1. Controller and contact
The controller is Emil Konstanty Borowiecki, trading as ODKLEJPOL Emil Konstanty Borowiecki, ul. Festynowa 24B/4, Częstochowa, Poland, tax identification number 5732768565. Netaluno is a brand of this business. This policy covers netaluno.pl, netaluno.com and enquiries about our services.
For personal data matters, email contact@netaluno.com or kontakt@netaluno.pl, or call +48 513 212 909. The controller has not appointed a data protection officer.
2. Data and purposes
When you contact us by phone, email or WhatsApp, we process the information you provide, such as your name, company details, email address, phone number, message and attachments. We use it to respond, prepare a proposal and discuss working together.
If you enquire about entering into a contract on your own behalf, the basis is Article 6(1)(b) GDPR, taking steps at your request before entering into a contract. For other correspondence, including contact with company representatives, the basis is Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries and business contacts. We also rely on this basis to organise correspondence and tasks, and establish, exercise or defend legal claims.
We process data needed to perform a contract under Article 6(1)(b) GDPR, and data required by law, such as tax rules, under Article 6(1)(c) GDPR.
Providing enquiry data is voluntary, but without contact details or information about the matter we may be unable to respond or prepare a proposal. We do not use enquiry data for newsletters, bulk offers or remarketing.
3. Handling correspondence
We handle correspondence using OVHcloud email and Gmail. We also use OpenAI Codex to help review messages, prepare summaries and organise tasks. For these purposes, the tool may process sender details, message content and attachments made available to it.
We have disabled the use of our content and Codex environments for model training in OpenAI settings. We remain responsible for replies, proposals and decisions about working together. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on a person.
4. Website operation and security
Sevalla hosting, provided by Kinsta Inc. using Cloudflare infrastructure, handles requests needed to display and protect the website. Logs may include IP addresses, request times, visited paths, browser and device information, and response codes.
The basis is Article 6(1)(f) GDPR. Our legitimate interest is operating and securing the website and diagnosing faults. This processing is separate from optional Google analytics.
5. Analytics, cookies and browser storage
With your consent, we use Google Analytics 4 through Google Tag Manager. We analyse visited pages, visit sources, website use and the choice to contact us by phone, email or WhatsApp. Google receives information including cookie identifiers, browser and device information, and website activity. Our contact-click event sends the channel type without message content, email addresses or phone numbers.
The basis for analytics is consent under Article 6(1)(a) GDPR. We do not start Google Tag Manager or Google Analytics before consent. Refusal does not restrict website use. You can withdraw consent through “Analytics settings”. Withdrawal does not affect the lawfulness of earlier processing.
We store your choice in localStorage under netaluno-analytics-v1 for 180 days, separately for each domain. This storage remembers your decision. After consent, Google Analytics may set _ga and _ga_* cookies, normally valid for up to 2 years, with expiry potentially renewed during website use. Your browser may shorten this period. Withdrawing consent reloads the page and attempts to remove accessible analytics cookies. You can also remove browser data through your browser settings.
6. Recipients
Depending on the channel and purpose, recipients include Sevalla/Kinsta hosting and infrastructure providers, OVHcloud, Google, OpenAI and telecommunications providers. If you choose WhatsApp, WhatsApp Ireland Limited also processes data under its service rules.
Providers’ roles depend on the service. For ordinary Gmail and OpenAI services for individuals, Google and OpenAI process data under their own privacy policies. We do not describe these services as covered by Netaluno business data processing agreements.
We may also disclose data to authorities entitled to receive it by law.
7. Transfers outside the EEA
Using providers’ global infrastructure may involve processing outside the European Economic Area, including in the United States.
Providers’ documents describe mechanisms such as adequacy decisions or European Commission standard contractual clauses, depending on the service and transfer. Kinsta’s agreement includes standard contractual clauses. Google, OpenAI and WhatsApp describe their transfers and safeguards in the documents linked below. You can obtain information about safeguards and how to request copies from the controller and the relevant provider.
8. Retention
We retain enquiries that do not lead to cooperation for 12 months after the last contact. Where discussions continue or data is needed for claims, we retain the necessary information until discussions end, the applicable limitation period expires or proceedings conclude, as appropriate. We retain contract and accounting records for the periods required by applicable law and needed to handle claims.
Sevalla makes website log history available for up to 60 days. Information needed to investigate a particular incident may be retained while handling it or pursuing claims.
Google Analytics event data retention is 2 months and user data retention is 14 months, with the period reset on new activity. These settings do not cover most standard aggregate reports.
Browser storage periods are described in section 5. Providers acting as separate controllers also set their own retention periods. OpenAI describes retention that depends on factors including data type, settings, content deletion, and legal and security requirements.
9. Your rights
Subject to the GDPR, you may request access, rectification, erasure or restriction of processing. Data portability applies where the GDPR conditions are met.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may also withdraw consent where processing relies on it.
Send requests to the email addresses above. You may also complain to the President of Poland’s Personal Data Protection Office at uodo.gov.pl, or another competent supervisory authority.
10. Provider documents and policy changes
Further information is available in the provider documents linked below.
We update this policy when our processing practices or legal requirements change. The current version is available on this page.