The website has no contact form or user account area. Google Analytics is loaded only after the visitor voluntarily accepts analytics. No Google tag is downloaded before consent.
1. Data controller
The controller of personal data associated with this website is:
Smart Minds IT Michał Michna
ul. Zygmuntowska 6A/17
39-300 Mielec, Poland
Polish tax ID (NIP): 8171959742
Email: biuro@smartmindsit.pl
Phone: +48 505 494 767
Questions about personal data may be sent to the controller by email or raised by phone.
2. Data that may be processed
2.1. Technical data and server logs
When a page is requested, the hosting server may automatically record technical data such as the IP address, request date and time, requested URL, server response code, browser type, operating system and referring page if supplied by the browser.
This data is used to operate the website, diagnose errors, prevent abuse and investigate security incidents.
2.2. Data supplied when contacting us
If a visitor contacts Smart Minds IT by phone, SMS, email or WhatsApp, the controller processes the information contained in the message and the contact details required to respond and continue the discussion.
2.3. Analytics data
After consent, Google Analytics 4 may collect information about how the website is used, including visited pages, visit time and source, on-page events, approximate device and browser data, and clicks on contact channels.
The website does not configure User-ID, Google Signals or advertising personalisation.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering and securing the website | Technical data and server logs | Article 6(1)(f) GDPR — the controller’s legitimate interest in maintaining a secure and operational website |
| Responding to enquiries and preparing cooperation | Information supplied by email, phone, SMS or WhatsApp | Article 6(1)(b) GDPR where contact concerns a prospective or existing contract, or Article 6(1)(f) GDPR for other correspondence |
| Establishing, exercising or defending legal claims | Correspondence and agreed arrangements | Article 6(1)(f) GDPR |
| Measuring website use | Google Analytics 4 data | Article 6(1)(a) GDPR — consent; device storage and access are also governed by Article 399 of the Polish Electronic Communications Law |
| Complying with legal duties | Contract or billing data, if cooperation follows | Article 6(1)(c) GDPR |
5. Recipients and transfers outside the EEA
Data may be disclosed to service providers supporting the controller, but only to the extent required for the relevant service. These categories include:
- the hosting and server-infrastructure provider maintaining the website and technical logs;
- technical, legal or accounting service providers where their involvement is required;
- Google Ireland Limited — only after analytics consent;
- Meta Platforms and WhatsApp operators — only after a visitor deliberately opens WhatsApp or starts communicating through that service;
- telecommunications and email providers when a visitor uses phone, SMS or email.
Google and Meta may process information outside the European Economic Area. Their respective privacy documentation describes the applicable transfer mechanisms. Visitors should review those documents before using the services.
6. Data retention
- Server logs: retained for the period resulting from the hosting provider’s configuration and security rules, then deleted or rotated unless a specific entry is required to investigate an incident.
- Correspondence: retained for as long as required to handle the matter and subsequently for a period justified by legal obligations or the protection against claims.
- Contract and billing data: retained for periods required by tax, accounting and limitation rules.
- Google Analytics: user-level and event-level data is retained in accordance with the property configuration, with a target maximum of 14 months. Aggregated reports may remain available for longer under Google Analytics rules.
- Consent choice: retained until it is changed, site data is removed in the browser or the consent mechanism version changes.
7. Your rights
Subject to the conditions set out in the GDPR, data subjects may have the right to:
- access their data and obtain a copy;
- rectify inaccurate data;
- request erasure or restriction of processing;
- receive portable data where processing is based on consent or contract and carried out by automated means;
- object to processing based on legitimate interests;
- withdraw analytics consent at any time;
- lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or another competent supervisory authority.
Requests may be sent to biuro@smartmindsit.pl. The controller may request information necessary to verify the identity of the person making the request.
8. Contact channels and external links
The Email, Phone, SMS and WhatsApp buttons open the visitor’s relevant application or external service. Merely viewing the website does not transfer data to WhatsApp. Transfer begins only after the visitor follows the link and enters the provider’s domain or application.
The website may link to other websites. Once a visitor follows such a link, the external provider’s privacy rules apply.
9. Security and automated decisions
The website is static and has no login panel, user accounts or database used to render the pages. Communication with the domain should use encrypted HTTPS. Technical security headers and a limited set of external dependencies are applied.
Website data is not used to make decisions based solely on automated processing that produce legal effects or similarly significantly affect visitors.
10. Changes to this policy
This policy may be updated when the website is expanded, new integrations are added, providers change or legal requirements change. The current version is published at this permanent URL together with its last-updated date.
This policy was prepared for the current configuration: a static website without a form, optional Google Analytics after consent and contact through external channels. Adding a form, map, embedded video, chat, newsletter or new measurement technology requires the policy and consent mechanism to be reviewed.