Privacy policy

The controller of personal data is [[DO UZUPEŁNIENIA: pełna nazwa prawna firmy]], [[DO UZUPEŁNIENIA: adres siedziby]], NIP [[DO UZUPEŁNIENIA: NIP]]. Contact for data matters: [[DO UZUPEŁNIENIA: e-mail kontaktowy]].

Data protection officer: [[TO BE COMPLETED: whether a DPO has been appointed]].

Data from the contact form, the brief and investor-area access requests: full name, email, optionally phone, company or organisation, city, date, message, client type, event details (brief).

Technical data: site language, page path and campaign parameters (UTM), a hash of the IP address (an irreversible HMAC code used to limit submissions – we do not store the IP address itself), hosting server logs.

Files uploaded in the “Your ad above the city” configurator are processed only in your browser and never reach our server.

Replying to an enquiry and preparing an offer – Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (legitimate interest: business contact).

Sending news – Art. 6(1)(a) GDPR (consent, which you may withdraw at any time).

Spam and abuse prevention, site security – Art. 6(1)(f) GDPR.

Establishing, pursuing or defending claims – Art. 6(1)(f) GDPR.

We keep form data for up to 12 months after our last contact, after which the system deletes it automatically. If we enter into a contract, data needed to settle it is kept for the period required by law (including tax law).

Marketing consent is kept until withdrawn.

Application and database hosting: Railway Corporation (region: [[TO BE COMPLETED: Railway region, EU West recommended]]).

Email delivery: [[TO BE COMPLETED: email provider – Resend Inc. or SMTP server]].

Bot protection for forms: Cloudflare Turnstile (Cloudflare, Inc.), if enabled.

Cookieless analytics: [[TO BE COMPLETED: Plausible / Umami – if enabled]].

Data is not sold or shared with third parties for marketing.

Some providers are based in the USA. Transfers rely on the European Commission's decision (EU–US Data Privacy Framework) or standard contractual clauses. [[TO BE COMPLETED: confirm the basis for each provider]].

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting the lawfulness of prior processing).

You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise your rights, write to [[DO UZUPEŁNIENIA: e-mail kontaktowy]].

We do not use analytics or marketing cookies, so the site shows no consent banner.

Technical cookies: NEXT_LOCALE (remembered language), tabi_investor (investor-area access after entering a code, 30 days), tabi_admin (administrator panel only).

Browser storage: localStorage – chosen theme (light/dark); sessionStorage – campaign parameters (UTM) until the end of the visit.

We do not make automated decisions or profile users.

We will announce material changes on this page. The date of the last update is shown at the top.