Privacy Policy

1. Controller and contact

The controller is Explore-IT Adrian Zdankiewicz, M. Konopnickiej 39/8, 84-240 Reda, Poland. For personal-data matters, write to kontakt@explore-it.pl. We have not appointed a data protection officer.

2. Data, purposes, legal bases and retention

• Enquiries and correspondence. We process contact details, company name, the request description and voluntarily supplied information and attachments to respond and discuss cooperation. A contact person, e-mail and description are required by the form. Company name, phone number, enquiry topic and attachments are optional. Without required details you cannot submit the form, but you may contact us another way. When you act on your own behalf to enter into or perform a contract, the basis is Article 6(1)(b) GDPR. For company representatives and other correspondence, the basis is Article 6(1)(f) GDPR — our interest in addressing the matter and handling business contacts. We close an enquiry after a final response, withdrawal from discussions or completion of agreed follow-up contacts. We then review the correspondence and remove material that is not needed for cooperation, legal obligations or the specific claims described below.
• Meetings. We process a name, e-mail, topic and time to accept the request and arrange the meeting. These details are necessary to handle the request. Acceptance does not confirm the booking: you must click the link in the confirmation e-mail. The basis is Article 6(1)(b) GDPR for pre-contract steps on your own behalf, or Article 6(1)(f) for company representatives and arranging contact. An unconfirmed request is used to handle the booking until confirmation, cancellation or expiry. After a meeting, we retain details until agreed follow-up actions are completed and discussions are closed; the correspondence or cooperation rules then apply.
• Cooperation, accounting and claims. We retain data needed to perform a contract while it is being performed — Article 6(1)(b) GDPR, and counterparty representatives' details under Article 6(1)(f). Legally required records are retained under Article 6(1)(c) until the relevant tax and accounting duties expire. Tax liabilities generally expire five years after the end of the year in which payment was due, subject to suspension or interruption. Evidence needed to establish, pursue or defend specific claims is retained under Article 6(1)(f) until the applicable limitation period expires, or, in a dispute, until final resolution and completion of enforcement. This concerns selected records relevant to the obligation or claim, not automatically all correspondence and attachments.
• Website operation and protection. We process IP addresses, request time, address and outcome, and browser information to maintain availability, diagnose faults and prevent abuse — Article 6(1)(f) GDPR. Short-lived records preventing excessive traffic and duplicate submissions are removed during periodic cleanup after the relevant restriction expires. Routine logs are removed once the operation and security review for the period they cover is complete, unless further investigation is needed. Records of a particular fault or incident are retained until investigation, remediation and related claims are closed.
• Privacy choices. Evidence of choices and changes is retained for up to 24 months after the latest decision to demonstrate lawful processing — Article 6(1)(c), read with Articles 5(2) and 7(1) GDPR. Analytics and advertising rely on the consent described in section 4.

Backups support recovery after a failure. Data removed from live systems may remain in rotating daily, weekly and monthly copies until the last copy containing it expires or is replaced. We do not use backups for further case handling or marketing; after restoration, we reapply the relevant retention rules and completed erasure requests.

Do not send passwords, secrets, unnecessary third-party data or special-category data.

3. Recipients and transfers outside the EEA

Recipients may include authorised people handling your enquiry, providers needed to handle it, accounting and legal advisers and legally authorised public bodies. We use:

• OVHcloud (OVH) — hosting and infrastructure services. OVH acts as a processor when storing customers' data. See the OVHcloud Data Processing Agreement.
• Google Ireland Limited and Google entities delivering the services — Google Analytics 4 and Google Ads following the relevant consent. Google's documentation distinguishes processing on our behalf in Analytics from its role as an independent controller for relevant advertising services; see Google's services and roles.
• Cloudflare, Inc. — Turnstile protection, which uses information such as IP addresses and signals from your browser and the visited website. Verification uses an invisible widget. Cloudflare processes signals on our behalf to protect the site and, as an independent controller, also to improve bot detection. See the Turnstile Privacy Addendum.

Google and Cloudflare operate globally, so data may be processed outside the EEA, particularly in the USA. According to Google's transfer information and Cloudflare's privacy policy, transfers to US entities covered by certification rely on the European Commission's EU–US Data Privacy Framework adequacy decision (Article 45 GDPR). In other cases specified in their terms, the providers identify European Commission Standard Contractual Clauses (Article 46 GDPR). OVHcloud's Data Processing Agreement also provides for those clauses for the transfers it describes to countries without an adequacy decision. This does not mean that every service or transfer relies on the same mechanism. The safeguards are available in the linked documents; you may also ask the Controller for information or a copy of the safeguards concerning your data.

4. Cookies, Google and your choices

Necessary browser storage remembers privacy choices for around 6 months, the selected language for up to 12 months, and navigation information for the session. It also supports website security. For this necessary use, we rely on the exemption in Article 399(3) of Poland's Electronic Communications Law (PKE).

You can choose optional purposes independently:

• Analytics — Google Analytics 4: measuring visited pages and interactions. Data includes cookie identifiers and device and activity information, without form contents.
• Advertising — Google Ads: measuring accepted enquiries, meeting requests and contact clicks and attributing them to ads. This category also covers audiences of previous visitors and tailored ads (remarketing), which involves advertising profiling based on activity.

The basis is Article 6(1)(a) GDPR and the consent required by Article 399 PKE. Optional Google tools remain blocked until a choice is made. Consent to one category does not enable the other. Refusal does not restrict contact or booking.

GA4 is configured to retain event data for 2 months and user data for 14 months. Resetting user-data retention on new activity is enabled: a new event from that user may restart their retention period. These settings concern individual-level data; they do not determine cookie lifetimes or retention of standard aggregated reports. Google explains these distinctions and the automatic deletion cycle in its Analytics retention documentation.

Google cookie lifetimes depend on the cookie type and service settings; some periods may renew on later activity. Descriptions of individual cookies and their lifetimes are in Google's cookie information. Google and Cloudflare describe retention for data processed for their own purposes in their policies: Google and Cloudflare.

Use “Cookie settings” in the footer at any time to change or withdraw consent. Withdrawal does not affect prior lawful processing. We remove cookies under our control for the disabled category. You can remove Google-domain cookies through browser settings. Withdrawal stops further use of the tools; you may ask the Controller to erase previously collected data under the rights below.

5. Your rights

You may request access, rectification, erasure, restriction and portability where provided by law. You may object to processing based on legitimate interests; an objection to direct marketing is unconditional. You may withdraw consent at any time.

Write to kontakt@explore-it.pl. We generally respond within one month. You may complain to Poland's President of the Personal Data Protection Office (UODO) or another competent supervisory authority. We do not make solely automated decisions producing legal or similarly significant effects about you.