Privacy policy

1. Data controller

The controller of your personal data is ECOMIZE Mateusz Lachowicz, Tax ID (NIP) 536-191-34-28. The registration data is available in CEIDG (the Polish business register). Contact on personal data matters: [email protected].

2. Scope of processed data

identification data (first and last name),
contact data (email address, phone number),
company data (company name, job title),
the content of correspondence and reviews submitted through forms,
technical data (IP address, browser type, operating system) — in server logs and, after you give consent, in Google Analytics.

Providing data in the forms is voluntary, but without a name, an email address and the content of the message (or review) we will not be able to answer your enquiry or publish a review. The remaining fields (company, phone, job title) are optional.

3. Purposes and legal bases

Answering an enquiry from the contact form and further correspondence — Art. 6(1)(f) GDPR (the controller's legitimate interest).
Providing services and preparing a quote — Art. 6(1)(b) GDPR (steps taken before entering into a contract and performance of a contract).
Publishing a review — Art. 6(1)(a) GDPR (consent). We publish the content of the review, the rating, the first name and — if you provide them — the company and job title, together with the publication date. We do not publish the email address from the review form.
Verifying whether the author of a review was our customer, and handling withdrawal of consent — Art. 6(1) (f) GDPR (legitimate interest: the reliability of published reviews). For this purpose we process the email address given in the review form.
Visit statistics (Google Analytics) — Art. 6(1)(a) GDPR (consent given in the dialog on the site). Without consent the tool does not load.
Legal obligations, e.g. tax obligations — Art. 6(1)(c) GDPR.

We do not send commercial information by email or phone without your prior consent (Art. 398 of the Act of 12 July 2024 — Electronic Communications Law, Journal of Laws 2024, item 1221).

4. Retention period

for the time needed to handle the enquiry or perform the contract,
for the period resulting from legal provisions (e.g. tax — 5 years),
reviews — until consent to publication is withdrawn,
reviews awaiting moderation — until the decision on publication; rejected reviews — deleted within 30 days,
the email address from the review form — until the review is deleted; if the submission is rejected, we delete it immediately.

5. Recipients of data

Data may be received by IT service providers acting on our behalf (hosting, email), the provider of analytics tools (Google Ireland Limited — only after consent is given), an accounting firm and authorities entitled under the law. Entities processing data on our behalf apply protection measures compliant with the GDPR.

The provider of Google Analytics in the EEA is Google Ireland Limited. In connection with using this tool (only after consent is given) data may be transferred to Google LLC in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, and the transfer takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 finding an adequate level of protection (Art. 45 GDPR). In addition, the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR), included in Google's data processing terms (business.safety.google/adsprocessorterms), are applied as a supplementary safeguard. We will provide a copy of the safeguards on request sent to the email address given in section 1.

6. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing, data portability, to object, and to withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal). To exercise your rights, write to [email protected].

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

7. Cookies and browser storage

Necessary — remembering your consent decision and the selected theme (light/dark) in the browser's storage. They do not require consent because they are necessary for a feature you ask for (Art. 399(3) of the Electronic Communications Law).
Language preference — a cookie named lang (value pl or en, valid for one year) remembering the language you chose with the PL | EN switch in the footer. It is a functional cookie and does not require consent.
Analytics — Google Analytics cookies (_ga, _ga_*), stored only after consent is given (Art. 399 of the Act of 12 July 2024 — Electronic Communications Law, Journal of Laws 2024, item 1221, in conjunction with Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with the "Cookie settings" button in the footer of the site — we will then switch off Google Analytics and delete its cookies.

8. Security

We use connection encryption (TLS), access control, backups and system monitoring. The forms have protections against abuse.

9. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling.

10. Changes to the policy

We announce changes on this page by updating the date at the beginning of the document.