Privacy Policy

§ 1. Controller of personal data

The controller of personal data within the meaning of Article 4(7) of the GDPR is FOTON PROSTA SPÓŁKA AKCYJNA, with its registered office in Warsaw at ul. Ludwika Rydygiera 12/2, 01-793 Warszawa, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001216858, NIP: 5253074592, REGON: 543724884 (hereinafter: the "Controller" or "we").

The Controller has not appointed a Data Protection Officer. For matters relating to the processing of personal data, you can contact us at the email address biuro@fotonremonty.pl.

§ 2. Scope of data collected

The Controller processes the following categories of personal data:

2.1. Data provided via the contact form:

• first and last name,
• email address,
• the content of the message.

2.2. Data provided in the online tools made available on the Website (Renovation Calculator, Property Valuation):

• email address,
• technical parameters entered by the User (including floor area, finishing standard, location).

This data is processed solely in order to generate a result and send it to the email address provided.

2.3. Data collected automatically:

• IP address in anonymised form,
• type and version of the web browser and operating system,
• device information (desktop / mobile device) and screen resolution,
• information about pages visited on the Website, the time of the visit and the entry source,
• server logs of the hosting provider.

This data is collected by means of the following tools:

• Google Analytics 4 - statistical analysis of traffic on the Website with anonymisation of the IP address;
• Google Ads - measuring the effectiveness of advertising campaigns; the conversion event is recorded only at the moment the User submits the contact form.

§ 3. Purposes and legal bases of processing

Personal data is processed for the following purposes and on the following legal bases:

§ 4. Data retention period

The retention period for personal data depends on the purpose of processing and is, respectively:

• data provided in the contact form and in the online tools — for the period necessary to handle the enquiry, but no longer than 3 years from the last contact (for the purposes of defending or asserting claims);
• data of Clients with whom a service contract has been concluded — for the duration of the contract and for 5 years counted from the end of the calendar year in which the last invoice was issued (an obligation arising from the Accounting Act and the Act on Value Added Tax);
• statistical data processed within Google Analytics 4 — for a maximum of 14 months (the default retention period);
• server logs — for a maximum of 90 days;
• data processed on the basis of consent — until consent is withdrawn.

§ 5. Data recipients

The Controller entrusts the processing of personal data to the following entities acting on its behalf, on the basis of concluded data processing agreements (Article 28 GDPR):

• Formspree Inc., with its registered office in the United States of America — technical handling of the contact form (transmission of messages to the Controller's mailbox);
• Google Ireland Limited, with its registered office in Ireland, and Google LLC, with its registered office in the United States of America — analysis of traffic on the Website (Google Analytics 4) and measurement of advertising campaign conversions (Google Ads);
• Vercel Inc., with its registered office in the United States of America — hosting of the Website and delivery of content via a CDN; servers used in the European Union region (Frankfurt).

Apart from the entities listed above, data may be disclosed to public authorities on the basis of applicable legal provisions (including tax authorities, courts and law enforcement authorities). The Controller does not sell personal data to third parties.

§ 6. Transfer of data outside the EEA

Some of the entities processing personal data on behalf of the Controller (Formspree Inc., Google LLC, Vercel Inc.) have their registered office in the United States of America, which entails the transfer of personal data outside the European Economic Area. The transfer takes place on the following bases:

• the EU–U.S. Data Privacy Framework (DPF) — Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, finding an adequate level of protection of personal data ensured by the United States in respect of entities certified under the DPF;
• Standard Contractual Clauses — approved by the European Commission and applied as an additional safeguard in the case of entities not covered by DPF certification.

A copy of the safeguards applied will be made available upon the User's written request sent to biuro@fotonremonty.pl.

§ 7. Rights of the data subject

In connection with the processing of personal data, the User has the following rights:

• the right of access to data (Article 15 GDPR) — obtaining confirmation as to whether data is being processed and receiving a copy of it;
• the right to rectification of data (Article 16 GDPR) — requesting the correction of inaccurate data or the completion of incomplete data;
• the right to erasure of data (Article 17 GDPR, the "right to be forgotten") — requesting the erasure of data in the cases specified by the GDPR;
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability (Article 20 GDPR) — receiving data in a structured, commonly used, machine-readable format;
• the right to object (Article 21 GDPR) — to the processing of data on the basis of the legitimate interest of the Controller (Article 6(1)(f) GDPR), including to Google Analytics analytics;
• the right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before its withdrawal (to the extent that processing is based on consent).

The above rights are exercised by submitting a request to biuro@fotonremonty.pl. A response is provided within 30 days of receipt of the request.

The User also has the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

§ 8. Automated decision-making and profiling

The User's personal data is not subject to automated decision-making, including profiling, within the meaning of Article 22 of the GDPR. Decisions regarding the handling of enquiries, the preparation of quotes and the provision of services are made by persons acting on behalf of the Controller.

§ 9. Cookies

The Website uses cookies and similar technologies in order to ensure basic functionality (essential cookies) and statistical analysis of traffic (Google Analytics 4 with anonymisation of the IP address).

Detailed information about the cookies used and how to manage them can be found in the Cookie Policy.

The User can disable Google Analytics analytics using the official browser add-on available at tools.google.com/dlpage/gaoptout.

§ 10. Children's data

Our services are addressed to adults. We do not knowingly collect the personal data of persons under 16 years of age. If we become aware that we are processing the data of a minor without the required consent of a parent or legal guardian, such data will be deleted without undue delay.

§ 11. Data security

The Controller applies appropriate technical and organisational measures to protect the personal data processed, including encrypted transmission (HTTPS/TLS), access control to systems, regular software updates and the creation of backups. In the event of a personal data breach, the Controller proceeds in accordance with the procedure set out in Articles 33 and 34 of the GDPR.

§ 12. Changes to the Privacy Policy

The Controller reserves the right to update this Privacy Policy, in particular in connection with changes in the law or the development of the services provided. Users will be informed of material changes by means of a notice on the Website's home page or by email (where the Controller holds the User's address). The date of the last update is indicated at the top of this document.

§ 13. Contact

For all matters relating to the protection of personal data, the manner of its processing or the exercise of the rights referred to in § 7, please contact us:

• FOTON PROSTA SPÓŁKA AKCYJNA
• ul. Ludwika Rydygiera 12/2, 01-793 Warszawa
• email: biuro@fotonremonty.pl