In short: we collect only the data needed to answer your request and run this site. We do not sell data, we do not send newsletters, and we enable Google's analytics and advertising tools only with your consent. We do not transfer data outside the European Economic Area without a legal basis.
1. Who is the controller
The controller of your personal data is HOLAPOLSKA sp. z o.o., ul. Kielecka 1/2, 31-526 Kraków, Poland, entered in the National Court Register (KRS) under number 0001259508, NIP 6751831638, REGON 545442954, share capital 5 000,00 zł.
For any data protection matter write to biuro@holapolska.pl. We have not appointed a Data Protection Officer as we are not required to; these matters are handled directly by the management board.
2. What data we collect
- From the contact form (including when you request the free 30-minute diagnostic consultation): full name, email address, phone number (optional), the topic you select, the service you are interested in and your message (optional).
- From the checklist form on our guides: full name, email address and phone number (optional). Anyone can read the guides without registering; you only fill in this form if you want the free checklist sent to you by email.
- From correspondence by email or WhatsApp: the data you share with us, such as your phone number, profile name and the content of your messages.
- Automatically, in server logs: IP address, date and time of the request, the URL requested and browser type. This data is generated technically on every connection.
- From cookies and similar technologies: only to the extent described in the Cookie policy and, apart from strictly necessary ones, only with your consent.
- From the consent record: a random identifier, the date and time, the policy version and the choices you make in the cookie banner. We do not store your IP address in this record.
We do not collect special categories of data (Art. 9 GDPR) and we ask you not to include such data in your message.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering your contact form message, including a request for the free diagnostic consultation, and taking steps at your request prior to a contract | Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR — our legitimate interest in replying to you | 12 months from last contact |
| Sending you the checklist you requested by email | Art. 6(1)(b) GDPR | 12 months from last contact |
| Contacting you about the service related to the guide whose checklist you requested | Art. 6(1)(f) GDPR — legitimate interest; you may object at any time | 12 months from last contact or until you object |
| Maintaining correspondence (email, WhatsApp) and business contact | Art. 6(1)(f) GDPR — legitimate interest | 12 months from last contact |
| Statistics (Google Analytics 4) and advertising conversion measurement (Google Ads) | Art. 6(1)(a) GDPR — your consent | until withdrawn, max. 24 months |
| Demonstrating that you gave cookie consent (consent record, Art. 7(1) GDPR) | Art. 6(1)(c) in conjunction with Art. 7(1) GDPR | as long as needed to demonstrate consent, max. 3 years |
| Site security and abuse prevention | Art. 6(1)(f) GDPR | up to 12 months (server logs) |
| Performance of a contract, if concluded | Art. 6(1)(b) GDPR | duration of the contract |
| Accounting and tax obligations | Art. 6(1)(c) GDPR | 5 years from the end of the tax year |
Form submissions reach us by email. So that no request gets lost, we also keep a copy on our server in the European Union (with a hosting provider established in the EU), for the same period: 12 months from last contact. We do not sign you up to any newsletter or send automated message sequences.
4. Is providing data mandatory?
It is voluntary, but without the fields marked as required in the form — in particular your email address — we cannot reply to you or send you the checklist. Your phone number is always optional.
5. Who we share data with
Your data may be processed by trusted providers who serve us, only as far as necessary and under a data processing agreement (Art. 28 GDPR):
- hosting and email provider established in the EU,
- Google Ireland Limited, as the provider of analytics and advertising tools, only if you give consent,
- accounting office and advisers, if a contract is concluded,
- public authorities, where required by law.
We do not sell or disclose personal data to third parties for marketing purposes.
6. WhatsApp and social media profiles
WhatsApp. Contacting us via WhatsApp is your choice; you can always write to us by email instead. If you choose WhatsApp, data relating to the conversation is also processed by WhatsApp Ireland Limited (Meta group) under its own terms and privacy policy, including any transfers outside the EEA. We use the conversation only to answer you.
LinkedIn, Instagram, Facebook. The site contains only plain links to our profiles. We do not embed plugins or buttons from these platforms, so visiting our site does not send them any data. If you go to a social network, its operator's terms apply there.
7. Google tools and transfers outside the EEA
Our infrastructure is kept within the European Union. Google Tag Manager, Google Analytics 4 and Google Ads conversion measurement are loaded only after you give consent in the cookie banner (Google Consent Mode, basic implementation). Until you do, your browser makes no requests to Google.
Once you consent, data may be processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which can involve a transfer to the United States. This relies on the European Commission adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) and on standard contractual clauses. Without your consent no such transfer takes place.
8. Your rights
- access to your data and a copy of it (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection at any time to processing based on legitimate interest, including being contacted about the service related to a checklist (Art. 21 GDPR),
- withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR).
Simply write to biuro@holapolska.pl. We respond without undue delay and within one month at the latest.
9. Right to complain
If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. You may also contact the supervisory authority of the EU Member State of your habitual residence or place of work (Art. 77 GDPR).
10. Profiling and automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
11. Security
We apply technical and organisational measures appropriate to the risk: encrypted connection (TLS), restricted access to data, backups and protection of our forms against abuse. The forms are protected by methods that run on our own server — we do not use external CAPTCHA systems, which would require disclosing your IP address to third parties.
12. Changes to this policy
We may update it when the law or the way the site works changes. The current version is always published at this address, with the date shown below.
Last updated: 14 October 2026