Privacy Policy

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Overview

We take the protection of your personal data seriously and process it only in accordance with the GDPR and the Polish Personal Data Protection Act. This website is deliberately kept lean: it sets no cookies, uses no analytics or advertising services and loads no content from third-party servers. Personal data is processed only in the cases described below.

Hosting and Server Log Files

This website is hosted by nazwa.pl sp. z o.o., ul. Pana Tadeusza 2, 30-727 Kraków, Poland. Each time you access a page, the hosting provider’s web server automatically records technical data in so-called server log files: the IP address of the requesting device, date and time of the request, the page or file requested, the amount of data transferred, the referring page, and the browser and operating system used. This data is required to deliver the website reliably and securely and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the secure and stable operation of the website). Log files are stored only for as long as is necessary for the secure and stable operation of the website and are then deleted automatically; the specific period is determined by the technical arrangements of our hosting provider. They are kept longer only where this is required to investigate a specific security incident. We have concluded a data processing agreement (Art. 28 GDPR) with the hosting provider.

Contact Form

If you use the contact form, we process the email address, the topic selected and the message text you enter, together with the date and time of submission, the language version of the site you used and the IP address the message was sent from. We process this data solely to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) or Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). The form is technically delivered by the service Web3Forms (web3forms.com), operated by Web3Creative, a business registered in Kerala, India, which forwards your message to our mailbox 4lean@conceptiongroup.pl. Web3Creative acts as a processor on our behalf under a data processing agreement pursuant to Art. 28 GDPR (available at web3forms.com/dpa). The servers used are located in the United States, so your data is processed outside the EU/EEA. The transfer is safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, as set out in that agreement. Web3Creative in turn engages sub-processors, in particular cloud infrastructure providers and spam-filtering services; the spam-filtering services receive your IP address and email address in order to assess the submission. The current list of sub-processors forms part of the agreement referred to above. According to the provider, submissions are stored on its servers for a maximum of three years from the date of submission and are then deleted automatically; its server logs are deleted at regular intervals. If you would prefer your enquiry not to pass through this service, please write to us directly at 4lean@conceptiongroup.pl or call us instead. The data is deleted once your enquiry has been dealt with and no statutory retention obligation applies; where an enquiry leads to a business relationship, the data is stored as part of that relationship.

Contact by Email, Phone and WhatsApp

If you contact us by email or phone, we store the data you provide (name, contact details, content of the enquiry) to process the enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR, as above. The website also contains a link that opens a chat with us in WhatsApp. Clicking it takes you to the WhatsApp service operated by WhatsApp Ireland Ltd. / Meta; the site itself transmits no data to WhatsApp before you click. If you write to us via WhatsApp, WhatsApp’s own privacy policy applies to the transmission; we process the content of your message as described above.

LinkedIn

This website contains a plain link to our company page on LinkedIn. No LinkedIn plugin or tracking code is embedded; no data is transmitted to LinkedIn until you click the link and leave our site. From that point on, the privacy policy of LinkedIn Ireland Unlimited Company applies.

No Cookies, No Tracking, No Third-Party Content

This website sets no cookies and writes nothing to your browser’s local or session storage. We use no web analytics, advertising networks or social-media tracking. Fonts, images and video are delivered from our own server, so no data about your visit is passed to third parties merely by viewing the site.

Recipients and Transfers to Third Countries

We pass personal data on to third parties only where this is necessary to handle your enquiry (for example the hosting and form service providers named above, acting as processors), where we are legally obliged to do so, or where you have consented. All processing takes place within the EU/EEA, with one exception: the form service named above processes submissions on servers in the United States. That transfer is safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Storage Period

We store personal data only for as long as necessary for the purposes stated or as required by statutory retention obligations (in particular under Polish tax and commercial law, generally five years from the end of the relevant financial year). After that, the data is deleted.

Your Rights

Under the GDPR you have the following rights with regard to your personal data:

• the right of access (Art. 15 GDPR) — to learn which data we process about you;
• the right to rectification (Art. 16 GDPR) of inaccurate data;
• the right to erasure (Art. 17 GDPR), where no retention obligation applies;
• the right to restriction of processing (Art. 18 GDPR);
• the right to data portability (Art. 20 GDPR);
• the right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR);
• the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise these rights, simply contact us using the details given under “Controller”.

Right to Object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Supervisory Authority

The supervisory authority responsible for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. You may also contact the supervisory authority of your habitual residence or place of work.

Data Protection Officer

We are not required to appoint a data protection officer. Please direct all questions about data protection to the contact details given above.

Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Data Security

This website is delivered over an encrypted HTTPS connection. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.

Changes to This Policy

We will update this privacy policy whenever the way we process data changes — for example if we introduce new services on this website. The current version is always available on this page.