Privacy Policy and GDPR Information Notice

1. Data controller

The controller of your personal data is:

2. Data we process

Depending on how you use the website, we may process:

• contact and enquiry data: name, email address, phone number, company, market, current website, message and any information you voluntarily provide;
• contract and billing data when you become a client;
• technical data contained in server logs, such as IP address, request date and time, requested URL, browser and device information, referring page and error data.

Please do not send special-category or other sensitive data unless it is genuinely necessary and expressly agreed with us.

3. Purposes and legal bases

• responding to enquiries, preparing an offer and taking steps before entering into a contract — Article 6(1)(b) GDPR;
• performing a contract and providing support — Article 6(1)(b) GDPR;
• accounting, tax and other legal duties — Article 6(1)(c) GDPR;
• website security, preventing abuse, service improvement and establishing or defending claims — our legitimate interests under Article 6(1)(f) GDPR;
• marketing communications, only where consent is required and has been given — Article 6(1)(a) GDPR. Consent may be withdrawn at any time.

4. Recipients and international transfers

Data may be disclosed only where necessary to hosting and infrastructure providers, email and IT providers, accounting or legal advisers, contractors supporting delivery, and public authorities entitled by law. Appropriate data-processing agreements are used where required.

Some technology providers may process data outside the European Economic Area. In that case we rely on a valid legal mechanism, such as an adequacy decision or Standard Contractual Clauses, and apply supplementary safeguards where required.

5. External content and links

Portfolio previews are delivered using a third-party website thumbnail service. Loading such a preview may disclose technical data, including your IP address and browser information, to that provider. Links to client projects and other external websites lead to services governed by their own privacy notices.

6. Retention

• general enquiries: for the time needed to answer and ordinarily no longer than 12 months afterwards;
• contract data: for the duration of the relationship and then for the periods required by tax, accounting and limitation rules;
• data relevant to claims: until the relevant limitation period expires;
• technical logs: ordinarily 30–90 days, or longer where needed to investigate a security incident.

Data may be deleted earlier where it is no longer required and no legal ground for retention applies.

7. Your rights

Where the applicable conditions are met, you may request access, rectification, erasure, restriction, data portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. Contact us at rw@walesagroup.pl.

You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

8. Voluntary provision and automated decisions

Providing data is voluntary, but data marked or described as necessary is required for us to reply or perform a contract. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Security and updates

We apply organisational and technical safeguards appropriate to the nature of the data and risks. We may update this notice when the website, providers or law changes. The current version is always published here.