Policy privacy
Your privacy is important to us. We explain in simple language what data we collect, for what purpose, on what legal basis, and what rights you have in relation to it—in accordance with the GDPR and applicable Polish law.
Scroll to readThe most important in four sentences
If you don't have time for the entire document, here's the gist. Each card links to a specific clause with details.
What we collect
Data you provide in a form or email, and anonymous visitor statistics.
Zakres danych — §04What for
To respond to your inquiry, prepare an offer and — if we reach an agreement — execute the contract.
Cele — §02How long
Only as long as necessary – from 12 months for inquiries to statutory deadlines for invoices.
Czas — §05Your control
You have full GDPR rights: access, rectification, deletion and withdrawal of consent – at any time.
Twoje prawa — §11In short
We process your data solely to respond to your inquiry, conduct business discussions and, if we reach an agreement, execute the contract. We do not sell them or pass them on to third parties for marketing purposes. Below you will find a full, clause-by-clause explanation of how we do it.
Personal data administrator #
The controller of your personal data within the meaning of Article 4(7) of the GDPR – i.e. the entity that decides on the purposes and methods of their processing – is:
Tax Identification Number: 9721368456
In all matters related to the protection of personal data, you can contact us by e-mail at kontakt@websky-studio.pl or by phone at +48 518 790 600.
Due to the scale and nature of the processing, we have not appointed a formal Data Protection Officer (DPO). The controller is the point of contact for GDPR matters – please write to the address above and we will respond as soon as possible.
For what purpose do we process data? #
We only collect data that we actually need and use it for clearly defined purposes:
- responding to an inquiry sent via the contact form or e-mail,
- preparation of an offer and individual project valuation,
- performance of a contract for the creation of a website, store or other digital service,
- issuing, archiving and sharing invoices – in accordance with tax regulations,
- marketing communications — only if you have subscribed to the newsletter,
- anonymous analysis of website traffic and improvement of its performance (Google Analytics 4),
- pursuing possible claims or defending against them.
We don't process your data for any purpose unless we've informed you in advance. If we ever want to use it differently, we'll first ask for your consent.
On what legal basis #
Each operation on your data is based on one of the grounds indicated in Article 6(1) of the GDPR:
Execution of a contract or activities aimed at concluding it – e.g. response to a request for proposals and implementation of a project.
Fulfilling legal obligations – e.g. issuing and archiving invoices and maintaining accounting records.
Your voluntary consent – e.g. subscribing to a newsletter or accepting analytical cookies.
The legitimate interest of the administrator – website analytics, pursuing claims, marketing of own services to existing customers.
Where consent is the basis, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before your withdrawal.
What data do we collect? #
Most often, these are data that you provide yourself in the contact form or in an e-mail:
- name and surname,
- company name (optional),
- email address,
- phone number (optional),
- the content of the inquiry and information about the planned project,
- in the event of concluding a contract: Tax Identification Number, company address and invoice details.
Additionally, after expressing consent in the cookie banner, we automatically collect for analytical purposes (Google Analytics 4): anonymized IP address, information about the browser and device, time of visit and a list of visited subpages.
We do not request or need sensitive data (e.g., about health, opinions, or beliefs). Please do not include it in your inquiries.
How long do we store data? #
We only store data for as long as necessary for the purpose for which it was collected or as required by law:
- Requests for quotes without a signed contract: up to 12 months from last contact.
- Customer data (contract completed): for the duration of the contract and 6 years after its termination - for evidentiary purposes and for claims arising from the limitation period.
- Invoices and accounting documents: 5 years from the end of the financial year (requirement of the Tax Ordinance).
- Newsletter: until you withdraw your consent.
- Analytical cookies: 14 months (default period for Google Analytics 4).
After these periods, the data is permanently deleted or anonymized. You can find a visual summary at storage timeline lower.
Who we share your data with #
Your data may only be transferred to trusted processors with whom we have signed processing agreements:
- accounting office handling our accounting,
- hosting and email providers (e.g. mydevil, cyberFolks),
- Google LLC - within Google Analytics and Google Workspace,
- newsletter service providers (Mailchimp / Brevo) – if you have subscribed to the newsletter,
- payment operators - if you make a payment for a service,
- authorized state authorities - only on the basis of applicable legal provisions.
Your data are never sold third parties for marketing or commercial purposes. Each entity processes it only to the extent and for the purpose we entrust it to.
Data transfer outside the EEA #
Some of our suppliers—primarily Google LLC—may process data on servers outside the European Economic Area (EEA). We ensure that such transfers only take place with appropriate safeguards in place.
- the transfer is based on standard contractual clauses (SCC) approved by the European Commission,
- where possible, data is pseudonymised or anonymised before transfer,
- We use vendors that participate in recognized compliance programs (e.g., Data Privacy Framework).
You have the right to request a copy of the transfer security measures in place. Write to kontakt@websky-studio.pland we will provide you with the appropriate information.
How we protect your data #
We use technical and organizational measures appropriate to the risk to ensure your data is secure at every stage:
- encryption of the connection to the website with the protocol SSL / TLS (HTTPS),
- limited, personal access to data – only those who really need it,
- regular backups and updates of software and servers,
- principle of minimization - we only collect data necessary for a given purpose,
- verification that our suppliers provide a comparable level of protection.
If, despite the safeguards in place, a data breach occurs that may pose a risk to your rights, we will report it to the President of the Personal Data Protection Office within 72 hours and, if required, we will also inform you.
Automated decisions and profiling #
Your data are not used to make automated decisionswhich would produce legal effects for you or significantly affect you in a similar manner, within the meaning of Article 22 of the GDPR.
Website analytics (Google Analytics 4) is based on aggregated and statistical data—it is solely used to improve website performance, not to evaluate or profile specific individuals. Every decision regarding an offer or collaboration is made by a human.
Children's data #
Our services are intended for businesses and adults running their own businesses. The website is not intended for children or We do not knowingly collect data from persons under 16 years of age.
If you believe that a child has provided us with their information without the consent of their guardian, please write to kontakt@websky-studio.pl — we will remove them immediately.
Your rights under the GDPR #
You have full control over your data. Under the GDPR, you have the following rights:
- Right of access — you can request a copy of the data we hold.
- Right to rectification — we will correct incorrect or incomplete data.
- The right to erasure ("to be forgotten") — in situations provided for by law.
- The right to restrict processing — in certain cases.
- The right to data portability — in a structured, commonly used format.
- Right to object — especially in relation to processing for direct marketing purposes.
- The right to withdraw consent — at any time (e.g. unsubscribing from the newsletter).
- Right of complaint to the President of the Personal Data Protection Office (uodo.gov.pl).
Just one email is enough kontakt@websky-studio.pl with a description of what the request concerns. We will respond within 30 days (usually faster). Exercising your rights is free of charge.
Cookies and analytical tools #
This website uses cookies to ensure proper site operation, anonymously analyze traffic, and personalize content. Details about specific tools and their active periods can be found in a separate document. Cookie Policy.
Upon your first visit, we display a consent banner—you choose which cookie categories you accept. You can change your decision at any time using settings console below or the "Cookie Settings" link in the footer of the page.
Privacy Policy Changes #
This policy may be updated from time to time, for example, due to changes in regulations or the introduction of new tools on the website. Each new version includes the update date and version number in the document header.
For existing customers, we also communicate significant changes via email, 14 days in advance before their entry into force.
How long do we keep individual data?
Each data category has its own pre-defined retention period. After this period, the data is deleted or anonymized. Below is a timeline.
(no contract)
(contract completed)
accounting
newsletter
(Google Analytics 4)
Okresy mogą się wydłużyć wyłącznie wtedy, gdy wymaga tego dochodzenie roszczeń lub obowiązujący przepis prawa.
Short answers to specific doubts
We have collected the questions our customers most frequently ask about privacy and personal data.
Q:Do you sell my personal data?
No. We never sell or rent your data to third parties for marketing or commercial purposes. We only share it with trusted processors (e.g., accounting firms, hosting providers) based on data processing agreements and only to the extent necessary to provide the service.
Q:How long will you hold my inquiry if cooperation does not occur?
We store requests for quotes without a signed contract until 12 months since the last contact. After this time, they are deleted. You can find the full table of periods in the section data retention above.
Q:How to unsubscribe from the newsletter?
There is an "Unsubscribe" link in every newsletter message. One click is all it takes. You can also write to kontakt@websky-studio.pl — withdrawal of consent is immediate and free of charge and does not affect the lawfulness of the previous sending.
Q:Do you use Google Analytics?
Yes, we use Google Analytics 4 for anonymous traffic analysis - but only after you give your consent in the cookie banner. The IP address is anonymized, and the data is not used to identify specific individuals. You can withdraw your consent in settings console.
Q:Is my data transferred outside the European Union?
Google services (Analytics, Workspace) may process data outside the EEA. This is done on the basis of standard contractual clauses (SCCs) approved by the European Commission, which ensure a level of protection consistent with the GDPR.
Q:Where can I file a complaint about my data?
First, we encourage you to contact us – we resolve most matters immediately. However, you have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (uodo.gov.pl), ul. Stawki 2, 00-193 Warsaw.
GDPR language without legal jargon
Several terms that appear in this document are explained in one sentence.
- Administrator
- The entity that decides why and how your data is processed. Here: Websky Studio Adrian Kamiński.
- Processing
- Any operation on data – collecting, storing, organizing, sharing or deleting.
- Personal data
- Any information that allows for the identification of a person – name, e-mail, telephone number, IP address or Tax Identification Number of a sole proprietorship.
- Agreement
- Voluntary, informed and unambiguous consent to the processing of data for a specific purpose – which you can withdraw.
- Processor
- A company that processes data on our behalf under a data processing agreement, e.g. a hosting company or an accounting office.
- EEA
- European Economic Area – EU countries plus Iceland, Liechtenstein and Norway, covered by a common level of data protection.
- Profiling
- Automated assessment of a person's characteristics based on their data. We do not use it to make decisions about you.
- Supervisory body
- The institution responsible for ensuring compliance with the GDPR. In Poland, this is the President of the Personal Data Protection Office (UODO).
Privacy Questions
Something unclear? Ask.
Have a question about your data, want to exercise your GDPR rights, or withdraw your consent? Write or call us—we respond within 30 days, usually much sooner.