Privacy policy

1. Data controller

The controller of personal data provided through the Webfinery website (contact form, e-mail correspondence) is the owner of the Webfinery website (the "Controller", "we").

For any matters concerning personal data, you can contact us at: [email protected].

2. What data we process

• Contact form data: full name, e-mail address, the content of your message and - if you provide them - phone number, company name, website address and the selected service.
• Technical data related to sending the form: IP address, the address of the page the form was sent from, and the date and time it was sent.
• E-mail correspondence data, if you write to us directly.
• Website usage data - only if you consent to analytics cookies: the identifier from Google Analytics cookies, pages visited and visit duration, traffic source (e.g. a search engine), approximate location (country, city) and device, operating system and browser type.

3. Purposes and legal bases

• Replying to your message and corresponding with you - Article 6(1)(f) GDPR (our legitimate interest in contacting a person who wrote to us).
• Preparing an offer and taking steps at your request before entering into a contract - Article 6(1)(b) GDPR.
• Protecting the form against spam, bots and abuse (Cloudflare Turnstile verification, submission limits) - Article 6(1)(f) GDPR.
• Establishing, exercising or defending legal claims - Article 6(1)(f) GDPR.
• Visit statistics that help us improve the website (Google Analytics) - Article 6(1)(a) GDPR, i.e. your consent. You can withdraw it at any time (section 10).

4. Providing data is voluntary

Providing your data is voluntary, but without your name, e-mail address and message we will not be able to reply to your enquiry. The other form fields are optional. Consenting to analytics cookies is also voluntary - the website works the same without it.

5. Recipients of data

Your data may only be shared with entities that help us run the website and act on our behalf:

• hosting and server providers running the website and the panel where we store messages,
• Cloudflare, Inc. - to verify that the form is sent by a human (Cloudflare Turnstile),
• Google Ireland Limited - for visit statistics (Google Analytics, Google Tag Manager), only if you consent,
• our e-mail provider,

and with public authorities where required by law. We do not sell your data or share it for marketing purposes.

6. Transfers outside the European Economic Area

Cloudflare, Inc. and Google LLC (an affiliate of Google Ireland Limited) are based in the United States. Data is transferred on the basis of the European Commission's decision on the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

7. How long we keep your data

• Form messages and correspondence - until the conversation ends and, if it does not lead to cooperation, for no longer than 12 months from the last contact.
• If we enter into a contract - for the duration of the contract and then until the expiry of limitation periods for claims and any periods required by law.
• Technical data (e.g. IP address) - no longer than necessary to protect the website against abuse.
• Statistics in Google Analytics - no longer than 14 months. Google Analytics cookies expire 2 years after your last visit, or earlier if you withdraw consent or delete them in your browser.
• Your cookie decision - 12 months, after which we will ask again.

8. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectify your data,
• have your data erased,
• restrict processing,
• data portability - to the extent we process your data in connection with a contract,
• object to processing based on our legitimate interest,
• lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) - or with the authority in your country of residence.

To exercise your rights, write to [email protected].

9. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Cloudflare Turnstile verification only automatically assesses whether the form is being sent by a human rather than a bot.

10. Cookies and technical data

Necessary - no consent needed. The website does not work properly without them: they remember the selected language and your cookie decision (stored in your browser). Cloudflare Turnstile may store data in your browser that is needed to verify the form.

Analytics - only with your consent. We use Google Analytics 4, loaded through Google Tag Manager, to see how many people visit the website, which pages they read and where they come from. Google Analytics cookies (_ga, _ga_*) are only stored after you click "Accept" in the cookie banner. Until you consent, Google only receives signals without cookies (e.g. that a page was viewed), with no identifier that would recognise your browser on later visits.

Advertising - not used. The website does not use advertising cookies and does not share data for advertising purposes.

Changing your decision. You can change or withdraw your consent at any time by clicking "Cookie settings" in the website footer. If you reject, we delete the Google Analytics cookies stored in your browser. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn. You can also delete or block cookies in your browser settings.

The server running the website keeps standard logs (including IP address, date and the address of the visited page) to keep the website secure and working properly.

11. Changes to this privacy policy

This policy may be updated, e.g. due to changes to the website or the law. The current version is always available on this page together with the date of the last update.