Privacy Policy

1. Controller

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the "GDPR") is:

The controller has not appointed a data protection officer, as this is not mandatory given the nature of its activities.

2. Legal basis for processing

We process personal data on the following legal bases:

• Consent of the data subject (Article 6(1)(a) GDPR) - when using analytics cookies and measuring website traffic
• Legitimate interest (Article 6(1)(f) GDPR) - ensuring the functionality of the website, protecting the form against abuse and defending legal claims
• Pre-contractual steps and performance of a contract (Article 6(1)(b) GDPR) - handling your enquiry, preparing a quotation and providing the agreed services

3. Scope of data processed

We collect only data that you provide to us voluntarily or that arises from your use of our website:

a) Contact form data

• First name and surname
• Email address
• Telephone number (optional)
• Company name (optional)
• Content of your message

b) Automatically collected data

• IP address and request security data that may be temporarily processed by hosting and bot protection
• Browser type and operating system
• Website traffic data (via cookies, if you have given consent)
• Pseudonymised analytics data and permitted referral or UTM context, which is linked to an enquiry only after analytics consent has been given

Your name, email and the content of your message are required so that we can handle your enquiry. Phone number and company name are optional. We do not carry out automated decision-making or profiling with legal or similarly significant effects.

4. Purposes of processing

We process your data exclusively for the following purposes:

• Responding to your questions and requests sent via the contact form
• Preparing and sending a commercial quotation
• Communication relating to the consulting services provided
• Statistical evaluation of website traffic (with consent only)
• Improving the content and functionality of the website

5. Recipients and processors

Your personal data may be made available to the following third parties, which process data on our behalf:

• Google LLC - Google Analytics and Google Tag Manager for traffic analysis (with consent only)
• Vercel Inc. - hosting, website delivery, serverless functions and security logs
• Plus Five Five, Inc. (Resend) - delivery of messages from the contact form and confirmations to the sender; data is processed in the USA on the basis of a data processing agreement (DPA) and standard contractual clauses
• Apple Distribution International Ltd. - iCloud Mail mailbox to which the contact message is delivered and in which the subsequent communication takes place
• Cloudflare Inc. - Turnstile protection of the contact form against automated abuse

Your data is not sold to third parties for marketing purposes. Some of the providers listed may process data outside the EU/EEA on the basis of appropriate safeguards, in particular standard contractual clauses or a valid adequacy decision.

6. Retention period

We keep your personal data only for as long as necessary to fulfil the purpose of processing:

• Contact form: a maximum of 3 years from the last contact, unless a contractual relationship is established or the data is needed for the exercise of legal claims
• Analytics data: user and event data in Google Analytics for a maximum of 14 months; analytics cookies for a maximum of 2 years. Aggregated reports may be retained for longer.
• Technical systems: Vercel runtime logs for a maximum of 30 days, depending on the active plan; Resend processes email data for the duration of the service and, under its DPA, deletes it within 90 days after the account is closed.
• Contract data: for the duration of the contract and thereafter for the period required by law (in particular tax and accounting regulations - up to 10 years)
• Cookies: depending on the type of cookie, see our cookie policy

After the retention period expires, your data will be securely deleted or anonymised.

8. Data security

We have adopted appropriate technical and organisational measures to protect your personal data, including:

• Encrypted data transmission via the HTTPS/TLS protocol
• Access to personal data restricted to authorised persons only
• Regular review of security measures

9. Cookies

Our website uses cookies to ensure functionality and to analyse traffic. Detailed information on the types of cookies, their purpose and the settings available to you can be found on the Cookie Policy page.