Privacy policy

1. Who the controller is

The controller of your personal data is Wiktoria Zygmunt, a natural person carrying out unregistered business activity under Polish law, with no CEIDG entry and therefore no business VAT ID or REGON number.

Everything, data protection matters included, is handled at kontakt@corelly.pl; a postal address is given on request in reply to a message sent there. No data protection officer has been appointed.

2. What data I collect

• Contact form and email: your name, email address, subject, the content of your message and anything you choose to include in it.
• Project delivery: the details needed to enter into and settle a contract: company details, VAT ID, address, contact persons.
• Technical data: IP address, browser and operating system, written automatically to server logs by the hosting provider.

3. Purposes and legal bases

• Replying to your enquiry: legitimate interest (Art. 6(1)(f) GDPR), and where the conversation leads to work, steps prior to entering a contract (Art. 6(1)(b) GDPR).
• Performing a contract: Art. 6(1)(b) GDPR.
• Issuing and keeping accounting records: legal obligation (Art. 6(1)(c) GDPR).
• Establishing or defending legal claims: legitimate interest (Art. 6(1)(f) GDPR).

4. How long I keep it

• Correspondence that did not lead to work: up to 12 months from the last contact.
• Contract data: for the term of the contract and then until claims become time-barred.
• Accounting records: 5 years from the end of the calendar year in which the tax obligation arose.

5. Who receives the data

I do not sell data and do not pass it to third parties for marketing. Data may reach providers supporting me technically or formally, under a data processing agreement: a hosting and server infrastructure provider, and a transactional email provider that carries messages from the contact form. I keep my own books, so no accounting firm receives your data.

GDPR requires recipients or categories of recipients to be stated, so they are listed by category here. The names of the individual providers are given on request at kontakt@corelly.pl.

Some data is processed in the United States, outside the EEA: this covers the transactional email provider and may cover the hosting provider. Such transfers rely on the standard contractual clauses approved by the European Commission or another mechanism under Chapter V GDPR.

6. Your rights

You may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest. You may also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

7. Cookies

The site uses only cookies necessary for it to work: they remember your colour theme and language. These are technical cookies and do not require consent. The site currently uses no analytics or advertising trackers.

8. Automated decisions

I do not make decisions about you based solely on automated processing and I do not use profiling.