PRIVACY

Your details and contact with the studio

Information on the processing of personal data

Who is responsible for the data?

In terms of jointly handling enquiries from the website and determining cooperation proposals, the joint data controllers are:

• Pasjonujące Wnętrza Filip Tokarz, Targoszyn 30/1, 59-407 Mściwojów, NIP 6951537777; email pasjonujacewnetrza@gmail.com.
• Archipelag Pomysłów Inez Wersocka-Tokarz, Targoszyn 30/1, 59-407 Mściwojów, NIP 6951106296; email archipelagpomyslow@gmail.com.

You can contact us regarding your data and exercise your rights towards each of us. Joint processing of an enquiry does not automatically mean concluding an agreement with both companies. The contractor and the terms of the specific contract are indicated in the presented offer and contract.

How do we divide responsibility?

Filip Tokarz is responsible for the technical maintenance of the website and dashboard, and for contact with the hosting provider. Both Filip Tokarz and Inez Wersocka-Tokarz handle customer enquiries: they read and answer messages and agree the next steps. Each is responsible for the proper use and protection of data in the matters they handle. We cooperate to protect jointly processed data and respond to requests concerning individual rights. You can contact either of us; this division of responsibilities does not limit your rights in relation to either joint controller.

Why do we collect data?

An email address and a message are required to use the form. Your full name, telephone number, town or city, floor area, property type and requested services are optional. We use these details to respond and prepare a proposal. The form cannot be submitted without the required details, but you can still call or email us.

We process requests for a quote in order to take action at your request before concluding a contract (Article 6(1)(b) of the GDPR). We process the remaining correspondence and data necessary to protect against abuse on the basis of a legitimate interest: conducting correspondence and securing the website (Article 6(1)(f) of the GDPR). The form does not subscribe you to the newsletter.

Where does the message go?

We store messages in a private dashboard hosted by SEOHOST, accessible only to authorised people. We send only a notification with a link to the dashboard to pasjonujacewnetrza@gmail.com, a Google email account. The notification contains no form content, email address, telephone number or other customer data. Enquiry details are accessible after logging in. Direct email correspondence is handled separately in Gmail. Hosting and email providers, and people authorised by the controllers, may process data as necessary to handle an enquiry. SEOHOST provides the hosting. Using Google services may involve processing outside the European Economic Area, subject to the terms and safeguards described in Google’s information on international data transfers.

After logging in to the panel, the owner's browser is excluded from the statistics. We retain the technical tag pw_owner_browser for 180 days; it does not give access to the panel.

How long do we store data?

We store correspondence for the time necessary to handle the enquiry and related arrangements. If it leads to the conclusion of a contract, we store the data for the duration of its implementation and then for the period required by law or necessary to establish, pursue or defend claims. We delete data that is unnecessary for these purposes.

We store enquiries and related correspondence for no longer than 12 months from the last substantive contact, unless they are no longer needed earlier. We store data required for the performance of a contract, legal obligations or the protection of legitimate claims separately for a period appropriate to a given purpose. The owner periodically reviews and removes unnecessary enquiries; simply changing a note or status does not extend the retention period. Automatic enquiry deletion is not enabled. Email correspondence and hosting backups are kept separately; deleting an entry in the panel does not automatically delete them. The data is not publicly available. Spam protection stores an IP hash and submission IDs; entries older than one hour are deleted on the next successful sending attempt. The hosting server may save technical logs, including IP address, time and request address, for security and diagnostic purposes.

What are your rights?

You can request access to your data, rectification, erasure or restriction of processing. Where provided for by law, you have the right to data portability and the right to object to processing based on legitimate interests. You can lodge a complaint with the President of the Polish Personal Data Protection Office. We do not make decisions about you based solely on automated processing or profile you for marketing purposes.

Statistics and cookies

Only with your consent (Article 6(1)(a) of the GDPR), we measure the source of visits, page views and engagement and link the enquiry to the current visit. We save a random browser and visit ID, source category (e.g. Facebook), subpage path without parameters and time. We do not save full referrer addresses or advertising parameters. We do not send these statistics to Facebook, Google, Instagram or TikTok. We store statistical data for up to 90 days. Their deletion takes place as part of the data review by the administrator; automatic cleaning is not enabled. The source category of an enquiry is retained for the enquiry retention period.

You can refuse or withdraw your consent using the “Cookie settings” button in the footer. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. The form also works without consent; in that case, we do not attribute the enquiry to an analytics source.

• pw_choice — necessary to remember consent or refusal, 180 days.
• pw_consent — after acceptance, secured server ID of the consent record, up to 180 days. Deleted when consent is withdrawn.
• pw_visitor - after consent, random browser ID, up to 90 days from the start of the visit.
• pw_visit — after consent, visit ID, 30 minutes from the last event.
• pw_admin — necessary login session to the owner's panel; expires after closing the browser, access for a maximum of 8 hours, with logging out after 30 minutes of inactivity.

Dashboard security is based on legitimate interests (Article 6(1)(f) of the GDPR). We limit login attempts using an IP address hash retained for up to 24 hours, and keep an activity log for 90 days. Backups of edited pages do not contain the enquiry database; we retain the latest 30 versions. Additional manual dashboard backups include the database and access data. They are stored outside the public directory and are accessible only to the hosting administrator. These backups are reviewed when data is deleted. If a backup is restored, previous deletions must be applied again.

The panel owner can additionally secure login with a one-time code from the authentication application. We only store recovery codes as hashes, outside the public website directory.

The server stores proof of consent to statistics: random identifier hash, scope, information version, time of granting and possible withdrawal. We keep proof of consent for 365 days. Setting a cookie alone is not sufficient to start the measurement without a valid consent record on the server.

External links

The form itself does not require analytics cookies. We do not use advertising pixels or automatic newsletter subscription. Links to Facebook, Instagram and TikTok lead to external sites that apply their own privacy policies.