the project.
3. Purpose and legal basis
- Delivering video material to the client under the order, managing work on reels, and keeping track of who delivered what — legitimate interest of the controller (Art. 6(1)(f) GDPR) and performance of the contract with the client (Art. 6(1)(b) GDPR).
- Service security (sign-in logs, request rate limiting) — legitimate interest (Art. 6(1)(f) GDPR).
4. Retention
- Accounts of people with access — for the duration of cooperation; afterwards the account is disabled and data deleted after 12 months.
- Upload register, notes, feedback and event log — for the duration of the order and 12 months after it ends (settlements, complaints).
- Web server logs — 14 days. Panel database backups — 14 days. Preview copies of edit versions — up to 30 days after the reel reaches “final”.
- Access token to the client’s Drive — until the drive is disconnected or the client revokes consent.
5. Access to the client’s Google Drive
The panel uses the client’s Google Drive only within the drive.file scope. It sees and changes only files and folders it created itself (the “Produkcja Obrazu – materiały” folder and its contents). It has no access to other files on the drive, does not delete files and does not overwrite existing ones — the only change after creation is the name of the “FINAL” shortcut in the “04 final” folder.
The drive owner can revoke access at any time: myaccount.google.com/permissions → the panel app → “Remove access”. Files already uploaded stay on the drive and belong to the drive owner.
The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Drive data or use it for advertising or for training models.
Briefs from Google Docs. The panel reads brief documents with the Google account of the person who added them, within the drive.file scope: it sees only the files that person chose in the Google file picker. It never edits, adds to or comments on them. We keep the tab contents on the panel server as successive brief versions so the crew and editors see the current brief and its changes; retention as for order data. The same Limited Use rules apply to Google Docs data.
6. Recipients and transfers
The panel server runs at OVHcloud (European Union). Files and Google account data are processed by Google (Google Ireland Limited). Notifications (e.g. about uploads: name, file name, size; “What are you missing?” feedback) reach the administrator via Telegram.
7. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object (Art. 15–21 GDPR). Write to kontakt@produkcjaobrazu.com. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw), or with your local authority.
8. Cookies
We use only essential cookies: the sign-in session (14 days; signing out also invalidates it on the server), Google sign-in protection (10 minutes) and your chosen language (12 months). We use no analytics or advertising cookies.