Privacy policy

This policy explains what personal data we process when you use web-gfx.com, why, on what legal basis, and what rights you have. We apply the GDPR (Regulation (EU) 2016/679) and the Polish Electronic Communications Law.

1. Data controller

The controller of your personal data is Jacek Mogilnicki, a sole trader operating under the WEB GFX brand:

• address: ul. Południowa 11, 73-110 Żarowo, Poland
• Tax ID (NIP): 8542219673, REGON: 321432900
• email: hello@web-gfx.com

For anything related to your personal data, write to hello@web-gfx.com. We have not appointed a data protection officer, as we are not required to.

2. What data we process and why

2.1. Contact form and email

Data: full name, email address, phone number (if you provide it), type of service and your message.

Purpose: replying to your enquiry, preparing a quote and further contact about it.

Legal basis: your consent, given by ticking the box in the form (Art. 6(1)(a) GDPR), and where the enquiry concerns a contract, steps taken at your request before entering into it (Art. 6(1)(b) GDPR). After the conversation ends, data may be kept to establish, exercise or defend legal claims (our legitimate interest, Art. 6(1)(f) GDPR).

Retention: for the duration of the correspondence and then until any claims become time-barred, no longer than 3 years after the last contact. If we sign a contract, related data is kept for the period required by tax and accounting law.

2.2. Spam protection

The form is protected by Cloudflare Turnstile, provided by Cloudflare, Inc. When the form opens, Cloudflare receives your IP address and technical information about your browser to check that the message is not sent by a bot. To limit the number of messages, we also store a hash (SHA-256) of the IP address with the time the message was sent. Entries older than 10 minutes are not used.

Legal basis: our legitimate interest in protecting the website and mailbox from abuse (Art. 6(1)(f) GDPR).

2.3. Server logs

The web server automatically logs the IP address, date and time of the request, the page requested, the response code and browser information. This data is used only to keep the website secure and working (Art. 6(1)(f) GDPR) and is kept for the period set by the hosting provider.

2.4. Visit statistics

Matomo is a statistics tool installed on our own server (analytics.web-gfx.com). It works without cookies, and the IP address is shortened (anonymised) before it is stored. The data is not shared with anyone. We respect your browser’s “Do Not Track” setting. Legal basis: our legitimate interest in understanding how visitors use the website (Art. 6(1)(f) GDPR).

Google Analytics 4 is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We run it only after you consent to analytics cookies (Art. 6(1)(a) GDPR). Google processes identifiers stored in cookies, information about the pages you visit, your device and browser, and an approximate location derived from your IP address (GA4 does not store the IP address itself). We keep Google Analytics data for 14 months. You can withdraw consent at any time in the cookie settings; this does not affect the lawfulness of processing before withdrawal.

2.5. Cookie consent records

When you choose your cookie settings, we store a random consent ID (the one shown in the “Cookie settings” panel), the date, the settings version, your choices and the page where they were saved. We do not store your IP address. We do this to be able to demonstrate that consent was given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Records are kept for 3 years.

3. Recipients

Data may only be shared with service providers that help us run the website and act on our instructions:

• hosting and email providers (the web server and the mailbox that receives messages),
• Cloudflare, Inc. (form protection – Turnstile),
• Google Ireland Limited (Google Analytics – only with your consent),
• public authorities, where required by law.

We do not sell personal data.

4. Transfers outside the European Economic Area

Cloudflare, Inc. and Google LLC (an affiliate of Google Ireland Limited) may process data in the United States. Transfers are based on the European Commission’s adequacy decision for organisations certified under the EU–US Data Privacy Framework and, additionally, on standard contractual clauses approved by the European Commission.

5. Your rights

You have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR),
• lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority in your EU country of residence.

To exercise your rights, write to hello@web-gfx.com. We will reply without undue delay and within one month at the latest.

6. Providing data

Providing data in the form is voluntary, but without your name, email address and message we cannot reply. The phone number is optional.

7. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

8. Cookies

Information about cookies and similar technologies is in our cookie policy.

9. Changes

We update this policy when the law or the way the website works changes. The date of the last update is shown at the top of the page.