Let's talk

Privacy policy

Effective from:
Last updated:

This English version is a translation. If there is any discrepancy, the Polish version prevails.

1. Controller

The controller of your personal data is Dawid Zdanowicz, a sole proprietor conducting business under the name Dawid Zdanowicz, entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax ID (NIP) 7011235710, REGON 540335656, correspondence address: ul. Alternatywy 3/46, 02-775 Warszawa, Poland (the “Controller”, “we”).

ATPACT is the trade brand under which the Controller does business. ATPACT is not a separate legal entity.

2. Privacy contact

For any matter concerning personal data, write to [email protected] or to the correspondence address above. The Controller has not appointed a data protection officer.

3.1. Using the website

When you open atpact.com, your browser sends technical data needed to display it, in particular your IP address, the requested page, the date and time of the request and information about your browser (user agent). The website is delivered through Cloudflare services, which process this data to deliver the website and protect it against abuse.

  • Purpose: providing the website and keeping it secure and available.
  • Legal basis: the Controller’s legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

We do not keep our own server logs containing IP addresses. The function that handles the contact form records only technical events (for example “message delivered”), without personal data.

3.2. Visitor statistics (Cloudflare Web Analytics)

If you consent, we use Cloudflare Web Analytics to see aggregated website statistics such as page views, referring sources and loading times. It works through a Cloudflare script that, after the page loads, reads page-load performance information, the referring page and the browser identifier (user agent) in your browser and sends them to Cloudflare. Without your consent the script is not loaded at all.

  • The script does not set cookies and does not use the browser’s local storage. Cloudflare states that the service does not collect visitors’ personal data and does not record query strings in URLs.
  • We only see aggregated statistics. We do not use them to identify individuals and do not combine them with other data.
  • Purpose: analysing website traffic and performance to improve the website.
  • Legal basis: your consent given in the consent notice on the website (Art. 399 of the Polish Electronic Communications Law and Art. 6(1)(a) GDPR).
  • Withdrawing consent: at any time through the “Cookie settings” link in the website footer. Withdrawal applies from the next page view and does not affect the lawfulness of processing before it.

3.3. Contact form and email correspondence

If you contact us through the contact form or by email, we process your name, email address, the content of your message and any other data you choose to share.

  • Purpose: replying to your message, discussing possible cooperation and continuing the related correspondence.
  • Legal basis: the Controller’s legitimate interest in answering enquiries and communicating with current and potential business partners (Art. 6(1)(f) GDPR); where you write on your own behalf with a view to entering into a contract, also steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

The form sends your message by email to the Controller’s mailbox. The website does not store messages in a database. To protect the form against abuse we use a hidden field that detects bots, a check of how quickly the form was filled in, and a limit on the number of messages. For the limit, where it is active, a one-way hash of your IP address created with a secret value is stored for no longer than 20 minutes. Your IP address cannot be derived from it.

We do not send marketing messages through the form and do not add you to any mailing list.

If the correspondence leads to cooperation, data may be processed to perform the contract (Art. 6(1)(b) GDPR), to meet legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR), and to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).

4. Recipients

Your data may be disclosed to service providers that process it on our behalf under data processing agreements:

  • Cloudflare, Inc. (USA) and its affiliates: hosting and delivery of the website (Cloudflare Pages), receiving and checking contact form messages (Cloudflare Pages Functions), abuse protection and visitor statistics (Cloudflare Web Analytics).
  • Google as the provider of Google Workspace: forwarding contact form messages by email to the Controller’s mailbox (Google Apps Script), and the mailbox and email correspondence itself.

Only the Controller has access to the mailbox. Data may be disclosed to public authorities where the law requires it.

5. Transfers outside the European Economic Area

Cloudflare and Google may process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (for entities certified under it, including Cloudflare, Inc. and Google LLC) and on the European Commission’s standard contractual clauses included in these providers’ data processing terms. You can request a copy of the relevant safeguards at [email protected].

6. How long we keep data

  • Enquiries that do not lead to cooperation: 12 months from the last contact. After that, the messages are deleted or anonymised.
  • Correspondence related to a contract: for the duration of the contract and then until claims become time-barred, or longer where the law requires it, in particular tax and accounting rules.
  • Data needed to establish, exercise or defend claims: until the claims are finally resolved or time-barred.
  • Visitor statistics: according to Cloudflare, detailed data is kept for 7 days and then aggregated; aggregated statistics are available for about 6 months.
  • IP hash for the message limit: no longer than 20 minutes.

7. Your rights

You have the right to:

  • access your data and obtain a copy,
  • rectification,
  • erasure,
  • restriction of processing,
  • data portability, for data we process on the basis of a contract or pre-contractual steps,
  • object to processing based on the Controller’s legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation,
  • withdraw consent to statistics at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, write to [email protected]. We will reply without undue delay and within one month of receiving your request; this period may be extended where the GDPR allows it.

8. Complaints

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl.

9. Providing data

Providing data in the contact form or in an email is voluntary, but without your email address and message we cannot reply.

10. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

11. Cookies and similar technologies

Information about cookies and similar technologies is in the Cookie policy.

12. Changes

We will update this policy when the way the website processes data changes. The current version is always available on this page together with the date of the last update.

13. Language versions

This policy is available in Polish and English. If there is any discrepancy, the Polish version prevails.