§1. Data Controller
The controller of personal data is the Firma Dla Każdego Foundation, with its registered office in Warsaw, ul. Lwowska 17/4, 00-660 Warsaw, Poland, NIP: 5252625624.
Contact: kontakt@firmadlakazdego.pl, tel. +48 575 594 500
§2. Scope of Data Collected
The Controller collects and processes the following personal data:
- Full name
- Email address
- Phone number
- Content of messages sent via the contact form
- IP address and technical browser data (through cookies and analytics tools)
§3. Purposes and Legal Bases for Processing
- Handling contact inquiries — based on Art. 6(1)(f) GDPR (legitimate interest of the controller)
- Performance of the cooperation agreement — based on Art. 6(1)(b) GDPR
- Fulfillment of legal obligations (accounting, taxes) — based on Art. 6(1)(c) GDPR
- Analytics and service quality improvement — based on Art. 6(1)(a) GDPR (user consent)
- Establishment or defense of legal claims — based on Art. 6(1)(f) GDPR
§4. Data Retention Period
- Contact form data — until the inquiry is resolved, no longer than 12 months
- Cooperation agreement data — for the duration of the agreement and 5 years thereafter
- Accounting and tax data — in accordance with tax law requirements (5 years from the end of the tax year)
- Analytics data (cookies) — up to 13 months from the last visit
§5. User Rights
Every data subject has the right to:
- Access their personal data
- Rectification of inaccurate data
- Erasure of data ("right to be forgotten")
- Restriction of processing
- Data portability
- Object to processing
- Withdraw consent at any time (without affecting the lawfulness of processing prior to withdrawal)
- Lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw
§6. Data Recipients
Personal data may be shared with:
- Hosting service providers (Vercel Inc.)
- Email service providers (Resend)
- Analytics tool providers (Google Analytics)
- Accounting firms and legal advisors cooperating with the Foundation
- State authorities based on applicable legal provisions
§7. Cookies
- Essential cookies — ensuring proper website functionality (e.g., remembering cookie consent)
- Analytics cookies — Google Analytics — collecting anonymous visit statistics
- Marketing cookies — Google Tag Manager — personalizing advertising content
Users can manage cookie settings in their browser. Disabling cookies may limit website functionality.
§8. Data Transfers Outside the EEA
Due to the use of Google and Vercel services, data may be transferred to the United States. Transfers are carried out based on Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) or adequacy decisions (EU-US Data Privacy Framework).
§9. Data Security
The Controller implements appropriate technical and organizational measures to protect personal data, including SSL/TLS encryption, access restrictions to authorized personnel only, and regular security reviews.
§10. Automated Decision-Making
The Controller does not use automated decision-making, including profiling, as referred to in Art. 22(1) and (4) GDPR.
§11. Changes to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy. Users will be informed of any changes through publication of the updated version on the website.
Effective date: May 1, 2026