Privacy policy

Who is the controller of your data

The controller of personal data collected through this website is enjoy the process [TO BE COMPLETED: full legal name, address, tax number]. For data-related matters: [TO BE COMPLETED: email address].

Why and on what legal basis we process data

Replying to a message from the contact form. The basis is our legitimate interest in conducting correspondence (Art. 6(1)(f) GDPR) and, where the message concerns entering into a contract, taking steps at your request prior to entering into it (Art. 6(1)(b) GDPR).

Booking a consultation. The basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). A booking must be confirmed with the button in the email we send to the address you give. Until then the slot is held for 30 minutes, and the data reaches neither Google Calendar nor the members of our team. Once confirmed, the appointment is added to the controller’s calendar held in Google Calendar.

Protecting forms and bookings against abuse. The basis is our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR). We count how many times a given IP address has sent the contact form, booked or cancelled an appointment, checked available slots or tried to sign in to the admin panel — once the limit is exceeded, further attempts are temporarily refused. When the number of bookings in the last 24 hours exceeds the daily limit, the administrator receives a notification that contains no data about the people booking.

Security event log. The basis is our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR). We record when a booking was confirmed or cancelled with the button in an email — the entry contains only the booking number, without an IP address, name or email address. We also record attempts to sign in to the admin panel (with a hash of the IP address made with a secret key), password changes and the runs of the website’s automated tasks.

Website usage statistics. The basis is our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR). The statistics use no cookies or other identifiers stored in your browser, and your IP address is processed only as an irreversible hash with a daily rotating salt, which makes visits on different days impossible to link.

What data we collect

From the contact form: name, email address, subject and message body, and — if you provide them — your role, company size and urgency; these three are included only in the notification email and are not stored in the website database. With a message we also store an irreversible hash of your IP address with a daily rotating salt, which lets us recognise a series of submissions from one source on the same day. When booking: name, email address, the chosen slot, your time zone, the topic and optionally a phone number. With a message or a booking we store the date it was sent and the version number of the privacy policy in force at that moment. In the attempt counters used to prevent abuse: an irreversible hash of your IP address made with a secret key, and the number of attempts within a time window. In usage statistics: the page path, language, referring source, approximate country, device type and the hash described above. In the security event log: the type and time of the event, the booking number (when a booking is confirmed or cancelled) and, for attempts to sign in to the admin panel, a hash of the IP address made with a secret key.

Who we share data with

The provider of the server hosting this site, our email provider and — solely for appointment booking — Google Ireland Limited as the provider of Google Calendar. Encrypted backups of the website database are stored in Google Drive, provided by Google Ireland Limited. Each backup is encrypted on the website's server before it leaves it, and the provider does not hold the key needed to read it — it stores the file but has no access to its contents. Booking details — name, email address, phone number, topic and time — are also received — once the booking is confirmed — by the members of our team who take part in the consultation: in an email with a calendar invitation and as attendees of the Google Calendar event. We do not sell data and do not pass it to third parties for marketing.

How long we keep data

Contact form messages — 24 months from receipt. Analytics events — 14 months. Confirmed consultation bookings — 24 months from the date of the appointment. Cancelled bookings — 12 months from the date of the appointment. The matching Google Calendar entry is deleted together with the booking. If a contract follows the consultation, its data is kept outside this website for the period required by accounting and tax law. Unconfirmed bookings — at most two days from when they were made. Attempt counters with IP address hashes — at most two days. Security event log entries — 12 months.

Messages, analytics events, confirmed or cancelled bookings and security event log entries are deleted during a monthly review, so after a period ends they may remain in the website database for up to one more month. These periods apply to the website database. Notification emails about messages and bookings also reach our mailboxes and those of team members, and invitations reach their calendars; these copies are not deleted automatically. We will delete them at your request.

Backups. We make an encrypted backup of the website database every day. Data deleted from the database — including at your request — remains in these backups for at most 90 days; older backups are deleted automatically. We restore a backup only to bring the website back after a failure or to check that it can be restored.

Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability and to object to processing based on legitimate interest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland). On request, we will send you a copy of your data as a JSON file.

To exercise these rights, write to the contact address given above. We respond without undue delay and no later than within one month.

Is providing data mandatory

Providing data is voluntary but necessary for us to reply to your message or to book an appointment.

Profiling

We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you.

Cookies

This site uses no cookies for analytics or marketing. The only thing stored in your browser is your colour theme preference — a technical setting not linked to any person.

[PENDING LEGAL REVIEW] This document is a draft prepared alongside the site implementation. It should be reviewed by whoever is responsible for GDPR compliance in your business before publication.