← Back to the website
Personal data protection

GDPR privacy notice

Last updated: 30 October 2026 · This is an English translation. Wersja polska

In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR), I inform you that:

  1. Data controller. The controller of your personal data is Michał Sadowski, ul. Leszczyńskiej 20, 93-347 Łódź, Poland (the “Controller”).

  2. Contact. For any matter concerning your personal data, you can contact the Controller by email at zamowienia [at] zrobione.online or by post at the address above. The Controller has not appointed a Data Protection Officer.

  3. Scope of data. I process the data you provide in the form on zrobione.online: your first name, email address, phone number, the address of your current website and information about your needs (e.g. what bothers you about your current website, preferred colors, additional notes), as well as any data contained in our further correspondence. I attach to your request information on how you found the website (e.g. from Google search, from Facebook or from a specific campaign) and the language version of the website you sent it from.

  4. Purposes and legal bases of processing. I process your data in order to:

    1. reply to your enquiry and prepare an offer, at your request, before a possible contract is concluded (Article 6(1)(b) GDPR);
    2. conduct correspondence and, where necessary, establish, exercise or defend legal claims, which is the Controller’s legitimate interest (Article 6(1)(f) GDPR);
    3. keep website visit statistics and check which sources (e.g. search engines, social media, campaigns) bring visitors and requests, which is the Controller’s legitimate interest (Article 6(1)(f) GDPR).

  5. Visit statistics. Each time you visit the website, I record the page you visited, the address of the page you came from (without URL parameters), campaign parameters (UTM), the type of device (computer, tablet or phone) and the language version. To tell visitors apart, the server creates a one-way hash of your IP address and browser information combined with a random key that changes every day. I do not store your IP address, and once the key changes it is impossible to link visits from different days or to identify a visitor. The website does not use cookies or similar technologies for visitors.

  6. External fonts and scripts. The website uses Google Fonts (Google) and script libraries provided by cdnjs (Cloudflare, Inc.). To display them, your browser connects to these companies’ servers, which thereby receive your IP address and browser information. This data may also be processed in the United States. Both companies participate in the EU-US Data Privacy Framework, covered by a European Commission adequacy decision. The legal basis is the Controller’s legitimate interest in displaying the website correctly and quickly (Article 6(1)(f) GDPR). For more information, see the privacy policies of Google and Cloudflare.

  7. Recipients of data. Your data may be shared only with entities providing website hosting and email services to the Controller (Hostido.pl), under a data processing agreement. When the website is displayed, your IP address and browser information are also received by the providers of fonts and scripts (see External fonts and scripts). Your data is not shared with any other parties or used for marketing purposes.

  8. Transfers outside the EEA. Data from the form and the statistics is not transferred to third countries (outside the European Economic Area) or to international organisations. The exception is your IP address and browser information, which may reach the providers of fonts and scripts in the United States when the website is displayed (see External fonts and scripts).

  9. Retention period. I keep your data for as long as our correspondence continues and for up to 12 months after it ends. If a contract is concluded, the data will be kept until the limitation period for claims arising from it expires and for as long as required by law, including tax law. I keep visit statistics without a time limit, because they do not make it possible to identify visitors.

  10. Your rights. You have the right to:

    • access your data and receive a copy of it (Article 15 GDPR),
    • rectify your data (Article 16 GDPR),
    • have your data erased (Article 17 GDPR),
    • restrict processing (Article 18 GDPR),
    • data portability (Article 20 GDPR),
    • object to processing based on legitimate interest (Article 21 GDPR).

    To exercise these rights, write to zamowienia [at] zrobione.online.

  11. Complaint to the supervisory authority. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) if you believe that the processing of your data violates the GDPR.

  12. Providing data is voluntary. Providing data is voluntary. To reply to your enquiry and prepare an offer, I need either your email address or your phone number. Other data (first name, website address, description of your needs, preferred colors, notes) is not required; not providing it only affects the form of contact and the scope of the offer.

  13. Automated decision-making. Your data will not be used for automated decision-making, including profiling.

← Back to the form