Who is responsible for your data
The controller of personal data is Grzegorz Pawlak. InfinityInbay is the brand I work under.
For matters concerning personal data, write to kontakt@infinityinbay.pl.
What data I process and why
Contact form. When you send a message, I receive the name, company name and phone number (if you enter them), email address and message you provide. I use them only to reply and to continue the correspondence about the matter you are writing about.
Five questions (“Describe the problem”). The answers go into the message only when you send it. Before that, nothing is sent or saved anywhere.
Providing data is voluntary, but without an email address I can't reply. Please don't include information that isn't needed to describe the matter, especially sensitive data and data about other people.
Technical data. The server the site runs on processes the IP address and basic information about each request, for example the browser type and the time of the visit. This is needed for the site to display and to protect it from abuse.
Messages from the form are automatically checked for spam. Apart from that, I don't use the data for automated decision-making or profiling.
Legal basis
I process data under the GDPR, Regulation (EU) 2016/679:
- replying to an enquiry about working together or a quote: Article 6(1)(b) (steps taken at your request before entering into a contract),
- other correspondence: Article 6(1)(f) (legitimate interest, namely replying to messages received),
- running the site, its security and spam protection: Article 6(1)(f) (legitimate interest, namely keeping the site working and secure).
The form doesn't ask for consent, because replying to your message doesn't require it. I don't send newsletters or marketing messages.
Who has access to the data
The data is seen by me and by the companies that technically run the site and the correspondence:
- Netlify, Inc. (USA): hosting the site and receiving and storing messages from the form, including checking them for spam.
- Google Cloud EMEA Limited (Ireland), the Google Workspace service: the provider of the mailbox that receives notifications about new messages and that I reply from.
If the conversation leads to working together, the contract and invoicing are handled by Useme (useme.com). Useme then processes the data needed for the contract and invoice as a separate controller, on the terms described in its own privacy policy.
I don't sell data or pass it on to anyone for marketing purposes.
Transfers outside the European Economic Area
Netlify, Inc. is based in the United States, so data may be processed outside the EEA. Netlify states that it takes part in the EU-U.S. Data Privacy Framework and uses standard contractual clauses approved by the European Commission. Current information is in Netlify's privacy policy: netlify.com/privacy.
Email runs on Google Workspace. The contract is with Google Cloud EMEA Limited in Ireland, but Google may also process data in other countries, including the USA. Google states that it takes part in the EU-U.S. Data Privacy Framework and uses standard contractual clauses. Details are in the Google Workspace data processing terms: workspace.google.com/terms/dpa_terms.html.
How long I keep data
I keep messages from the form for as long as the correspondence goes on, and then for no longer than 12 months after the last message. After that I delete them from the form panel and from the mailbox.
If the correspondence leads to working together, further processing takes place on the basis of the contract and the laws that apply to it.
How long technical data stays in the server logs is decided by the hosting provider.
Your rights
You have the right to:
- access your data and receive a copy,
- rectification,
- erasure,
- restriction of processing,
- portability of data provided in connection with an enquiry about working together,
- object to processing based on legitimate interest.
To use them, write to kontakt@infinityinbay.pl. I'll reply without undue delay, within one month at the latest.
You can also lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
Cookies, browser storage and analytics
This site doesn't set cookies and doesn't use analytics or advertising tools. Fonts and scripts are served from the same domain, without calls to outside servers.
In your browser's storage the site keeps only what the features you use need: the chosen style of the site (so it doesn't ask every time) and, until you close the tab, the message carried over from the five questions to the form, the time the form was last sent and your place on the site map. This information isn't sent anywhere. You can delete it by clearing the site data in your browser.
Changes
If the way data is processed changes, I'll update this document and the date at the top of the page.