1. This Privacy Policy sets out the rules for the processing of personal data collected via the website gjmb.pl, hereinafter referred to as the “Website”.2. The owner of the Website and, at the same time, the Data Controller is Mateusz Białas, 02-505 Warsaw, Kraushara 1/22, hereinafter referred to as the Controller.
3. Personal data collected by the Controller via the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter also referred to as the GDPR.
4. The Controller takes particular care to respect the privacy of Clients visiting the Website.
§ 1 Type of data processed, purposes and legal basis
1. The Controller collects information concerning natural persons carrying out legal transactions not directly related to their business activity, natural persons conducting business or professional activity on their own behalf, as well as natural persons representing legal persons or organisational units without legal personality which are granted legal capacity by law and which conduct business or professional activity on their own behalf, hereinafter jointly referred to as Clients.
2. The Controller processes Clients’ personal data in connection with the use of the contact form service available on the Website, to the extent necessary for the performance of a contract or in order to take steps prior to entering into a contract – the legal basis for processing is Article 6(1)(b) of the GDPR
3. When using the contact form service, the Client provides the following data:
email address
first name
telephone number
4. When using the Website, additional information may be collected, in particular: the IP address assigned to the Client’s computer or the external IP address of the Internet service provider, domain name, browser type, access time and operating system type. Navigation data may also be collected from Clients, including information about links and references they choose to click on or other activities undertaken on the Website for purposes related to the provision of services, as well as for technical, administrative, analytical and statistical purposes – in this respect, the legal basis for processing is also Article 6(1)(f) of the GDPR, i.e. processing necessary for the purposes of the legitimate interests pursued by the Controller, namely ensuring IT security and managing the Website, as well as improving the functionality of the Website and the services provided.
§ 2 Recipients of data
1. The Client’s personal data is transferred to service providers used by the Controller in connection with operating the Website. Depending on contractual arrangements and circumstances, service providers to whom personal data is transferred either act on the Controller’s instructions with regard to the purposes and means of processing such data (processors) or independently determine the purposes and means of processing (controllers).
1.1. Processors. The Controller uses providers that process personal data exclusively on the Controller’s instructions. These include, among others, providers of hosting services, accounting services, marketing systems, Website traffic analysis systems and marketing campaign effectiveness analysis systems
1.2. Controllers. The Controller uses providers that do not act exclusively on instructions and independently determine the purposes and means of using Clients’ personal data. They provide electronic payment and banking services.
2. Location. Service providers are based primarily in Poland and other countries of the European Economic Area (EEA).
3. Upon receiving a relevant request, the Controller makes personal data available to authorised state authorities, in particular organisational units of the Public Prosecutor’s Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.
§ 3 Data retention period
1. Clients’ personal data is stored:
1.1. Where the legal basis for the processing of personal data is consent, the Client’s personal data is processed by the Controller until the consent is withdrawn, and following its withdrawal, for a period corresponding to the limitation period for claims that may be raised by the Controller or against the Controller. Unless a specific provision provides otherwise, the limitation period is six years, and for claims concerning periodic benefits and claims related to conducting business activity – three years.
1.2. Where the legal basis for data processing is the performance of a contract, the Client’s personal data is processed by the Controller for as long as necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a specific provision provides otherwise, the limitation period is six years, and for claims concerning periodic benefits and claims related to conducting business activity – three years.
§ 4 Cookies mechanism, IP address
1. The Website uses small files known as cookies. They are stored by the Controller on the end device of the person visiting the Website, provided that the web browser allows this. A cookie file usually contains the name of the domain from which it originates, its “expiry time” and an individual, randomly selected number identifying the file. Information collected using such files helps tailor the products offered by the Controller to the individual preferences and actual needs of persons visiting the Website
2. The Controller uses two types of cookies:
2.1. Session cookies: after the browser session ends or the computer is switched off, the stored information is deleted from the device’s memory. The session cookie mechanism does not allow any personal data or confidential information to be retrieved from Clients’ computers.
2.2. Persistent cookies: these are stored in the memory of the Client’s end device and remain there until they are deleted or expire. The persistent cookie mechanism does not allow any personal data or confidential information to be retrieved from Clients’ computers.
3. The Controller uses first-party cookies for the purpose of:
3.1. analysis, research and audience measurement, in particular to create anonymous statistics that help understand how Clients use the Website, enabling improvements to its structure and content.
4. The Controller uses third-party cookies for the purpose of:
4.1. displaying, on the Website’s information pages, a map showing the location of the Controller’s office using the maps.google.com service (controller of the third-party cookies: Google Inc, based in the USA)
5. The cookie mechanism is safe for the computers of Clients visiting the Website. In particular, it is not possible for viruses or other unwanted or malicious software to access Clients’ computers by this means. Nevertheless, Clients may restrict or disable cookies in their browsers. If this option is used, the Website will still be accessible, except for functionalities which, by their nature, require cookies.
6. The Controller may collect Clients’ IP addresses. An IP address is a number assigned to the computer of a person visiting the Website by their Internet service provider. The IP number enables access to the Internet. In most cases, it is assigned dynamically to the computer, i.e. it changes each time the device connects to the Internet and, for this reason, is commonly regarded as non-personal identifying information. The IP address is used by the Controller to diagnose technical problems with the server, prepare statistical analyses (e.g. to determine from which regions the highest number of visits is recorded), as information useful for administering and improving the Website, as well as for security purposes and for the potential identification of unwanted automated programs placing a burden on the server by browsing the Website’s content.
§ 5 Rights of data subjects
Persons whose data is processed have the following rights:
1. Right to withdraw consent to data processing at any time:
1.1. The Client has the right to withdraw any consent previously granted
1.2. Withdrawal of consent takes effect from the moment the consent is withdrawn
1.3. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal
1.4. Withdrawal of consent does not result in any negative consequences for the Client; however, it may prevent further use of services or functionalities which the Controller may lawfully provide only with consent
2. Right to object to data processing:
2.1. The Client has the right, at any time, on grounds relating to their particular situation, to object to the processing of their personal data based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. The Controller may no longer process such personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims
2.2. Unsubscribing by email from receiving marketing communications concerning products or services will constitute the Client’s objection to the processing of their personal data, including profiling for these purposes
3. Right to erasure (“right to be forgotten”):
3.1. The Client has the right to request the erasure of all or some of their personal data
3.2. The Client has the right to request the erasure of personal data if:
3.2.1. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed
3.2.2. the Client has withdrawn specific consent to the extent that the personal data was processed on the basis of that consent
3.2.3. the Client has objected to processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or has objected to processing pursuant to Article 21(2) of the GDPR
3.2.4. the personal data has been unlawfully processed
3.2.5. the personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which the Controller is subject
3.2.6. the personal data has been collected in connection with the provision of information society services
3.3. Despite a request for the erasure of personal data following an objection or withdrawal of consent, the Controller may retain certain personal data to the extent that processing is necessary for the establishment, exercise or defence of legal claims, as well as for compliance with a legal obligation requiring processing under Union law or the law of a Member State to which the Controller is subject. This applies in particular to personal data including: first name, surname and email address, which is retained for the purpose of handling complaints and claims related to the use of the Controller’s services, as well as residential address/correspondence address and order number, which is retained for the purpose of handling complaints and claims related to concluded sales agreements or the provision of services
4. Right to restriction of data processing:
4.1. The Client has the right to request restriction of the processing of their personal data. Submitting such a request, until it has been considered, prevents the use of certain functionalities or services where their use involves the processing of data covered by the request. The Controller will also refrain from sending any communications, including marketing communications
4.2. The Client has the right to request restriction of the use of personal data in the following cases:
4.2.1. where the Client contests the accuracy of their personal data – in such case, the Controller restricts its use for the period necessary to verify the accuracy of the data, but for no longer than 7 days
4.2.2. where the processing is unlawful and, instead of requesting erasure of the data, the Client requests restriction of its use
4.2.3. where the personal data is no longer necessary for the purposes for which it was collected or used, but is required by the Client for the establishment, exercise or defence of legal claims
4.2.4. where the data subject has objected to the processing of their data – pending verification as to whether the legitimate grounds of the Controller override those of the data subject
5. Right to request access to personal data from the Controller and to receive a copy thereof:
5.1. The Client has the right to obtain confirmation from the Controller as to whether personal data concerning them is being processed and, where that is the case, the Client has the right to:
5.1.1. obtain access to their personal data
5.1.2. obtain information about the purposes of processing, categories of personal data processed, recipients or categories of recipients of such data, the envisaged period for which the Client’s data will be stored or, if it is not possible to specify that period, the criteria used to determine it, the rights available to the Client under the GDPR and the right to lodge a complaint with a supervisory authority, and, where the personal data has not been collected from the data subject, any available information as to its source, as well as the existence of automated decision-making, including profiling referred to in Article 22(1) and (4) of the GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject and the safeguards applied in connection with the transfer of personal data outside the European Union
5.1.3. obtain a copy of their personal data. The right to obtain a copy must not adversely affect the rights and freedoms of others
6. Right to rectification (correction) of data:
6.1. The Client has the right to request that the Controller rectify inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the Client whose data is concerned has the right to request completion of incomplete personal data, including by providing a supplementary statement, by submitting a request to the email address specified in §6 of the Privacy Policy
7. Right to data portability:
7.1. The Client has the right to receive the personal data they have provided to the Controller and subsequently transmit it to another personal data controller of their choice. The Client also has the right to request that the personal data be transmitted by the Controller directly to such controller, where technically feasible. In such a case, the Controller will transmit the Client’s personal data in the form of a CSV file, which is a commonly used, machine-readable format that allows the received data to be transmitted to another personal data controller
8. Right to lodge a complaint with a supervisory authority:
8.1. The Client has the right to lodge a complaint with the President of the Personal Data Protection Office concerning an infringement of their rights relating to the protection of personal data or other rights granted under the GDPR
9. Where the Client exercises any of the rights referred to above, the Controller will comply with the request or refuse to comply with it without undue delay and no later than within one month of receiving it. However, if – due to the complexity of the request or the number of requests – the Controller is unable to comply with the request within one month, it will comply within a further two months, having informed the Client within one month of receiving the request of the intended extension and the reasons for it
10. The Client may submit complaints, enquiries and requests to the Controller concerning the processing of their personal data and the exercise of their rights
§ 6 Changes to the Privacy Policy
1. The Privacy Policy may be amended, and the Controller is not obliged to provide notification of such amendments.
2. Questions concerning the Privacy Policy should be sent to the following email address: [loupgarou@wp.pl](mailto:loupgarou@wp.pl)3. Date of last modification: 14.09.2026
