Privacy and Cookie Policy

This Privacy and Cookie Policy (the ‘Policy’) sets out the rules for processing and protecting the personal data of users of the website available at digidraft.pl (the ‘Website’). It also describes the use of cookies and similar technologies.

The Policy complies with:

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).
2. Directive 2002/58/EC (ePrivacy Directive) concerning the processing of personal data and the protection of privacy in the electronic communications sector.
3. The Polish Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2018, item 1000, as amended) and the Telecommunications Law of 16 July 2004.

The controller of your personal data is:

Name

Fundacja Centrum Rozwoju Przedsiębiorczości ReworkBiz

Address

ul. Konstruktorska 12a, 02-673 Warszawa

Tax ID (NIP)

5214026198

REGON

525734879

KRS

0001044665

E-mail

biuro@digidraft.pl

Phone

+48 731 412 684

If you have questions about the processing of your personal data or wish to exercise your rights, contact us at the email address above or write to our registered office.

1. Personal data - any information relating to an identified or identifiable natural person.
2. Processing - any operation performed on personal data, such as collection, recording, storage, organisation, alteration, disclosure or erasure.
3. Controller - the entity that determines the purposes and means of processing personal data.
4. Consent - a freely given, specific, informed and unambiguous indication of a person’s wishes permitting the processing of their data (Article 4(11) GDPR).
5. Cookies - small text files stored on a user’s device by a website.
6. UODO - the Polish Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, the supervisory authority for personal data processing in Poland.

We process your personal data only where we have a valid legal basis. The purposes and corresponding legal bases are described below:

1. Quote request form (CTA) - in the ‘Get a quote’ section, we collect an email address or phone number of your choice and the requested service to respond to your enquiry. Legal basis: Article 6(1)(b) GDPR, taking steps at the data subject’s request before entering a contract. Contact details are optional, but necessary to receive a quote.
2. Quotation brief - after submitting a quote request, you can answer several questions about your website, customers and budget, such as the website address, Google search terms and competitors. We link the answers to your enquiry and use them only to prepare a quote. Legal basis: Article 6(1)(b) GDPR (pre-contractual steps). The brief is optional; we can prepare a quote without it.
3. Contact form (Contact page) - we collect your name, email address, enquiry category and message to handle your request. Legal bases: Article 6(1)(b) GDPR (pre-contractual steps) and Article 6(1)(a) GDPR (consent ticked in the form). Consent also covers any further informational correspondence and can be withdrawn at any time without affecting the lawfulness of earlier processing.
4. Contract performance / service delivery - if you use our services, we process the data needed to enter and perform the contract (Article 6(1)(b) GDPR).
5. Website traffic analysis (Google Analytics) - only after consent to analytics cookies do we process anonymous Website usage data based on that consent (Article 6(1)(a) GDPR). Refusing consent does not restrict access to the Website.
6. Form spam protection (Cloudflare Turnstile) - the quote and contact forms are protected by Cloudflare Turnstile, which checks whether a submission comes from a person rather than a bot. Legal basis: Article 6(1)(f) GDPR, the Controller’s legitimate interest in Website security and protection against abuse, spam and automated submissions.
7. Compliance with legal obligations - where required by law (Article 6(1)(c) GDPR), for example accounting and tax obligations.
8. The Controller’s legitimate interest - for example, establishing or defending claims and ensuring Website security (Article 6(1)(f) GDPR).

Depending on how you use the Website, we may process the following data categories:

1. Identification data - name (contact form on the Contact page).
2. Contact data - email address (quote and contact forms), or phone number if you choose telephone contact in the quote form.
3. Communication content - enquiry category and message (contact form), and answers in the quotation brief.
4. Technical data (analytics, only with consent) - anonymised IP address, browser type and version, screen resolution, pages visited, session duration and country/city of origin (collected by Google Analytics 4).
5. Cookie preferences - your cookie consent choice, stored locally in your browser’s localStorage as a necessary part of consent management.

Cookies are small text files saved on your device when you visit the Website. We use them only as described below. The Website does not use advertising or remarketing cookies, or tracking pixels such as Meta Pixel.

Cookie categories

1. Essential cookies - do not require consent; they are necessary for basic Website operation and remembering your privacy preferences.

2. Analytics cookies - require your consent and are loaded only after you give it.

Managing cookie consent

On your first visit, a banner lets you choose your preferences. You can change your settings at any time by clicking ‘Cookie settings’ in the Website footer or below:

Manage cookie settings

Blocking cookies in your browser

You can also manage cookies in your browser settings. Instructions for popular browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

You can also use the Google Analytics opt-out tool: Google Analytics Opt-out.

Only after you consent to analytics cookies do we use Google Analytics 4, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics collects anonymous statistical data about Website use, such as visits, pages viewed and session duration. We use IP anonymisation (anonymize_ip: true), meaning Google truncates the IP address before transferring it to servers in the USA.

Google LLC is certified under the Data Privacy Framework (DPF), a mechanism permitting personal data transfers from the EEA to the USA, recognised by the European Commission as providing an adequate level of data protection (Decision 2023/1795 of 10 July 2023). More information: Google Privacy Policy.

Your data may only be disclosed to the following categories of recipients:

1. Google LLC (Google Analytics 4) - only if you have consented to analytics cookies. Anonymized data, transferred under the DPF.
2. Cloudflare, Inc. (Turnstile - form protection) - the provider of the Turnstile anti-spam mechanism. When a form is submitted, it processes technical data (including the IP address and signals about browser interaction) to distinguish a person from a bot. Data may be transferred to the USA under the Data Privacy Framework (Cloudflare, Inc. is DPF-certified). Details of processing are set out in the Turnstile Privacy Addendum and Cloudflare Privacy Policy.
3. Hosting and server infrastructure provider - a processor acting solely on our documented instructions, under a data processing agreement (Article 28 GDPR).
4. Legal, accounting and auditing service providers - where processing is necessary to fulfil legal or contractual obligations.
5. Public authorities - only upon a request that complies with applicable law (e.g. courts, law enforcement agencies, the Polish Personal Data Protection Office).

1. Form data (quote, brief, contact) - for as long as necessary to handle the enquiry, then for the period required by accounting rules and limitation periods for claims (up to 6 years).
2. Analytics data (Google Analytics) - data collected by GA4 is retained by Google for the period configured in the service settings (14 months by default). Consent given to us for data collection expires 12 months after it is granted.
3. Cookie preferences (localStorage) - the consent record is stored locally on your device for 12 months from the date of consent.
4. Data arising from contracts - for the duration of the contract and the limitation period for claims arising from its performance.

Under the GDPR, you have the following rights, which you may exercise by contacting us at biuro@digidraft.pl:

1. Right of access (Article 15 GDPR) - you may obtain confirmation of whether we process your data and, if so, access to it and a copy.
2. Right to rectification (Article 16 GDPR) - you may request the correction of inaccurate data or completion of incomplete data.
3. Right to erasure - the 'right to be forgotten' (Article 17 GDPR) - you may request the erasure of data when it is no longer necessary for the purposes for which it was collected, or when you have withdrawn consent.
4. Right to restriction of processing (Article 18 GDPR) - you may request that we restrict the processing of your data in certain situations (for example, when you dispute its accuracy).
5. Right to data portability (Article 20 GDPR) - you may receive your data in a structured, commonly used and machine-readable format and transmit it to another controller.
6. Right to object (Article 21 GDPR) - you may object at any time to the processing of data based on the controller's legitimate interests.
7. Right to withdraw consent (Article 7(3) GDPR) - if we process your data on the basis of consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw consent to analytics cookies through the cookie settings panel available in the Site footer.
8. Right to lodge a complaint with a supervisory authority (Article 77 GDPR) - you have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, if you believe that processing infringes the GDPR. If you live or work in another EU Member State, you may also lodge a complaint with the competent supervisory authority in that state (Article 77(1) GDPR).

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or disclosure:

1. Transmission encryption - communication between your browser and the Site is encrypted using TLS/HTTPS.
2. Data minimisation - we only collect data necessary for specific purposes (Privacy by Design, Article 25 GDPR).
3. IP anonymisation - IP address anonymisation is enabled in Google Analytics (anonymize_ip: true).
4. Access control - only authorised people bound by confidentiality obligations have access to your data.
5. Regular backups and updates - we regularly back up data and update systems to minimise risk.
6. Incident procedures - in the event of a personal data breach, we will notify UODO within 72 hours (Article 33 GDPR) and, where required, inform you without undue delay (Article 34 GDPR).

The Site may contain links to external websites (social media, partners). We are not responsible for the privacy policies of these websites. We recommend reviewing their privacy policies before using them.

We do not use automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

We reserve the right to amend this Policy, for example as the Site develops, legislation changes or supervisory authorities issue decisions. Significant changes will be communicated by:

1. Updating the date - shown at the top of the document.
2. Displaying the cookie banner again - if changes concern the scope of data processing that requires consent.
3. A social media announcement - on the official DigiDraft Facebook profile (facebook.com/digidraftagency).

Using the Site after changes have been introduced constitutes acceptance of the updated Policy.

For matters concerning personal data protection, exercising your rights or privacy settings, please contact:

E-mail

biuro@digidraft.pl

Phone

+48 731 412 684

Address

Fundacja Centrum Rozwoju Przedsiębiorczości ReworkBiz,
ul. Konstruktorska 12a, 02-673 Warszawa