Privacy Policy

1. Data Controller

The controller of personal data collected through the website ciraki.info is Ciraki, with its registered address at Inżynierska 1/3, Łódź, Poland. You may contact us regarding data protection matters by email at [email protected] or by phone at +48 601 300 444.

This Privacy Policy has been prepared in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, referred to as "GDPR"), and the Polish Act of 10 May 2018 on the Protection of Personal Data (Dz.U. 2018 poz. 1000, as amended).

2. Categories of Personal Data Collected

When you use the contact form on our website, we collect the following categories of personal data that you provide voluntarily:

• Full name
• Email address
• Subject of enquiry
• Message content

When you browse the website, technical data may be collected automatically, including your IP address, browser type and version, operating system, referral URL, and pages visited. This data is collected through cookies and similar technologies, as described in our Cookie Policy.

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, each supported by a specific legal basis under Article 6 GDPR:

• Responding to enquiries submitted via the contact form: Legal basis is Article 6(1)(b) GDPR — processing is necessary for the performance of a contract or to take steps prior to entering into a contract, or Article 6(1)(f) GDPR — our legitimate interest in responding to communications addressed to us.
• Ensuring the security and proper functioning of the website: Legal basis is Article 6(1)(f) GDPR — our legitimate interest in maintaining a secure and functional online presence.
• Analytical purposes using cookies (where consent is given): Legal basis is Article 6(1)(a) GDPR — your freely given, specific, informed, and unambiguous consent.
• Compliance with legal obligations: Legal basis is Article 6(1)(c) GDPR.

4. Data Retention Periods

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law.

Data submitted through the contact form is retained for a period of up to 24 months from the date of the last communication, unless a longer retention period is required for legal or contractual reasons. Technical and analytical data collected via cookies is retained in accordance with the periods specified in our Cookie Policy. Where processing is based on consent, data is retained until consent is withdrawn.

5. Recipients and Transfers of Personal Data

We do not sell, rent, or trade your personal data to third parties. Your data may be shared with the following categories of recipients where necessary:

• Hosting and infrastructure service providers who process data on our behalf under data processing agreements
• Email service providers used to handle enquiry correspondence
• Analytics service providers (only where you have given consent to analytical cookies)
• Public authorities, where disclosure is required by law

Where data is transferred outside the European Economic Area, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, such as Standard Contractual Clauses approved by the European Commission.

6. Your Rights as a Data Subject

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access (Article 15 GDPR): You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16 GDPR): You may request correction of inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR): You may request deletion of your personal data where there is no longer a lawful basis for processing.
• Right to restriction of processing (Article 18 GDPR): You may request that we limit how we use your data in certain circumstances.
• Right to data portability (Article 20 GDPR): Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object (Article 21 GDPR): You may object to processing based on legitimate interests.
• Right to withdraw consent (Article 7(3) GDPR): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days of receiving your request.

7. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Poland, the supervisory authority is:

Prezes Urzędu Ochrony Danych Osobowych (PUODO)
ul. Stawki 2, 00-193 Warsaw, Poland
Website: uodo.gov.pl
Email: [email protected]

You also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

8. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR. Decisions that affect you are made by humans, not automated systems.

9. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration. These measures are reviewed and updated regularly in line with current security standards. However, no method of electronic transmission or storage is completely secure, and we cannot provide an absolute guarantee of security.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this document. We encourage you to review this policy periodically. Continued use of the website after changes are posted constitutes your acknowledgment of the updated policy.