Privacy Policy

§1. General provisions

1. The controller of personal data is Jakub Banach, conducting business under the name Jakub Banach Web Solutions with its registered office at ul. Jasna 84/9, 44-335 Jastrzębie-Zdrój, NIP: 6332249394, REGON: 526552235 (hereinafter: "Controller" or "We"). Data protection is carried out in accordance with the requirements of generally applicable law, in particular the GDPR.
2. For the purposes of better readability of the Privacy Policy, the term "User" has been replaced with "You", "Controller" - "We". The term "GDPR" refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. The term "site" refers to the website operating at www.banachwebsolutions.com.
3. We respect the right to privacy and take care of data security. To this end, we use, among other things, a secure communication encryption protocol (SSL/TLS).
4. Personal data provided in the form on the site is treated as confidential and is not visible to unauthorized persons.

§2. Purposes and legal basis for data processing

1. We process your personal data for the following purposes:
   1. To respond to inquiries sent via the contact form - legal basis: art. 6(1)(b) GDPR (actions taken before concluding a contract) and art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in handling correspondence).
   2. Direct marketing of our own services - including contacting existing clients with proposals for services related to previously performed work; legal basis: art. 6(1)(f) GDPR (legitimate interest of the Controller) and the explicit consent given in the service agreement, in accordance with art. 10 of the Act on Providing Services by Electronic Means.
   3. Site traffic analysis (our own visit statistics and Google Analytics) - only after you have consented to "Statistics" in the cookie banner; legal basis: art. 6(1)(a) GDPR.
   4. Measuring the effectiveness of Google Ads - checking whether a click on our ad ended with a contact form being sent or a call being booked - only after you have consented to "Marketing" in the cookie banner; legal basis: art. 6(1)(a) GDPR. We do not show ads based on your earlier activity (remarketing).
   5. Fulfillment of legal obligations imposed on the Controller (e.g. accounting, tax) in the event of concluding a contract - legal basis: art. 6(1)(c) GDPR.
   6. Pursuing potential claims or defending against them - legal basis: art. 6(1)(f) GDPR.
2. Providing data in the contact form is voluntary, but necessary to respond to the inquiry. Granting marketing consent is entirely voluntary and does not condition the response to the inquiry.

§3. Data retention period

1. Data from the contact form, in the event that no contract is concluded, is stored for up to 3 years from the last contact - to allow responding to any further questions and to pursue potential claims.
2. Data processed for the purpose of direct marketing of existing clients is stored for up to 3 years from the end of the service provision or until an objection is raised, consent is withdrawn, or a request for data deletion is made - whichever comes first.
3. Data related to a concluded contract is stored for its duration and for the periods resulting from legal obligations (accounting, tax) - as a rule, for 5 years from the end of the year in which the tax obligation arose.
4. Visit statistics (our own and Google Analytics) are kept for 14 months, after which they are deleted automatically.
5. The aggregate counts of choices made in the cookie banner are kept for 14 months, after which they are deleted automatically.
6. Google Ads cookies used for conversion measurement expire after 90 days; Google Analytics cookies after at most 2 years from the last visit. Withdrawing consent removes them from your browser.

§4. Your rights

1. You have the following rights under the GDPR:
   1. the right to access your data (art. 15 GDPR),
   2. the right to rectify your data (art. 16 GDPR),
   3. the right to erase your data ("right to be forgotten" - art. 17 GDPR),
   4. the right to restrict processing (art. 18 GDPR),
   5. the right to data portability (art. 20 GDPR),
   6. the right to object to processing (art. 21 GDPR),
   7. the right to withdraw consent at any time - without affecting the lawfulness of processing carried out before its withdrawal (art. 7(3) GDPR),
   8. the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw)
2. To exercise the above rights, please contact us at: kontakt@banachwebsolutions.com.
3. Withdrawal of marketing consent is also possible by clicking the "unsubscribe" link in every commercial message received from us, or by sending a message requesting to stop marketing contact to kontakt@banachwebsolutions.com.

§5. Data recipients

1. Your data may be transferred to the following categories of recipients:
   1. hosting and email service providers,
   2. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) - the provider of Google Analytics and Google Ads, only after you have consented to "Statistics" or "Marketing",
   3. accounting office - to the extent necessary to fulfill accounting obligations,
   4. law firm - only in the event of pursuing claims or defending against them,
   5. state authorities - only on the basis of applicable legal provisions.
2. Data collected by Google Analytics and Google Ads may be transferred to Google LLC in the United States. Google LLC participates in the EU–US Data Privacy Framework, under which the European Commission has found an adequate level of data protection (art. 45 GDPR); the transfer is also safeguarded by standard contractual clauses (art. 46 GDPR).

§6. Automated decision-making

Your data is not subject to automated decision-making producing legal effects concerning you or to profiling within the meaning of art. 22 GDPR. We do not use remarketing or personalised ads.

§7. Data security

1. We have implemented appropriate technical and organizational measures to protect data - including communication encryption (SSL/TLS), data access control, and regular backups.
2. Personal data is processed only by persons authorized by us and by processors with whom we have concluded data processing agreements.

§8. Cookies

1. On your first visit we show a banner in which you decide on two categories: "Statistics" and "Marketing". Without your consent the site stores no cookies or identifiers for analytics or advertising, and Google's tools are not loaded at all. We only remember your choice (in your browser's storage - localStorage).
2. When you first pick one of the banner's options ("Accept all", "Decline" or "Save my choice"), the site sends which option was picked and whether it includes consent to "Statistics". We store only the number of such choices in each hour - no IP address, identifier, device information or page viewed - so it cannot be linked to you. It tells us what share of visitors agree to statistics. Changing your decision later in "Cookie settings" is not counted.
3. Once you consent to "Statistics":
   1. the site stores a random visitor identifier and information about the current visit in your browser's storage (localStorage) for our own statistics: which pages are viewed, where visitors come from (e.g. a search engine or a campaign), device and browser type, approximate location (country, city) derived from the IP address, time spent on a page and how far it was scrolled; the IP address is not stored and this data is not shared with third parties,
   2. Google Analytics stores the _ga and _ga_<ID> cookies and collects similar information about the use of the site; Google processes it as our processor.
4. Once you consent to "Marketing":
   1. Google Ads stores the _gcl_au cookie and information about a click on our ad, to check whether it ended with a form being sent or a call being booked (conversion measurement). We do not use this data to show you personalised ads.
5. More about how Google processes data: https://policies.google.com/technologies/partner-sites.
6. You can change your decision at any time with the "Cookie settings" link in the site footer. Withdrawing consent removes the visitor identifier and Google's cookies from your browser.
7. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

§9. Final provisions

1. The privacy policy may be updated. The date of the last update is always indicated at the end of the document.
2. In matters not regulated by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law shall apply.
3. In case of discrepancies between the Polish and English versions of this Privacy Policy, the Polish version shall prevail.