A little privacy note.

new.home.again is Gosia’s home for colourful children’s rooms and seasonal makeovers. This note explains what happens to your personal data when you visit the site or get in touch, as required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

Who looks after your details

The controller of your personal data is Gosia, creator of new.home.again. For anything about your data, contact: Click here to show the email address. The controller’s full name and postal address are given in the reply to every enquiry and are available on request at the same address. No data protection officer has been appointed, as one is not required for a site of this kind.

What is used, why, and on what legal basis

• Your enquiry. If you use the contact form or send an email, your name, email address, the kind of visitor you are (parent, maker, brand or other) and your message are used to read and reply to you. The legal basis is the controller’s legitimate interest in answering correspondence (Art. 6(1)(f) GDPR). If you write about a possible collaboration, the basis is also taking steps at your request before entering into an agreement (Art. 6(1)(b) GDPR).
• Spam protection. When the form is enabled, Cloudflare Turnstile checks that a real person is sending it. It processes technical information about your browser and device, and the form forwards your IP address to Turnstile for this check. The legal basis is the legitimate interest in protecting the site and mailbox from abuse (Art. 6(1)(f) GDPR).
• Hosting and security. The site is hosted on Cloudflare Pages. Cloudflare processes technical access and security logs, including IP addresses, to deliver and protect the website, based on the legitimate interest in running a secure site (Art. 6(1)(f) GDPR).
• Legal claims. If it ever becomes necessary, correspondence may be kept to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

After you send the form, the confirmation repeats who the controller is, where your message is stored and how long it is kept.

Giving your details is voluntary, but without your name, email address and message it is not possible to reply. Please do not include sensitive information or children’s personal details in your message.

Who else handles your data

Your data is shared only with providers that help run the site, acting as processors on the controller’s behalf under data processing agreements:

• Cloudflare, Inc. — hosting, the Pages Function that receives the form, and Turnstile spam protection (privacy policy, data processing addendum);
• Resend — delivery of your message to the site owner’s mailbox (privacy policy, data processing addendum);
• LILIKOI — hosting of the mailbox that stores your enquiry and the reply.

Cloudflare and Resend are based in the United States, so your data may be transferred outside the European Economic Area. Such transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the provider is certified under it, or on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can ask for more information about these safeguards using the contact above.

How long it is kept

Enquiries and replies are kept in the mailbox for 1 year after the last exchange and are then deleted, unless they are needed for a legal claim. Delivery records held by Resend and technical logs held by Cloudflare are kept for the periods set by those providers. There is no mailing list and your enquiry is never used to send marketing.

Cookies and visits

This site does not load analytics, advertising tools or Instagram embeds, and does not set tracking cookies. Photographs and fonts are served with the site. Turnstile loads only near the contact form when sending is enabled; it may store or read technical information on your device solely to tell people from bots, which is strictly necessary to provide the form securely.

Turnstile’s check is automatic, but it does not produce legal or similarly significant effects for you, and you can always send an email instead. No other automated decision-making or profiling takes place.

Links to Instagram and makers

Instagram posts and makers’ profiles open only when you follow a link. Those services then apply their own privacy policies. Some pictured products were gifted; disclosures appear beside the makers and in the original posts.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing and, where processing is based on steps before an agreement, to receive it in a portable format.

Right to object. Where your data is processed on the basis of legitimate interest, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). Your data will then no longer be processed unless there are compelling legitimate grounds or it is needed for legal claims.

To use any of these rights, write to: Click here to show the email address. You also have the right to lodge a complaint with a data protection authority — in Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw — or with the authority in the EU country where you live or work.

Changes to this note

If the way the site handles data changes, this note will be updated. Last updated: 24 October 2026.