Privacy policy

Who the controller is

The controller of your personal data is GFX3 Marcin Czerwik, ul. Baczyńskiego 14A lok. 14, 41-203 Sosnowiec, tax ID 6442887977.

For anything concerning personal data, write to websites@gfx3.pl. No data protection officer has been appointed. Matters concerning personal data go to the address above.

What data is collected and where it comes from

You provide it yourself, by using one of the forms on this site:

• Contact form – your name, e-mail address, optionally a phone number, and the content of your message. It writes nothing to the server: the message goes straight to the mailbox. Your IP address and the time of sending are appended to the footer of that e-mail as part of the anti-spam protection.
• Project brief – company name, contact person, e-mail, optionally a phone number, your answers about the project, and any files you attach. A brief is stored on the server together with your IP address, the time of sending and the exact wording of the consent you ticked – that record is the evidence of when and to what you consented.

Every submission passes through an anti-spam filter that uses no captcha and no third-party service. A submission the filter judges automated is held back together with its IP address, so a message caught by mistake can still be recovered. How long it is kept is stated below.

No special-category data is asked for; please do not put any into the content of a message.

Purposes and legal bases

• Answering your message – art. 6(1)(b) GDPR. By sending an enquiry you are yourself asking for steps prior to a possible contract, so no consent is needed and none is asked for.
• Preparing an offer from your brief – art. 6(1)(a) GDPR. Here consent IS required; you give it knowingly when submitting the brief, and its wording is stored with the submission.
• Concluding and performing a contract, should we work together – art. 6(1)(b) GDPR.
• Keeping the correspondence and defending against possible claims – a legitimate interest, art. 6(1)(f) GDPR. This basis matters: withdrawing a consent stops the processing that rested on it, but the correspondence itself may be kept to the extent necessary.
• Protecting the forms against spam – a legitimate interest, art. 6(1)(f) GDPR.
• Counting visits to the site's pages – a legitimate interest, art. 6(1)(f) GDPR. The site counts visits to its pages in aggregate: which page was viewed, which external site linked to it and on which day. No IP address, no browser details and no cookie are kept, and nothing is stored on the visitor's device. The counts are kept for 90 days, then deleted.
• Improving the site search – a legitimate interest, art. 6(1)(f) GDPR. What is typed into the site search is counted in aggregate per month: the query, how often it was searched, how often it found nothing and which result was opened. No IP address, no browser details and no cookie are kept, and queries that look like an e-mail address or a phone number are not stored at all. The counts are kept for 365 days, then deleted.
• Visit statistics – art. 6(1)(a) GDPR, given through the cookie bar and withdrawable at any time.
• Accounting and tax obligations, if it comes to an invoice – art. 6(1)(c) GDPR.

Providing your data is voluntary, but without an e-mail address there is no way to reply.

How long the data is kept

• Brief answers and attached files stored on the server – 90 days from submission, then deleted.
• Submissions held by the anti-spam filter – 30 days, then deleted.
• E-mail correspondence – 3 years from our last contact, on the basis of a legitimate interest.
• Accounting records, should any arise – 5 years from the end of the tax year, as required by law.

Who the data is entrusted to

Your data is neither sold nor shared. It is however handled by the services without which the site and the mail would not work – processors acting on the controller's instruction:

• Prociv Sp. z o.o. (vh.pl) – hosting of the server the site runs on.
• Vercom S.A. (EmailLabs) – delivery of the e-mails sent from the forms.
• Google Ireland Limited (Google Workspace) – receiving and storing the e-mail correspondence.
• Google Ireland Limited (Google Analytics) – visit statistics, only if you consent in the cookie bar. Without your consent the analytics script is not loaded at all.

Some of the services above may process data outside the European Economic Area. This happens on the basis of a European Commission adequacy decision (EU-U.S. Data Privacy Framework) and of the standard contractual clauses approved by the Commission. A copy of those safeguards is available on request.

Your rights

At any time you have the right to:

• access your data and obtain a copy of it,
• rectify inaccurate data or complete incomplete data,
• request erasure of the data,
• request restriction of processing,
• transfer the data to another controller,
• object to processing based on a legitimate interest, stating what in your situation speaks against it,
• withdraw a consent you have given, at any time. Withdrawal does not affect the lawfulness of the processing carried out beforehand.

You also have the right to lodge a complaint with the supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa) if you believe your data is being processed unlawfully.

Automated decisions and profiling

No decisions concerning you are taken automatically, and you are not profiled.

Cookies

Cookies are described separately, together with the option to change your mind about analytics – see the cookie policy.

Last updated: 2026-11-09.