This document has not yet been reviewed by a lawyer and is not in force. It is an English translation of the Polish draft. Places marked [[ TODO: … ]] will be completed by the site owner or a lawyer.
Is your data in our company database? In that case the information under Article 14 GDPR applies. You can object on the Objection page.
The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is:
Martin Adamec (entrepreneur – natural person)
Mírová 1541, 516 01 Rychnov nad Kněžnou, Czech Republic
Czech business ID (IČO): 19552319
email: info@firmowekontakty.pl
phone: +420 720 950 900
Further details of the service provider are on the Legal notice page.
This policy concerns the processing of personal data of users of the firmowekontakty.pl website, of people who contact the controller, and of clients and their employees or associates. People whose data is in the controller’s company databases (in particular sole traders and named contact persons) are informed by a separate information under Article 14 GDPR.
The website runs on a virtual private server (VPS) rented from Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Data centre location: [[ TODO: data centre location according to the Hostinger account (EU Member State) ]]. Hostinger processes data as a processor under a data processing agreement compliant with Article 28 GDPR. [[ TODO: confirm that the data processing agreement (Hostinger Data Processing Agreement) has been concluded ]]
Each time a page is viewed, the server processes data sent by the browser and records it in logs:
Purpose: making the website available and ensuring its stability and security, in particular detecting and fending off attacks and abuse (e.g. by limiting the number of requests from one IP address). Legal basis: Article 6(1)(f) GDPR; the controller’s legitimate interest is the secure and reliable operation of the website. Retention period: logs are deleted after 14 days, unless they are needed longer to investigate a specific security incident.
The connection to the website is encrypted (TLS).
If you contact the controller through the contact form, by email or by phone, the controller processes the data you provide. In the form these are: full name, company, NIP or other identification number, email address, phone number, subject of the enquiry, data country, industry and the content of the message, as well as the language version of the form. Required fields are marked. To protect against automatically sent messages (spam), the controller uses the time the form was sent and a control field invisible to humans; together with the message, the time of sending, the IP address of the device and information about the browser (user agent) from which it was sent are also transmitted.
Purpose: handling the enquiry, preparing an offer and correspondence; protection against abuse. Legal basis: Article 6(1)(b) GDPR where the enquiry is aimed at concluding a contract (steps taken at the request of the data subject prior to entering into a contract); otherwise Article 6(1)(f) GDPR – the controller’s legitimate interest is answering enquiries and protecting against abuse. Where the enquiry is made by a person acting on behalf of a business, the legal basis for processing their data is Article 6(1)(f) GDPR (communication with a business partner). [[ TODO: lawyer – the checkbox in the form is worded as consent; decide whether it should be consent (Article 6(1)(a) GDPR) or only a confirmation of having read this information, and adapt the wording of the form ]]
Process: the form is sent to the controller’s server and from there as an email to the info@firmowekontakty.pl mailbox. The mailbox is hosted by [[ TODO: mailbox provider, address, data processing agreement ]]. If the message cannot be delivered, the server temporarily stores the enquiry in a directory that is not publicly accessible, so that it is not lost. 3 months
Retention period: enquiries that do not lead to a contract are deleted by the controller after 12 months from the end of the correspondence. If a contract is concluded, section 6 applies.
In the form on the Objection page, the controller processes the data needed to handle an objection or a request for erasure: the company name or first name and surname, the NIP or other identification number, the data to which the request relates, the email address for the reply and the content of the message, and also – as in section 4 – the time the form was sent, the IP address and information about the browser (user agent).
Purpose: handling the request, demonstrating that it has been handled and blocking the data so that it is not collected again from the sources at a later update. Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 12, 17 and 21 GDPR; for the block list also Article 6(1)(f) GDPR. Retention period: correspondence – 5 years from the end of the matter; block list – indefinitely
In connection with offers, the performance of contracts and invoicing, the controller processes the data of the client and its contact persons (name, company, address, contact details, identification and tax numbers, order and payment data). Legal basis: Article 6(1)(b) GDPR (contract) and Article 6(1)(c) GDPR (obligations under tax and accounting law). The controller processes the data of contact persons of clients who are businesses on the basis of Article 6(1)(f) GDPR; the legitimate interest is communication with a business partner.
Retention period: contract data – until the limitation periods for claims expire; accounting documents and invoices – for the period required by tax and accounting law. [[ TODO: the applicable periods under Czech tax and accounting law – accountant ]]
The website currently does not use cookies and does not store any information on the user’s terminal equipment. It does not use analytics or advertising tools (e.g. Google Analytics, Google Ads) or social media plugins, and it does not load fonts, scripts or other content from third-party servers; all elements of the website are served from the controller’s server. Consent to storing information on, or accessing information from, terminal equipment (Article 5(3) of Directive 2002/58/EC; in Poland Article 399 of the Electronic Communications Law, in the Czech Republic § 89(3) of Act No. 127/2005 Coll. on Electronic Communications) is therefore not required, and the website does not display a consent banner.
Links to external websites (e.g. to public registers) are marked as external. Data reaches the operator of such a website only after you click the link; that operator is responsible for any further processing.
Personal data is received only by entities that need it for the purposes stated:
The controller does not pass the data of website users or clients to third parties for marketing purposes.
The controller does not transfer data to countries outside the European Economic Area. [[ TODO: confirm – check the sub-processors of Hostinger and of the mail provider; where data is transferred, state the country and the safeguard under Articles 44–49 GDPR ]]
Providing data is not a statutory requirement. Without the data marked as required, however, the controller cannot handle an enquiry or objection, and concluding a contract requires the data necessary to perform it.
The controller does not take decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
Under the conditions set out in the GDPR, you have the right:
To exercise your rights, a message to the contact details given in section 1 is enough. The controller replies without undue delay and at the latest within one month of receiving the request (Article 12(3) GDPR).
You have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). Because the controller is established in the Czech Republic, the lead supervisory authority (Article 56 GDPR) is:
Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
uoou.gov.cz
A complaint can also be lodged with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement. For people in Poland this is:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warsaw
uodo.gov.pl
The controller has not appointed a data protection officer. [[ TODO: lawyer – confirm that there is no obligation to appoint one, see the note ]]
The controller updates the privacy policy when the way data is processed or the law changes, in particular before introducing analytics or advertising tools. The version published at firmowekontakty.pl/en/privacy-policy/ applies. [[ TODO: lawyer – decide which language version prevails in case of discrepancies (the Polish original is the source of this translation) ]]
Status: October 2026 (draft)
