PRIVACY
POLICY

1 General provisions

1.1. This Privacy Policy sets out the rules for processing personal data of users of the krolikart.pl website and the use of cookies.

1.2. The data controller is Wojciech Królik, registered at ul. Bliska 14 m. 46, 03-804 Warsaw, Poland, e-mail: [email protected], hereinafter the “Controller”.

1.3. The Controller processes personal data in accordance with applicable law, including the GDPR.

2 Scope and purpose of processing

2.1. Personal data is processed in order to:

• enable use of the website,
• handle enquiries and orders,
• provide services and perform concluded contracts,
• market the Controller’s own products and services,
• analyse site traffic and improve its functionality.

2.2. The Controller may process the following personal data: first name, surname, e-mail address, phone number, postal address, IP address, order data, payment data.

3 Legal basis for processing

3.1. Personal data is processed on the basis of:

• the user’s consent (Art. 6(1)(a) GDPR),
• necessity to perform a contract (Art. 6(1)(b) GDPR),
• a legal obligation (Art. 6(1)(c) GDPR),
• the Controller’s legitimate interest (Art. 6(1)(f) GDPR).

4 User rights

4.1. Every user has the right to:

• access their data,
• rectify their data,
• erase their data (“the right to be forgotten”),
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time,
• lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (PUODO).

4.2. To exercise their rights, the user may contact the Controller by e-mail.

5 Sharing data with other entities

5.1. Data may be shared with entities cooperating with the Controller (e.g. hosting providers, payment processors, e-mail delivery providers) only to the extent necessary to fulfil the processing purposes.

5.2. Data is not sold or shared with third parties for marketing purposes.

6 Cookies and analytics tools

6.1. The krolikart.pl website uses cookies to ensure the proper functioning of the site, analyse traffic and tailor content to user preferences.

6.2. The user can manage cookie consent via the banner on the site and their browser settings. Consent can be withdrawn at any time.

6.3. For traffic analysis the site uses: Cloudflare Web Analytics – a tool that works without cookies and without identifying individuals; and Google Analytics 4 (provider: Google Ireland Ltd.), which is loaded only after the user gives consent to analytics cookies. When “essential only” is selected, Google Analytics is not activated. Google may process data outside the European Economic Area on the basis of appropriate legal safeguards.

7 Client panel and call recordings

7.1. Clients carrying out a project or subscription are given access to the client panel (krolikart.pl/panel). The panel processes: first name and surname, company name, e-mail address, phone number, answers given in the project brief, messages exchanged with the Controller, information on project stages and subscriptions, and panel settings (language, theme).

7.2. The legal basis is the necessity to perform a contract (Art. 6(1)(b) GDPR) and the Controller’s legitimate interest in efficient communication with the client and documenting project arrangements (Art. 6(1)(f) GDPR).

7.3. Signing in to the panel is password-free, via a one-time link sent to the client’s e-mail address. After signing in, the browser stores an essential session cookie, valid for up to 30 days and inaccessible to page scripts, used solely to keep the client signed in. On devices shared by several people we recommend signing out with the “Sign out” button.

7.4. Panel data is stored on Cloudflare infrastructure (hosting and database), and e-mails from the panel are sent via the Resend service. Project files, call recordings and meeting booking are provided through Google services (Google Drive, Google Calendar, Google Meet) under access rules agreed with the client.

7.5. Online calls with the client may be recorded only with the client’s consent, given before the recording starts (Art. 6(1)(a) GDPR). The recording serves as a record of project arrangements, is shared only with the client concerned and is never published. Consent can be withdrawn at any time, in which case the recording is deleted.

7.6. Panel data is kept for the duration of the project or subscription and, after it ends, for no longer than 3 years, i.e. the limitation period for possible claims, unless the client requests earlier deletion. Call recordings are deleted no later than 12 months after the project ends.

8 Data retention period

8.1. Data is stored for the period necessary to achieve the purposes for which it was collected, and in accordance with applicable law.

9 Changes to the Privacy Policy

9.1. The Controller reserves the right to change this Privacy Policy. The current version will always be available on the website.

10 Contact

10.1. For matters related to the processing of personal data, you can contact the Controller at: [email protected].