StronyThis Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit zavcode.com (the "Website") or otherwise interact with us. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Polish Act on the Protection of Personal Data of 10 May 2018.
1. Data Controller
The data controller of your personal data is:
Kacper Zawojski
Modzurów, ul. Arki Bożka 15, 47-415 Rudnik, Poland
NIP: PL6392031090
REGON: 527724419
Registered in CEIDG (Central Register and Information on Economic Activity)
Contact: [email protected]
We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Article 37 GDPR. For any privacy-related matter, please contact us at the email above.
2. Scope of this Policy
This Policy applies to personal data we process when you:
- visit and browse the Website;
- submit a contact or booking form;
- exchange email correspondence with us;
- create or maintain an administrative account in our content management system (admin panel only — there is no public registration available on the Website);
- make a payment for our products or services (where applicable).
3. Categories of Personal Data We Process
Depending on how you interact with us, we may process the following categories of personal data:
(a) Identification and contact data — name, surname, email address, telephone number, company name, position, and any other information you voluntarily provide in our contact or booking forms.
(b) Communication content — the content of messages, attachments, and any information you share with us during correspondence.
(c) Technical and device data — IP address, browser type and version, operating system, device type, referring URL, and similar technical identifiers automatically transmitted by your browser.
(d) Usage data — pages visited, time spent on pages, page-view and page-leave events, and other interactions with the Website (collected only with your consent via PostHog — see Section 8).
(e) Authentication data (admin users only) — email address, hashed password, session identifiers.
(f) Payment data — where you make a payment, transaction identifiers, amount, currency, and limited billing information. Full card data is processed exclusively by our payment provider (Stripe) and is not stored on our servers (see Section 9).
(g) Anti-spam data — interactions with Google reCAPTCHA, including IP address and a cookie set by Google, used to distinguish humans from bots.
We do not knowingly process special categories of personal data (Article 9 GDPR) such as health, biometric, or political data through the Website.
4. Purposes and Legal Bases for Processing
We process your personal data only when we have a valid legal basis under Article 6(1) GDPR:
| Purpose | Legal basis |
|---|---|
| Responding to messages submitted via contact and booking forms | Art. 6(1)(b) GDPR — pre-contractual measures at your request, and Art. 6(1)(f) — our legitimate interest in responding to inquiries |
| Sending transactional emails (form confirmations, password resets) | Art. 6(1)(b) and 6(1)(f) GDPR |
| Securing forms against spam and abuse via Google reCAPTCHA | Art. 6(1)(f) GDPR — legitimate interest in protecting our infrastructure |
| Operating and securing the admin panel and user sessions | Art. 6(1)(f) GDPR — legitimate interest in providing and securing the service |
| Statistical analytics (PostHog) | Art. 6(1)(a) GDPR — your consent given via the cookie banner |
| Processing payments | Art. 6(1)(b) GDPR — performance of a contract |
| Compliance with accounting, tax, and other legal obligations | Art. 6(1)(c) GDPR — legal obligation |
| Defending against and pursuing legal claims | Art. 6(1)(f) GDPR — legitimate interest |
You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for analytics, change your preferences in the cookie banner or clear your browser storage.
5. Form Data
The Website provides two types of forms:
- a contact form for general inquiries, and
- a booking form for scheduling consultations or meetings.
Form submissions are stored in our PostgreSQL database, hosted on infrastructure described in Section 11. We retain submissions for as long as necessary to handle your request and, afterwards, for a limited period to address possible follow-ups or legal claims (see Section 12).
Providing your data via the forms is voluntary, but without it we may be unable to respond to your inquiry or arrange a booking.
6. Cookies and Local Storage
We use cookies and similar technologies (browser local storage) to operate the Website, secure forms, remember your preferences, and — only with your consent — analyse usage. You can manage your preferences at any time via the cookie banner or your browser settings.
We classify cookies and storage entries into four categories: necessary, functional, analytics, and marketing. Currently we do not use any marketing cookies.
| Identifier | Type | Provider | Purpose | Category | Retention |
|---|---|---|---|---|---|
payload-token | HTTP-only cookie | zavcode (1st party) | Admin/user session authentication | Necessary | Session / up to 7 days |
consent_prefs | Local storage | zavcode (1st party) | Stores your cookie consent choices (version, locale, categories) | Necessary | Until cleared by you |
alert_storage | Local storage | zavcode (1st party) | Remembers UI alerts you have dismissed | Functional | Until cleared by you |
_GRECAPTCHA | Cookie | Google LLC (3rd party) | Form spam and bot protection (reCAPTCHA) | Necessary (security) | Up to 6 months |
PostHog cookies (e.g. ph_*) | Cookie | PostHog (1st-party domain) | Statistical analytics (page views, events) | Analytics | Up to 12 months |
Necessary cookies do not require consent under Article 173 of the Polish Telecommunications Law and Article 6(1)(f) GDPR. Analytics cookies are loaded only after you grant consent in the cookie banner.
Google Fonts: We use the Inter font family loaded via Next.js, which self-hosts the font files at build time. As a result, no requests are made from your browser to Google's servers when the font is rendered, and no related personal data is transmitted to Google.
7. Recipients of Personal Data
We share personal data only with carefully selected service providers acting as data processors under Article 28 GDPR (each bound by a Data Processing Agreement), and with public authorities where required by law. Categories of recipients include:
- Hosting and infrastructure providers — see Section 11.
- Email service providers — our SMTP provider used to send transactional emails.
- Analytics providers — PostHog (only after consent).
- Anti-spam providers — Google LLC (Google reCAPTCHA).
- Payment providers — Stripe Payments Europe, Ltd.
- Professional advisors — accountants, legal counsel, and IT contractors, where strictly necessary.
- Public authorities — tax authorities, courts, law enforcement, or other competent bodies, where required by applicable law.
We do not sell your personal data and we do not share it with third parties for their own marketing purposes.
8. Analytics — PostHog
We use PostHog to understand how visitors use the Website (e.g. which pages are viewed, how long visitors stay, page-leave events, and selected custom events). PostHog is loaded only if you consent to analytics cookies in the cookie banner. The legal basis for this processing is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
Provider and legal entity. PostHog is provided by PostHog Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA), with a UK affiliate Hiberly Ltd. PostHog Inc. acts as our data processor under Article 28 GDPR; we are the data controller. We have entered (or will enter, before activating analytics) into a Data Processing Agreement with PostHog, which incorporates the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) for any transfers outside the EEA.
Hosting region. We use PostHog Cloud EU, which is hosted on AWS infrastructure in the eu-central-1 region (Frankfurt, Germany). Event and user data captured via the Website is stored on these EU-based servers. Notwithstanding the EU hosting location, access by PostHog personnel based outside the EEA cannot be entirely excluded; such access is governed by the DPA and Standard Contractual Clauses referenced above.
Data collected. Depending on your interactions, PostHog may process: page views and page-leave events, selected custom events, browser and device information (browser type, OS, screen size), UTM parameters, referrer URL, approximate location derived from IP, and a pseudonymous identifier stored in cookies/local storage. We do not send your name, email address, or other directly identifying information to PostHog from the public Website.
Your controls. You can opt out at any time by changing your preferences in the cookie banner or by clearing PostHog cookies and local storage in your browser. If you wish to exercise your rights of access, erasure, or other GDPR rights specifically against the data we hold in PostHog, contact us at [email protected] and we will action the request, including via PostHog's data-deletion mechanisms where applicable.
PostHog's privacy policy is available at https://posthog.com/privacy.
9. Payments — Stripe
If you make a payment for our products or services, the payment is processed by Stripe Payments Europe, Ltd. (Ireland) and its affiliates (collectively, "Stripe"). Stripe acts as an independent data controller for the payment data you enter into Stripe's payment forms (such as full card number, expiry date, and CVC). We never see, store, or have access to your full card details.
We receive limited transaction information from Stripe (e.g. transaction ID, amount, currency, last four digits of the card, and billing country) for accounting and order-fulfilment purposes. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR — accounting and tax law).
Stripe's privacy policy is available at https://stripe.com/privacy.
10. Google reCAPTCHA
We use Google reCAPTCHA (v2 and/or v3) to protect our forms from spam and automated abuse. reCAPTCHA is provided by Google Ireland Limited (for users in the EEA) and analyses your interactions with the Website (including IP address, mouse movements, and the _GRECAPTCHA cookie) to determine whether you are a human or a bot. The legal basis is our legitimate interest in protecting our infrastructure (Art. 6(1)(f) GDPR).
By using forms protected by reCAPTCHA you accept the application of Google's Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms).
11. Hosting, Infrastructure, and International Transfers
The Website and its database are hosted on DigitalOcean infrastructure located within the European Union. Specifically:
- Application hosting: DigitalOcean (EU region).
- PostgreSQL database: DigitalOcean (EU region).
- Media storage: DigitalOcean Spaces (S3-compatible object storage, EU region), optionally served via a CDN.
- Content management: Payload CMS, self-hosted on the same infrastructure.
- Analytics storage: PostHog Cloud EU, hosted on AWS in the eu-central-1 region (Frankfurt, Germany) — applies only if you consent to analytics cookies (see Section 8).
DigitalOcean is operated by DigitalOcean, LLC (USA) and its EU affiliates. Although our data is stored in the EU, DigitalOcean's parent company is established in the United States, which means access by US-based personnel cannot be entirely excluded. Where any data transfer outside the European Economic Area takes place, we rely on appropriate safeguards under Chapter V GDPR — in particular the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) — and, where applicable, supplementary measures.
Other providers that may receive personal data and that are established outside the EEA — notably PostHog Inc. (USA) for analytics infrastructure and Google LLC for reCAPTCHA — likewise process data under Standard Contractual Clauses or, where applicable, the EU–US Data Privacy Framework.
You may request a copy of the safeguards applied by writing to [email protected].
12. Retention
We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, in line with the following principles:
- Form submissions and correspondence — for the duration of the inquiry and up to 3 years after the last contact, in order to address possible follow-ups and legal claims.
- Admin account data — for as long as the account exists, plus up to 12 months after closure for security and audit purposes.
- Analytics data (PostHog) — up to 12 months from collection.
- Payment and accounting data — for 5 years from the end of the calendar year in which the transaction occurred (Polish Accounting Act).
- Logs and security data — typically up to 12 months.
- Cookies — as indicated in the table in Section 6.
After these periods, the data is deleted or irreversibly anonymised, unless a longer retention period is required by law or to defend against legal claims.
13. Your Rights under GDPR
You have the following rights, which you may exercise free of charge by contacting us at [email protected]:
- Right of access (Art. 15) — confirmation whether we process your data and a copy of it.
- Right to rectification (Art. 16) — correction of inaccurate or incomplete data.
- Right to erasure / "right to be forgotten" (Art. 17) — deletion of your data, subject to legal exceptions.
- Right to restriction of processing (Art. 18).
- Right to data portability (Art. 20) — receipt of your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — to processing based on our legitimate interests, including profiling.
- Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Right not to be subject to automated decision-making (Art. 22) — we do not make decisions producing legal or similarly significant effects based solely on automated processing.
You also have the right to lodge a complaint with the Polish supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl) — or with the supervisory authority in your country of residence.
We will respond to your request within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month.
14. Security
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, and disclosure, including:
- TLS/HTTPS encryption of all data in transit;
- encryption of stored passwords using industry-standard hashing;
- restricted, role-based access to administrative systems;
- regular software updates and security patches;
- backups and recovery procedures;
- vendor due diligence and Data Processing Agreements with all processors.
Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
15. Children
The Website is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us so that we can delete it.
16. Automated Decision-Making and Profiling
We do not make decisions producing legal or similarly significant effects based solely on automated processing of your personal data, including profiling within the meaning of Article 22 GDPR.
17. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this Policy indicates when it was last revised. Material changes will be communicated via the Website or, where appropriate, by email.
18. Contact
For any questions, concerns, or requests regarding this Policy or your personal data, please contact us at:
Email: [email protected]