Privacy Policy

Data controller

The data controller is ONIV Arkadiusz Łukasik, tax identification number (NIP) 6821545181, ul. Zielona 35a, 32-104 Koniusza, Poland. Contact: arekoniv@gmail.com, phone 605 151 682.

Contact form and enquiries

We process your name, contact details, optional company name and industry, description of your enquiry and preferred contact time. Form submissions are stored in the website database and accessible through the private administrator panel. They are not published or automatically sent by email or WhatsApp. Providing data is voluntary; your name, contact details and enquiry description are needed to respond. Do not include health information or confidential third-party data in the form.

Purposes and legal bases

We use data to respond to enquiries and handle correspondence under Article 6(1)(f) GDPR: the controller's legitimate interest in handling business enquiries. Where an enquiry concerns entering into a contract with the person providing the data, steps taken at their request before entering into a contract rely on Article 6(1)(b) GDPR. Technical data supports website security and abuse prevention under Article 6(1)(f) GDPR. The form does not subscribe you to a newsletter or trigger unsolicited advertising.

Recipients and infrastructure

The website uses the Sites platform provided by OpenAI and Cloudflare infrastructure, including a database. Infrastructure providers may process data as necessary to operate, store and secure the website. Email correspondence also involves Google's email service. The administrator has access to submitted enquiries in the panel. Bodies authorised by law may receive data to the extent required by law.

WhatsApp and external services

The WhatsApp button opens the external WhatsApp service (Meta). A message is sent only when you send it within that service. The website form does not transmit its contents to WhatsApp. Use of WhatsApp, Google and administrator sign-in is also subject to those providers' privacy policies.

Technology providers may process data outside the European Economic Area. For such transfers, they use GDPR mechanisms, particularly adequacy decisions or standard contractual clauses. Information about safeguards is available from the controller and in the providers' privacy policies: OpenAI, Cloudflare, Google, WhatsApp.

Data retention

Panel enquiries are retained for no more than 12 months after receipt; older submissions are deleted when subsequent enquiries are handled or the panel is opened. The administrator may delete them earlier once the matter is closed. If a contract is concluded, related documents are retained separately for the period required by law and necessary to establish, exercise or defend legal claims. Email and WhatsApp correspondence is retained for as long as needed to handle the matter, generally up to 12 months after closure, unless needed to perform a contract or protect legal claims.

Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction of processing and data portability where processing is automated and based on consent or a contract. You may object to processing based on legitimate interests on grounds relating to your particular situation. Send requests to arekoniv@gmail.com. You may lodge a complaint with the President of Poland's Personal Data Protection Office. We do not make decisions producing legal effects for users solely through automated processing or profile users for marketing.

Google Analytics and consent

With your consent, we activate Google Analytics 4 (Google Ireland Limited) to measure visits, page views, successful form submissions and WhatsApp, phone and email contact clicks. The legal basis is consent under Article 6(1)(a) GDPR. We do not load the Google Analytics tag before consent or after refusal. Refusal does not affect the website or form.

Website-generated events do not include your name, contact details or enquiry contents. Analytics information includes the visited page address, technical browser and device data and cookie identifiers. Google may process data outside the EEA using the mechanisms described in its privacy policy. Our code does not enable Google Signals or ad personalisation.

Your consent or refusal is stored locally in your browser for 180 days. The _ga and _ga_* analytics cookies are configured to expire within 180 days. You can withdraw consent at any time using “Cookie settings” in the footer and “Reject analytics”; withdrawal does not affect the lawfulness of earlier processing. On withdrawal, we remove these cookies where accessible to the website and stop measurement. Data retention within Google Analytics depends on that service's settings. Further information: Google Privacy Policy.

Cookies and security

We do not use advertising cookies or embed a WhatsApp widget. Infrastructure and sign-in providers may use essential technical mechanisms for security and authentication. The form limits submissions; for this purpose, we briefly retain a hash of an IP address combined with a time window, without storing the IP address itself in the form database. Rate-limit data expires after two hours and is deleted during the next cleanup operation. Infrastructure providers may keep their own technical logs.

Updated: 2 October 2026